Privacy Policy – Giraffa
Giraffe Urban Experiences Ltd.
Last updated: August 9, 2026
1 · General
Giraffe Urban Experiences Ltd., Company ID 516096815, of 41 HaNatziv Street, Tel Aviv-Yafo ("the Company", "we"), operates guided culinary tours, self-guided tours, and corporate and personal gift packages. This policy explains what personal information we collect, for what purpose, what we do with it, and what rights you have. It was written in accordance with the Privacy Protection Law, 5741-1981, as amended following Amendment 13.
The policy is phrased in the plural and addresses all genders.
2 · Consent
Wherever we ask you for details, we will explain what they are needed for. Providing the details is up to you, but without some of them, we will not be able to complete the order.
We will ask for your consent separately for two things: registration for the newsletter and marketing mailings, and measurement and advertising cookies. Consent is given by your proactive marking, it is not a condition for placing the order, and you may withdraw it at any time without affecting the service you receive.
3 · What information we collect
Information that you provide to us. For example: full name, phone number, email, delivery address, dietary and kosher preferences, building entry code for package delivery, and VAT/business registration number when business billing is required.
Information generated as a result of the interaction. For example: details of the orders you placed, your purchase history, and records of customer service inquiries.
Technical information. For example: IP address, approximate geographic location, browser type and operating system, and site usage data collected through cookies.
Information about you provided by another person: When an organization orders packages for its employees, or when a person purchases a tour for you as a gift, your details are provided to us by them. The provider undertakes toward us that they are authorized to provide them and that they have informed you of this, and we will mention this in our first communication with you.
4 · Information we do not collect
We do not collect allergies or medical information, even if provided on your own initiative. We collect dietary preferences only, and we assume no responsibility for the medical suitability of the food.
We do not store ID numbers. To the extent that identification is required for clearing purposes, it is transmitted directly to the clearing company and is not stored by us.
We do not store your payment method details. The clearing company stores the last four digits of the card, and we only have permission to view them for the purpose of identifying the transaction and handling billing inquiries.
5. Specially sensitive information
Kosher and dietary preferences are considered sensitive information. We ask for them only when required for menu customization, providing them is up to you, and the information is deleted up to 60 days after the tour date.
6 · Call Recording
Calls to customer service may be recorded for service quality control and order documentation. Notice of this will be given at the beginning of the call, and you may request not to be recorded.
7 · Why we use information
Provision of the service you ordered: order fulfillment, scheduling date and location, assigning an instructor, and menu customization.
Logistics and deliveries, including providing destination details to the courier company.
Collection, billing, and generation of accounting documents.
Customer service, inquiry handling, refunds, and billing corrections.
Marketing emails from Giraffe, subject to your consent and the right to opt out at any time.
Maintaining website security, preventing fraud, and complying with legal obligations.
8 cookies
A cookie is a file containing an identifier sent by a web server to a browser and stored by it. Persistent cookies are stored in the browser until their expiration date or until you delete them, and session cookies are deleted when you close the browser.
We use three categories of cookies. Necessary cookies, which enable the operation of the website and the shopping cart, and do not require consent. Measurement and analytics cookies, including Google Analytics, which are used to understand how the website is used. And marketing and advertising cookies, which are used to display personalized advertisements. The latter two categories operate only after you have given separate consent in the consent banner, and the choice can be changed.
9 · Transfer of information to others
As a general rule, we do not share personal information with third parties, and we do not sell it to anyone. The exceptions are as follows:
Courier companies that receive a name, address, phone number, and entry code for the purpose of delivering the shipment only.
System providers whose systems we use to manage our operations, who process information for us and in accordance with our instructions.
For tours marketed by a content creator: Name, email, and phone number will be provided to the creator only if you have indicated separate and explicit consent during the purchase. As long as such consent has not been given, no personal information is provided to the content creators.
Authorities and courts, when required by law or in the context of a legal proceeding, as well as for the purpose of establishing or defending our legal rights.
A potential buyer of the company's business, as part of a transaction and subject to the preservation of your rights.
Aggregate statistics on sales volumes may be provided to business partners and content creators. These data do not include identifying details and do not allow the identification of any specific individual.
10 · Where is the information stored
The information is managed in Monday, Airtable, and Flashy systems, on the company website, and in the PayPlus billing system. Some of these systems are cloud services whose servers are located outside of Israel, and therefore the information is also stored outside the country's borders. The engagement with them is made under their standard terms of use, which include a commitment to information security.
11 · Retention periods
Dietary and kosher preferences are deleted up to 60 days after the tour.
The building entry code is deleted immediately upon delivery.
Billing and accounting data are kept for seven years, as required by tax laws.
The consent and unsubscribing record from the mailing list, which includes the registration date, the consent text, and the unsubscribing date, is kept indefinitely. The record serves two purposes: to ensure we do not contact you again after you have asked to unsubscribe, and to prove that consent was given. The subscription itself remains active as long as you have not requested to unsubscribe.
Customer details and order history are kept as long as they are required for managing customer relations and providing ongoing service, and their deletion can be requested at any time.
Notwithstanding the above, we will retain documents containing personal data when required by law, or when they may be relevant to ongoing or anticipated legal proceedings.
12 · Information Security
We take reasonable organizational and technical measures to prevent the loss, misuse, or alteration of the information.
The company maintains a written information security procedure, manages access permissions by role and revokes them upon termination of employment, and logs security events. Payment transactions are processed through a certified clearing company and via an encrypted connection.
You acknowledge that the transmission of information over the Internet is inherently insecure, and we cannot guarantee the security of data sent via the Internet.
13 · Your rights
Right of access: To receive from us the information held about you. We will verify your identity using reasonable and proportionate means.
Right to rectification: to request the correction of information that is incorrect, incomplete, unclear, or out of date.
Right to erasure: the right to request the deletion of data, subject to legal retention obligations.
Right to opt-out: To instruct us at any time to stop contacting you with marketing communications.
We will process your request within 30 days. If we deny the request, we will provide a reasoned written notice within 21 days, and you may appeal to the Privacy Protection Authority or the court.
14 · Contact Us
For questions, requests, or complaints regarding this policy and the exercise of your rights: Giraffe Urban Experiences Ltd., 41 HaNatziv St., Tel Aviv-Yafo. Email: [email protected]. The company's privacy officer: Nadav Mendelson.
If you are not satisfied with the handling of your request, you may contact the Privacy Protection Authority by phone at 02-5097000 or by email at [email protected].
15 · Policy Changes
We may update this policy from time to time by posting a new version on the website. Material changes will be brought to your attention.
Last updated date: August 9, 2026.
This policy was written in accordance with the Privacy Protection Law, 5741-1981, as amended by Amendment 13.