
Participant Management Software: A Tour Operator's Guide
Most participant management software is built for conferences, not tours. Here's what multi-day operators actually need: staged payments, structured traveler records, and manifest-ready data.

Emergency contacts fail in the field because they're incomplete or the named person is on the same trip. Here's how to collect, verify, and carry them properly.
By Valentin Fily
A guide is halfway up a mountain when a traveler slips on wet rock. The phone shows no signal. The injured person can't explain what medication they take, and the guide can't reach the relative listed on a booking note because that relative is sitting in the same group, ten meters away.
That is where an emergency contact form earns its place. Not at the desk during a quiet afternoon, and not as another box to complete before payment, but beside a printed manifest when the group is remote and somebody else must act quickly.

For owner-operators with small teams, the awkward parts are usually the important parts. The listed contact may also be traveling. They may not know their details were provided. The traveler may have named somebody who has no authority to make a medical decision. Meanwhile, the guide needs the information offline, while the business has a responsibility to restrict access and delete it when the trip is over.
Government and institutional travel workflows already treat emergency contacts as an operational safety record, not a casual address-book entry. Modern forms commonly include personal contacts, destination contacts, hospitals, police, fire services, embassies, insurance providers, and assistance numbers, with guidance to keep copies on a phone, by email, and on paper. The U.S. Department of State emergency guidance also publishes dedicated crisis numbers, including 1-888-407-4747 from the United States and Canada and +1-202-501-4444 from overseas.
A useful emergency planning structure borrows from the wider discipline of a formal emergency response plan, where access, escalation, ownership, and records have to work under pressure rather than merely look complete in a policy folder.
The practical answer is a carry-and-delete workflow. The business collects structured information after booking, verifies it before departure, gives the guide a controlled offline copy, limits internal access, and removes the record after the trip. The sections below show how to build that without turning checkout into a paperwork obstacle.
The first failure usually looks harmless. A booking contains a name and mobile number, so the team assumes the emergency contact is covered. On departure day, the guide discovers that the number belongs to the traveler's partner, who is also on the trek. The second number is a work line that nobody answers outside office hours. The form exists, but it doesn't connect the injured traveler to anyone outside the incident.
That distinction matters most for a one-to-twenty-person adventure business — the kind running remote trekking and hiking departures where the group can be hours from a road. A large travel company may have a security desk, a duty officer, and a response provider. A small operator often has a guide, an owner, and a printed manifest. The form must therefore help the person physically with the group make the next call when the normal booking system, mobile signal, and office team are unavailable.
Field rule: A contact record isn't ready because every box is filled. It's ready when the guide can use it without guessing.
The information also has to survive the conditions in which it will be used. Official travel templates instruct travelers to save details on a phone, email copies to themselves and a trusted contact, and carry hard copies. University travel-risk forms use similar structures, including destination emergency contacts and separate home-country emergency contacts. That redundancy reflects a simple problem: phones get lost, networks fail, and an injured person may not be able to speak.
The privacy side is just as uncomfortable. Emergency contact details belong to somebody who isn't the customer. The traveler may provide the information, but that doesn't mean the third party agreed to have it stored indefinitely or shared with an entire team. A shared inbox or spreadsheet on a personal laptop is common in small businesses, but it's also the first operational weakness worth fixing.
The form should answer five practical questions before the group leaves:
By the end of the setup, the business should have a short collection form, a verification routine, a restricted record, and a printable manifest that can be sealed, carried, and destroyed after use.
A reliable form starts with information the guide can act on quickly. US passenger-manifest rules for covered international flights (14 CFR Part 243) require a 24-hour emergency point of contact with a full name and telephone number, with an email address recommended but not required. That is a useful floor for any operator's own form.
Collect the traveler's emergency contact as a person, not as an unstructured note.
The form should also record country code, preferred contact method, and language where relevant. International travelers often name someone in another country, so a bare local-format number can be useless to a guide using a different phone system.

The first missing field asks whether the contact is also on the trip. This should be a direct yes-or-no question for every named person. Couples, families, and friends frequently nominate one another because they're completing the form together. That contact can't serve as the outside point of communication if they're injured, separated, or unreachable on the same route.
The second asks whether the contact knows they've been named. A checkbox such as “Yes, this person knows” is clearer than a general consent sentence buried below the form. It also creates a prompt for the traveler to call the person and confirm the details.
The third asks who may make a medical decision if the traveler can't speak. The answer might be a named relative, a legal representative, or “no authority granted”. The form shouldn't imply that naming somebody automatically gives them legal authority. It should record the traveler's stated preference and direct the operator to seek appropriate professional advice about local requirements.
Minors need a responsible adult identified in a way the guide can understand, while international groups may need country, language, and time-zone context. Keep those questions conditional where possible. A short form can still be precise if it blocks a same-trip contact, requires two different routes, and flags missing country codes instead of accepting an open text box.
A practical guide to building emergency contact lists can help operators compare field structures, but the decisive test is operational. Someone should be able to read the record at a trailhead and know who is outside the incident, how to reach them, and what the traveler intended.
The participant record should sit alongside the rest of the traveler data rather than in a separate email thread. A participant management workflow can keep the emergency contact linked to the correct traveler, which matters when one person pays for several people.
Emergency details don't belong in the same moment as card payment. At checkout, the traveler is trying to secure a place, compare dates, and finish the transaction. Asking for a relative's phone number at that point creates friction, and many travelers won't have the correct details available. They either abandon the booking or enter a guess.
The better sequence is simple: secure the booking first, then collect the operational information while there's time to complete it properly. A post-booking request can explain why the data is needed, give the traveler a return path, and send reminders based on the departure date.
The form itself should be short. Use structured phone fields, a relationship selector, a clear country-code prompt, and separate questions for same-trip status and contact awareness. “Who should we call if you cannot speak?” is easier to answer than a paragraph about emergency notification procedures.

A reminder should be useful, not threatening. It can show what's missing, explain that the guide may be offline, and offer a direct link back to the traveler's record. If the traveler has booked for a family or group, the request should clearly identify which person still needs to complete their own details.
Gift bookings expose a common design mistake. The person who pays may know the itinerary but not the emergency contact for each participant. A group leader may book on behalf of several travelers and assume one contact applies to everyone. The system should therefore track the payer and travelers separately, with each traveler completing their own participant tasks where possible.
The same rule prevents a booking administrator from copying one person's details across an entire group. The operator can still help where needed, but the record should show which traveler supplied each contact and when it was last checked.
The form should allow an operator to mark a record as incomplete rather than automatically accepting a blank or duplicate. A guide can work with an outstanding item before departure. A guide can't fix a same-trip contact after an accident has already happened.
The guide needs the data where the phone doesn't work. The business needs to keep the data controlled. Those requirements aren't contradictory if offline access is treated as a temporary operational copy rather than a second permanent database.
The clean workflow starts with collection in the booking system, not by email. Email creates copies in sent folders, shared inboxes, forwarded threads, and personal devices. A spreadsheet saved to a laptop has the same problem, with less visibility into who opened or changed it. A structured record makes it easier to restrict access, update the manifest, and remove the information later.

“Everyone on the team can see it” sounds convenient until a seasonal guide, contractor, or marketing colleague has access to phone numbers they don't need. The owner, operations lead, and assigned guide may need the information. A person handling social media or general reservations usually doesn't.
Set access around the job:
Access should also be removed when a person no longer needs it. A short internal policy should state who can view, export, print, and destroy emergency contact data. A broader guide to data security protocols can help frame those controls, but the operator still needs a process that matches the team.
Before departure, export the relevant manifest and print the emergency contact details the guide needs. Place the pages in a sealed envelope or another controlled carrier, keep it with the responsible guide, and avoid leaving it in a vehicle, guest lodge, or shared office. The offline copy exists for the trip, not as a replacement for the controlled record.
After the trip, destroy the printed copy and delete the stored emergency contact record according to the business's stated retention process. There's no operational reason to hold a stranger's phone number for three years when the trip has already run. The principle is built into aviation rules: under 14 CFR Part 243, the emergency contact information a covered airline collects may be used only to notify family or listed contacts after an aviation disaster, and it is retained only until the passengers have disembarked.
The consent point deserves plain wording. The emergency contact didn't submit the form themselves. Under GDPR and similar privacy regimes, the details can constitute third-party personal data, and the traveler's act of providing them doesn't automatically equal the contact's consent. The operator should tell the traveler how the details will be used, who may access them, and when they'll be deleted, then ask their own privacy adviser about the lawful basis and exact wording. This is practical risk management, not legal advice.
Samba's security information describes the kind of system-level controls an operator should examine when moving contact records out of shared inboxes and personal spreadsheets.
The setup works best when the form is treated as a reusable participant task rather than a one-off document. The operator creates the emergency-contact questions once, then reuses them across relevant trips. Essential booking information can be collected at checkout, while the more detailed contact fields are requested after booking and scheduled by counting back from departure.
That split keeps the payment step focused and gives travelers time to find accurate details. It also lets the operations team see which participant records are complete before the group leaves, instead of discovering gaps while preparing transport or accommodation.
The task should include the full name, relationship, two contact routes, timezone overlap, second contact where needed, same-trip status, awareness confirmation, and medical-decision preference. Validation should reject a contact who is marked as traveling on the same departure and flag a missing second route for remote itineraries.
The record belongs to the participant, not merely to the person who paid. That distinction supports group leaders, family bookings, and gifts. Each traveler can have their own emergency contact, while the payer remains attached to the financial transaction.
Samba's participant tasks can be built once and reused across trips, with essential fields at checkout and the rest collected after booking. Its manifest updates as bookings change and can be exported for printing, which supports the sealed offline copy without asking the guide to reconstruct information from messages.
The operations lead should review incomplete tasks before exporting. The manifest should contain the participant identity, emergency contact details, and only the other operational fields the guide needs. A manifest workflow for tour operators can help connect participant records with departure planning, but the printed version still needs a human check before it leaves the office.
Samba records offline and bank-transfer payments with no platform fee, which lets an operator keep a complete booking record even when a customer doesn't pay by card. For online transactions, its stated pricing is 2% per booking, with the first $10,000 of bookings free and no setup fee or contract. Operators connect their own Stripe account, payouts go to the operator's account, and Samba doesn't hold funds. The 2% can be absorbed by the operator or passed to the traveler at checkout.
The free plan includes unlimited bookings, trips, and team members. Full white-label presentation, an own domain, API access, and multi-currency selling are Enterprise-only features. Those commercial details matter less than the operational test: the emergency-contact record must remain tied to the right traveler, update when bookings change, and produce a readable copy for the guide.
The value of an emergency contact is proved before departure, not after an incident. A contact who is also traveling is a silent failure until the day the guide needs an outside voice. No invented incident is needed to demonstrate the point. The structure either works under pressure or it doesn't.
Fold these items into your standard pre-departure checklist so the review runs every time:
A compact template can follow this order:
Traveler: full name and booking reference Primary contact: full name, relationship, phone, second route, timezone Backup contact: full name, relationship, phone, second route, timezone Trip status: contact traveling on this departure, yes or no Awareness: contact knows they've been listed, yes or no Medical preference: named person or stated preference, without implying automatic legal authority Purpose and retention: emergency assistance only, deleted after the trip according to the operator's process
Run the form as a traveler, enter a deliberately invalid phone format, check that the same-trip warning appears, export the manifest, print it, and confirm the guide can read it without a live connection. Then test the deletion step with a completed departure. Privacy obligations differ by jurisdiction, so the wording and retention process should be reviewed with the operator's own adviser. This article isn't legal advice.
The next practical move is small. Create the reusable task, move it out of checkout, assign a pre-departure review, and replace the shared inbox or personal spreadsheet with one controlled participant record.
Samba lets tour operators collect participant tasks after booking, keep payer and traveler records separate, update manifests as bookings change, and export the departure list for offline printing. Visit Samba to set up a booking-to-manifest workflow that keeps emergency contact data usable in the field and removable after the trip.

Valentin Fily
Founder & CEO
Related posts

Participant Management Software: A Tour Operator's Guide
Most participant management software is built for conferences, not tours. Here's what multi-day operators actually need: staged payments, structured traveler records, and manifest-ready data.

Manifest Software: Streamline Tour Operations 2026
When bookings, payments, and traveler records live in separate places, pre-departure chaos follows. Manifest software fixes that by making the departure the operational unit.

Your 10-Point Pre-Departure Checklist for Tour Operators
Turn chaotic departure week into a controlled workflow. This checklist covers every step—from locking participant data to closing financial records—before your group leaves.
Keep the 20–30% you would hand an OTA
Samba is the booking platform built for multi-day tour operators who want to run direct bookings — not pay a marketplace 20–30% of every departure.