1INFORMATION WE COLLECT

1.1 Personal Data You Provide

Under UK GDPR, “personal data” means any information relating to an identified or identifiable person. We collect:

1.2 Technical Data Collected Automatically

• Device Data: IP address, browser type and version, operating system
• Usage Data: Information about your visit, including URL clickstreams, download errors, length of visits
• Location Data: General geographic location inferred from IP address

1.3 Special Categories of Personal Data

If you provide such data, we will delete it immediately upon discovery.

2LEGAL BASIS FOR PROCESSING (UK GDPR)

Under Article 6 of UK GDPR, we process your personal data based on:

2.1 Legitimate Interests (Article 6(1)(f))

• Website security and fraud prevention
• Analytics to improve our services
• Direct marketing to existing customers
• Business development and administration

2.2 Contract Performance (Article 6(1)(b))

• Responding to your enquiries and communications
• Providing requested information about travel destinations
• Delivering newsletter subscriptions (if requested)

2.3 Legal Obligation (Article 6(1)(c))

• Compliance with UK tax obligations
• Responding to lawful requests from UK authorities
• Financial reporting requirements

2.4 Consent (Article 6(1)(a))

• Marketing communications to non-customers
• Non-essential cookies
• Sharing data with specific partners for marketing

3HOW WE USE YOUR INFORMATION

3.1 Service Provision

• Operate and maintain our website
• Provide travel content, guides, and recommendations
• Respond to your enquiries and provide support
• Send newsletters (if subscribed)
• Improve user experience on our website

3.2 Business Operations

• Analyse website performance and user behavior
• Prevent fraud and ensure security
• Comply with UK legal and regulatory requirements
• Manage business relationships

3.3 Marketing (with appropriate legal basis)

• Send promotional communications (with consent or legitimate interest)
• Display targeted advertisements
• Conduct market research
• Improve our marketing effectiveness

4INFORMATION SHARING UNDER UK LAW

4.1 Lawful Sharing

We may share your personal data with:

Service Providers (Data Processors):

• Website hosting providers (WordPress.com)
• Analytics services (Google Analytics)
• Email marketing platforms (for newsletters)
• Content delivery networks (CDN)

Business Partners (Joint Controllers):

• Travel booking platforms (Booking.com, Expedia)
• Activity providers (GetYourGuide, Viator)
• Affiliate marketing networks

Legal Requirements:

• UK courts and tribunals
• Law enforcement agencies
• HMRC and other UK regulatory bodies
• Legal advisors and auditors

4.2 Data Processing Agreements

All third-party processors are bound by written agreements ensuring:

• Processing only on our documented instructions
• Appropriate technical and organisational security measures
• Assistance with data subject rights requests
• Data deletion or return upon contract termination

5INTERNATIONAL TRANSFERS

5.1 Transfers Outside the UK

Some of our service providers are located outside the UK, including:

• United States: Google (Analytics), Facebook (Advertising)
• European Union: Various hosting and email services
• Other Countries: As disclosed in our service provider list

5.2 Transfer Safeguards

We ensure adequate protection through:

• Adequacy Regulations: Transfers to countries deemed adequate by UK Government
• Standard Contractual Clauses (SCCs): As approved by the ICO
• Certification Schemes: Where available and appropriate
• Binding Corporate Rules: For multinational service providers

5.3 Your Rights Regarding Transfers

You have the right to:

• Obtain information about transfer safeguards
• Object to transfers in certain circumstances
• Complain to the ICO about inadequate safeguards

6DATA RETENTION

6.1 Retention Periods

We retain personal data only as long as necessary for the purposes for which it was collected:

6.2 Automated Deletion

We have implemented automated systems to delete data when retention periods expire, except where longer retention is required by UK law.

7SECURITY MEASURES

7.1 Technical Safeguards

In accordance with Article 32 UK GDPR:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Multi-factor authentication and role-based access
• Monitoring: Continuous security monitoring and threat detection
• Backups: Secure, encrypted backup systems

7.2 Organisational Measures

• Staff Training: Regular data protection training for all personnel
• Incident Response: Documented procedures for data breaches
• Privacy by Design: Data protection considered in all new systems
• Regular Audits: Annual security and privacy assessments

7.3 Breach Notification

In accordance with UK GDPR Articles 33-34:

• ICO Notification: Within 72 hours of becoming aware of a breach
• Individual Notification: Without undue delay if high risk to rights and freedoms

8YOUR RIGHTS UNDER UK GDPR

8.1 Individual Rights

Under UK GDPR, you have the following rights:

8.2 Exercising Your Rights

8.3 Limitations

Some rights may be limited by UK law, for example:

• Legal obligations to retain certain data
• Freedom of expression and information
• Public interest or official authority tasks

9COOKIES AND TRACKING

9.1 UK Cookie Law Compliance

In accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003:

9.2 Managing Cookie Preferences

You can control cookies through:

• Our cookie consent banner
• Browser settings
• Industry opt-out tools (youronlinechoices.eu)
• Google Ad Settings

10CHILDREN’S PRIVACY (UK STANDARDS)

10.1 Age of Digital Consent

In the UK, the age of digital consent is 13 years. However, we set our minimum age at 16 for enhanced protection.

10.2 Parental Consent

For users under 16, we require verifiable parental consent before processing personal data.

10.3 Special Protections

• Enhanced security for children’s data
• Limited data collection
• No behavioural advertising to children
• Easy withdrawal of consent mechanisms

11MARKETING COMMUNICATIONS

11.1 UK Marketing Laws

We comply with UK marketing regulations including:

• Privacy and Electronic Communications Regulations (PECR)
• UK GDPR consent requirements
• Advertising Standards Authority (ASA) codes

11.2 Consent Mechanisms

11.3 Legitimate Interest Marketing

For existing customers only, based on:

• Similar products/services
• Clear opt-out in every communication
• Regular legitimate interest assessments

12DATA BREACH PROCEDURES

12.1 UK Legal Requirements

Under UK GDPR Articles 33-34:

12.2 Breach Response

• Immediate containment and investigation
• Assessment of scope and impact
• Implementation of remedial measures
• Documentation of all actions taken
• Review and improvement of security measures

13ICO COMPLAINTS

13.1 Your Right to Complain

You have the right to lodge a complaint with the UK supervisory authority:

13.2 When to Complain

• Concerns about how we process your personal data
• Delayed response to rights requests
• Suspected data breaches
• Marketing communications sent without proper consent

14INTERNATIONAL USERS

14.1 Jurisdictional Notice

This privacy policy is governed by UK law. International users should note:

14.2 Additional Rights

Users in certain jurisdictions may have additional rights:

• EU/EEA: Continued GDPR protections
• California: CCPA rights (limited application)
• Other Regions: Local privacy law protections

15CHANGES TO THIS POLICY

15.1 UK Law Updates

We will update this policy to reflect:

• Changes in UK data protection law
• ICO guidance and regulations
• New services or business practices
• Technical developments

15.2 Notification Process

Significant Changes:

• Email notification + website notice

Minor Updates:

• Website notice + updated “Last Modified” date

Legal Changes:

• Immediate implementation with notification

16CONTACT INFORMATION

16.1 Data Controller

16.2 Privacy Enquiries

Email: [email protected]

Subject Lines:

• “Data Subject Rights” – for exercising UK GDPR rights
• “Privacy Concern” – for general privacy issues
• “Data Breach Report” – for security incidents

16.3 Response Commitment

• Acknowledgment: Within 48 hours
• Full Response: Within 30 days (UK GDPR requirement)
• Complex Requests: Up to 90 days with explanation

16.4 Professional Advice

For complex data protection matters, we recommend consulting:

• UK data protection lawyers
• ICO guidance materials
• Industry-specific regulations