Privacy notice

TravelOptions Limited is a UK incentive travel and corporate hospitality agency based at Ten West Street, Alderley Edge, Cheshire SK9 7EG. We take the privacy of personal information very seriously, and this notice sets out how we comply with UK data protection law — the Data Protection Act 2018 and the UK GDPR.

Information Commissioner's Office registration number: ZA320397.

We collect, use and disclose personal information in order to perform our business functions, including making and managing travel and event bookings on behalf of our customers. We are committed to protecting the privacy and confidentiality of personal information, and maintain physical, electronic and procedural safeguards to protect the information in our care.

We are the data controller for any personal information you provide to us in connection with our relationship.

If you do not provide us with your personal information, or you withdraw a consent you have given, this may affect our ability to provide services to you. Most travel bookings must be made under the traveller's full name and include contact details and identification such as passport details — we cannot make bookings without that information.

Generally, the information we collect is what is needed to arrange your travel, events and bookings. That typically includes:

• Contact information — name, address, telephone number, email address
• Passport details
• Other details relevant to your arrangements, or required by the airlines, hotels, tour or activity providers involved
• Payment or bank details for a given service

When you contact us for other reasons — an enquiry through this website, feedback, or a newsletter sign-up — we collect the information you choose to give us for that purpose.

Alongside an enquiry made through this website, we also record the page you first arrived on, the site that referred you, any campaign tags in the link you followed, and your answer to "How did you find us?". This tells us which of our pages and campaigns are working.

Special category data. In some circumstances — recruitment, or arranging travel — we may collect information regarded as special category data, which can include health information, dietary and accessibility requirements, racial or ethnic origin, or information about criminal convictions. We collect this only where it is reasonably necessary and with your explicit consent, and we do not use it for purposes other than those for which it was collected.

We usually collect personal information directly from you — in person, by telephone, letter or email; when you use this website; when you submit an enquiry or newsletter form; or when you contact us through social media.

Sometimes we collect information about you from a third party. This happens where someone makes a booking on your behalf — a group booking, or a booking made for you by your employer, or where you are invited as a guest on an incentive or event by a company that has engaged us. In those cases we rely on the authority of the person making the booking to act for the other travellers.

If you make a booking on behalf of someone else, you confirm you have their consent for us to collect and process their personal information in line with this notice, and that you have made them aware of it.

Please tell us promptly if your details change, or if you become aware that we hold inaccurate information about you.

We process your information where one of the following applies:

• You have given consent, which you may withdraw at any time
• The processing is necessary to provide our services to you
• The processing is necessary for compliance with our legal obligations
• The processing is necessary for our legitimate interests, or those of a third party receiving the information

When you book travel or related services through us, we usually act as an agent for the relevant travel service provider — a hotel or an airline, for example. In that case we process your information as necessary to provide what you asked for, which includes passing it to that provider so they can deliver the service.

We also use personal information for: regulatory reporting and compliance; identifying fraud or error; maintaining a customer record so we can serve you better; market research and feedback; internal accounting and administration; meeting customs and immigration requirements relating to your travel; and other purposes authorised or required by law.

We may send you marketing about our products and services. We will only send electronic marketing if you have opted in, and you can unsubscribe at any time using the link in any message or by contacting us.

We do not and will not sell, rent or trade your personal information.

We may disclose it to:

• Travel service providers fulfilling your booking — airlines, hotels, car hire, transfer handlers, tour operators and similar
• Suppliers of IT services that support ours, including Netlify, which hosts this website and processes its enquiry and newsletter forms on our behalf
• Printers and distributors of marketing material, and event organisers
• External advisers such as lawyers, accountants and auditors
• The person who made your booking on your behalf, or your employer where you are travelling for work or attending an event they have arranged
• Customs, immigration, government agencies, regulators and law enforcement, where required or authorised by law

Travel service providers will use your information in line with their own privacy policies, and may contact you to obtain further information or provide your requested services. We encourage you to read their policies, which are normally on their own websites.

We do not currently use a customer relationship management system or a third-party email marketing platform. Two processors handle information submitted through this website: Cloudflare, which hosts the site and receives the form, and Resend, which delivers the resulting email to us. Resend processes this in the European Economic Area (Ireland). The 123FormBuilder, Netlify and Vamoos services named in earlier versions of this notice are no longer in use.

We may disclose your personal information to recipients outside the UK where this is necessary to provide your service — most obviously to a hotel or supplier in the country you are travelling to. Where we do, the transfer is subject to appropriate safeguards as required by UK data protection law.

We deal with travel service providers all over the world, so the location depends on the services being provided. We give them the minimum information needed to deliver the service.

Information you send through the enquiry forms on this website is processed within the European Economic Area (Ireland) and is not transferred outside it.

We implement and maintain appropriate technical and organisational measures to protect personal information from accidental or unlawful destruction, loss, alteration, or unauthorised disclosure and access.

This website is served over HTTPS and enquiry data is transmitted encrypted. Access to booking records is limited to the people in our team who need it. Data is backed up regularly, and devices holding personal data are password protected.

We are not responsible for the security controls of third parties who may collect or process information through their own websites or services.

We destroy or de-identify personal information once we no longer need it for our business purposes, or as required by law.

We send fresh registration and consent forms for each group or incentive we arrange, and we do not carry forward or reuse data from previous trips — that data is deleted.

We keep enquiries, booking records and newsletter records for six years after the end of the tax year they relate to, in line with our accounting, insurance and regulatory obligations. After that they are deleted or de-identified.

You can unsubscribe from our newsletter at any time, and ask us to delete your information sooner where we have no continuing legal reason to hold it — see "Your rights" below.

This website does not set advertising or analytics cookies, does not use third-party web analytics, and does not track you across other websites. There are no social media widgets or embedded third-party content on any page.

The enquiry form stores the page you arrived on and any campaign tags in your browser's session storage, so that information is still attached if you visit several pages before contacting us. It is cleared when you close the tab and is never shared with anyone else.

You have the right to ask us to: provide a copy of the personal information we hold about you; correct information that is inaccurate; delete information where there is no good reason for us to keep it; restrict or object to our processing; transfer your data to another provider; and withdraw consent where we rely on it.

To exercise any of these rights, email travel@traveloptionsltd.com or write to us at the address below. We will acknowledge your request and aim to respond within one month, though we may extend that for complex requests.

We may ask you to prove your identity before we release information, to prevent unauthorised disclosure. We reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

Note that restricting or withdrawing consent may affect our ability to provide services to you, for the reasons set out at the top of this notice.

If you have a question or complaint about this notice or how we handle your personal information, contact us at travel@traveloptionsltd.com, by telephone on 01625 539954, or by post at Ten West Street, Alderley Edge, Cheshire SK9 7EG. We will respond as soon as we practicably can.

If you are unhappy with how we have handled matters, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Our Data Protection Officer is Judy McSorley, who co-founded the company. Subject access requests and any correspondence about this notice should be addressed to her at travel@traveloptionsltd.com, or by post at the address below.

We may amend this notice from time to time. The revised version will be posted here, and the date it was last updated appears at the top of the page.