Privacy Policy

3. Where we get your information

Most of the information we hold comes directly from you, when you fill in a form, call us, message us or make a booking.

We may also receive information about you from:

• The lead traveller on a booking, where someone else books on your behalf
• Airlines, hotels and suppliers, for example flight schedule changes or booking confirmations
• Payment providers, confirming that a payment succeeded or failed
• Advertising and analytics platforms, where you click one of our adverts
• Public sources, such as social media, if you contact us through those channels

4. Why we use your information and our legal basis

Under UK GDPR we must have a legal basis for every use of your data. The table below sets out what we do and why.

Where we rely on legitimate interest, we have considered whether our interest is outweighed by your rights. You can ask us for details of that assessment, and you can object to processing based on legitimate interest. Section 13 explains how.

5. Passport and identity data

When we ask for passport details, we use them only to:

• issue airline tickets in the correct name and document number;
• meet hotel and resort registration rules in the destination country;
• supply Advance Passenger Information to airlines, which is passed to border authorities;
• check that a passport is valid for the dates and countries on your trip;
• support visa applications, where you have asked us to help.

We ask you to send passport details through our secure booking form at genztravel.co.uk/make-a-payment. Please avoid sending passport images through public social media channels.

Some countries require airlines and hotels to pass passenger identity data to their own government authorities. Those authorities operate under their own national laws, which may offer less protection than UK law. We have no control over how a foreign government uses data once it is lawfully required. If you are not comfortable with this, you will not be able to travel to that destination.

6. Special category data

Some information is treated as more sensitive under UK GDPR. For travel, this usually means health or mobility information, for example if you need wheelchair assistance at the airport, a medical device on board, or a specific diet linked to a health condition. Dietary requirements linked to religion may also reveal religious beliefs.

We only collect this information where you choose to give it, and only to arrange what you have asked for. Our legal basis is your explicit consent. We pass it only to the airline, hotel or supplier that needs it to provide the service.

You can withdraw this consent at any time by contacting us, but if you do, we may not be able to arrange the assistance you need.

7. Who we share your data with

We do not sell your personal data.

To arrange your trip, we have to share your details with the organisations that actually deliver it. These include:

• Airlines: names, dates of birth, passport data, seat and meal preferences
• Hotels and resorts: names, arrival and departure dates, room preferences, and identity details where local law requires registration
• Transfer companies, tour operators and guides: names, contact number, pick-up details
• Consolidators and booking systems: the reservation platforms we use to issue tickets
• Payment providers: to process your payment securely
• Insurance providers: only where you buy or arrange insurance through us
• Border, immigration and security authorities: where required by law
• Our professional advisers: accountants, auditors, lawyers and insurers
• IT and service providers: website hosting, email, CRM and customer support tools, acting on our instructions as processors
• Advertising and analytics platforms: only where you have accepted the relevant cookies
• Financial protection bodies, meaning the Civil Aviation Authority under the ATOL scheme and our trust account provider, Travel Trust Protection Ltd

We may also disclose data where we are legally required to, or if our business is sold or transferred, in which case your data would pass to the buyer under the same protections.

8. Sending your data outside the UK

We arrange travel to destinations including Thailand, the Maldives, Mauritius, Singapore, Indonesia, the Caribbean, the UAE, Cyprus, Turkey, Sri Lanka, Mexico, Japan, Vietnam, Spain, China and the USA. Many of these countries have not been assessed by the UK Government as offering equivalent data protection.

When we transfer your data outside the UK, we rely on one of the following:

• Adequacy regulations: where the UK Government has decided the country provides adequate protection, such as EU and EEA countries.
• The UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum: contract terms we put in place with suppliers and IT providers.
• The necessity exception for your contract: where a transfer is necessary to perform the contract we have with you. This applies to bookings with hotels, airlines and suppliers in your chosen destination, who set their own terms and will not sign our contract clauses.
• Legal obligation: where a foreign border or immigration authority requires passenger data by law.

You can ask us for more detail about the safeguards used for a particular transfer. Contact us using the details in section 21.

9. How long we keep your data

We do not keep your data indefinitely. The periods below apply unless we have a legal reason to keep something longer.

Once a retention period ends, we delete the data or make it anonymous so it can no longer identify you.

10. Marketing and your choices

We send travel offers and newsletters by email, and sometimes by SMS or WhatsApp, in two situations:

• you have asked to receive them; or
• you have booked with us or enquired about a booking, and we are offering similar travel services. You are given the chance to opt out at that point and in every message afterwards.

You can stop marketing at any time by clicking the unsubscribe link in any email, replying STOP to a text message, or emailing info@genztravel.co.uk. We will action your request without delay.

Opting out of marketing does not stop service messages about a booking you have made, such as flight time changes, payment reminders or travel documents. We have to send those.

11. Cookies and tracking

Cookies are small files stored on your device when you visit a website. We use them for the following purposes.

• Strictly necessary cookies: needed for the site to work, for example security and form submission. These do not require your consent.
• Functional cookies: remember your preferences and recently viewed destinations.
• Analytics cookies: help us understand which pages are used and how the site performs.
• Advertising cookies: used by Google and other partners to show you relevant adverts on other websites and to measure whether those adverts work. This includes Google’s advertising cookies, described in the Google Ads and Cookies Policy.

We ask for your consent before setting any cookie that is not strictly necessary. You can accept, reject or change your choices at any time using the Cookie Settings link in the footer of every page.

You can also block or delete cookies in your browser settings, but some parts of the site may then stop working properly.

Our servers also keep log files recording IP address, browser type, referring page and time stamps. We use these to keep the site secure and to diagnose problems.

12. Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including encrypted connections across the whole website, access controls that limit staff to the records they need for their role, secure UK-based hosting, annual data protection training for all staff, and checks on the security arrangements of our suppliers.

No system is completely secure, and we cannot guarantee the security of information you send us over the internet. If a data breach happens that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner’s Office within 72 hours where required.

13. Your rights

Under UK data protection law you have the following rights. They are free to exercise.

Right of access

You can ask for a copy of the personal data we hold about you, and information about how we use it.

Right to rectification

You can ask us to correct data that is wrong, or complete data that is missing.

Right to erasure

You can ask us to delete your data. We cannot always do this. For example, we must keep booking and payment records for tax and financial protection purposes.

Right to restrict processing

You can ask us to pause our use of your data, for example while we check the accuracy of something you have disputed.

Right to object

You can object to processing based on our legitimate interests. You can object to direct marketing at any time and we must stop.

Right to data portability

Where we process data by consent or under a contract, and by automated means, you can ask for it in a structured, commonly used, machine-readable format, or ask us to send it to another organisation.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did lawfully before you withdrew it.

Rights relating to automated decisions

You have the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. See section 18.

14. How to make a request

Email info@genztravel.co.uk or write to us at the address in section 21. Tell us which right you want to use and give enough detail for us to find your records. Your booking reference is the quickest way.

We may ask you to confirm your identity before we release personal data. This protects you against someone else requesting your information.

We will respond within one month. If your request is complex or you have made several requests, we may extend this by up to two further months. If we do, we will tell you within the first month and explain why.

15. Complaints to the ICO

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right.

You also have the right to complain to the UK supervisory authority at any time:

16. Children’s information

We do not market to children and we do not knowingly collect data directly from anyone under 13.

We do process children’s data when they are named on a family booking. In that case a parent or guardian gives us the child’s name, date of birth and passport details, and we use that data only to make the booking. It is held under the same protections as adult data and deleted on the same schedule.

If you believe a child has given us personal information directly, contact us and we will delete it.

17. Other people on your booking

If you book on behalf of other people, you are giving us their personal data, including passport details. By doing so you confirm that:

• you have their permission to share their information with us; and
• you have shown them this Privacy Policy, or told them where to find it.

Each traveller has the same rights over their own data as you do, and can contact us directly to use them.

18. Automated decisions

We do not make decisions about your booking using automated processing alone. Your quotes and bookings are handled by a human consultant.

We do use automated tools for fraud screening on payments, run by our payment providers. If a payment is declined by one of these checks, you can ask us to review it and a person will look at it.

19. Links to other websites

Our site links to websites run by airlines, hotels, insurers, advertising partners and other organisations. This policy does not cover them.

We are not responsible for how those sites handle your data. Read their own privacy policies before sharing information or completing a booking with them.

20. Changes to this policy

We may update this policy to reflect changes in how we work or in the law. The “last updated” date at the top of the page shows the current version.

If we make a significant change to how we use your data, we will tell you directly where we can, for example by email.

21. How to contact us

For our booking terms, including payment and cancellation conditions, see our Terms & Conditions.