PRIVACY POLICY

Tailor Your Holiday is incorporated in England (company registration number 11278901). Tailor Your Holiday is bound by very strict rules which protect clients’ confidentiality and all personal data provided to us, including by the use of Cookies, is protected by those rules.

This privacy policy sets out our approach to the personal data we collect from or obtain about you. It has been updated to comply with the new General Data Protection Regulations (GDPR) which came into force on 25th May 2018. If you have any queries in relation to this privacy policy, please contact info@tailoryourholiday.com

At Tailor Your Holiday we are very serious about protecting your privacy. Your trust is our most important asset. This privacy policy explains what personal data Tailor Your Holiday may collect from you and why and what we will do with this data. From 25 May 2018, you and your personal data will be protected by the EU General Data Protection Regulation (which is otherwise known as GDPR) and a new UK Data Protection Act 2018. In this privacy notice, we refer to this legislation as data protection laws. We will only process your personal data as set out in our privacy policy or otherwise notified to or agreed by you or as we are otherwise permitted to do in accordance with data protection laws.

For the purposes of data protection laws, we, Tailor Your Holiday are usually a data controller in respect of the personal data you provide us with or which otherwise comes into our possession. For certain types of holiday bookings, we may however be a data processor. This is likely to be the case where we contract with a third party such as a travel agent, travel planner or other travel business which is based outside the UK for the arrangement of travel services and which itself enters into a contract with you for the provision of your holiday. In this situation, that travel business is likely to be the data controller. Where we are a data processor, we will only process your personal data in accordance with the instructions of the data controller. Certain provisions of this privacy policy will be applicable where we are the data processor.

In order to respond to an enquiry, process and fulfil your booking or send you a brochure or other promotional material, we need to collect personal data from you. When we refer to personal data, we mean any information which relates to an identified or identifiable individual. Where we refer to process or processing, we mean anything which we may do with your personal data including collecting, storing, using, disclosing to third parties and erasing it.

You may provide or we may otherwise obtain personal data to us in various ways. This may be as a result of our direct communications or through a third party such as a travel agent. We have provided examples of the personal data we process below. This may be provided over the telephone, on-line through our website or in emails to us.

Depending on what's required, the personal data we collect may include names and contact details (such as telephone numbers, postal and e-mail addresses) and credit/ debit card or other payment information.

It may also include special categories of personal data such as information which concerns your health. Please see below for further information on this subject.

Please do not provide your personal data to us if you are not happy for us to process this information in accordance with this privacy policy.

Examples of when and how we may collect your personal information include the following:

• If you order a brochure or newsletter we will ask for your name, address and e-mail address. This is so we can effectively e-mail or post out the requested items.
• If you submit a holiday enquiry form we will ask for your name, telephone number and e-mail address. This is so we can effectively respond to your request.
• If you enter a competition or promotion we will ask for your name, address and e-mail address. This is so we can run the competition effectively and let you know if you have won or allow you to participate in the promotion. If we would like to use the personal data you have provided for any purpose in addition to the specific competition or promotion, we will make this clear and seek your specific consent to this.
• If you want to make a booking with us, we will ask for the personal information of all persons travelling. This is likely to include the personal data set out above. This is required so that we can make and provide your holiday arrangements.
• If you submit feedback to us, we will ask for your name and email address in order to effectively respond to your feedback.
• Carry out our obligations arising from any agreements entered into between you and us (which will most usually be for the provision of our services);
• Provide you with information related to our services and our events and activities that you request from us or which we feel may interest you, provided you have consented to be contacted for such purposes; 
• Notify you about any changes to our services.

Personal data which concerns your health or which reveals your racial or ethnic origin, religious beliefs or your sexual orientation are special categories of personal data. Other information also comes within special categories but this is unlikely to be relevant to the booking and provision of travel arrangements.

Generally speaking, the processing of special categories of personal data requires your explicit consent.

Accordingly, information concerning any disability, medical condition, restricted mobility or any other health issue (and related requirements) as well as dietary restrictions which may disclose your religious beliefs or any health issue are special categories of personal data. We will ask for your consent to our processing this information at the time you make your booking or your booking enquiry or whenever you otherwise provide or indicate that you intend to provide such information.

This policy applies only to our websites (http://www.tailoryourholiday.com), and not to other websites to which we provide links. You are advised to read the privacy policy of such other websites.

Once your booking has been made, your personal data may also be provided to government / public authorities such as customs or immigration if required by them, or as required by law. Certain information may also be passed on to security or credit checking companies.

We may also make personal data available to companies who provide services on our behalf, such as mailing brochures and marketing material.

We only provide third parties with the personal data they require in order to deliver their services. Other than in relation to government / public authorities (over whom we have no control), we will take appropriate steps which are intended to ensure that anyone to whom we pass your personal data for any reason agrees to keep it secure, only uses it for the purpose of providing their services and does not collect any personal data from you in the course of performing their services.

Your personal data may be stored, used and otherwise processed within the UK and/or any other country(ies) of the European Economic Area (EEA). EEA countries are all member states of the European Union together with Norway, Iceland and Liechtenstein. We may also store, use or otherwise process personal data outside the EEA. Data protection laws may not be as strong outside the EEA as they are in the EEA. Personal data will not be transferred to a country outside the EEA unless (1) the country to which it is transferred is one which the European Commission considers to provide an adequate level of data protection or (2) the personal data is transferred to a company which is required by our contract with them only to deal with the data in accordance with our instructions and to maintain appropriate security to protect the personal data which we are satisfied they have or (3) we are obliged to provide the personal data to a government / public authority in order to provide your holiday.

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it is collected. When assessing what retention period is appropriate for your personal data, we take into consideration:

• The requirements of our business and the services we provide;
• Any statutory or legal obligations;
• The purposes for which we originally collected the personal data;
• The lawful grounds on which we based our processing;
• The types of personal data we have collected;
• The amount and categories of your personal data;
• Whether the purpose of the processing could reasonably be fulfilled by other means

We take appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, which is appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures.

We will only retain and use your personal data for marketing purposes where you have specifically consented to our doing so or we are permitted to do in accordance with data protection laws (including as set out below).

We may send you e-mail marketing where we comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). PECR permits us to e-mail you information about the travel services we offer where you have previously provided us with your e-mail address in the course of entering into a contract with us for holiday / travel arrangements or negotiations for such arrangements and we wish to e-mail you marketing material about our similar services or products. You will of course be given the opportunity to opt out of receiving such e-mail marketing communications when you first provide us with your e-mail address and whenever we send you any e-mail marketing.

Where you have previously requested or agreed to receive information about our travel services from us by post, we may continue to send you such information in the same way until you ask us not to (which you can do by telephone, e-mail or post). Everything we send you will tell what you should do if you no longer wish to hear from us. We will send you this information as this is necessary for the purposes of our legitimate interests in communicating with you unless it is or becomes clear that our interests are overridden by your interests or fundamental rights and freedoms in which case we will cease communicating with you.

You may provide your consent to receiving marketing material from us by opting into receive marketing material either on-line or by telephone. You may also choose in what ways you are happy to receive communications from us. You may, for example, be happy to receive information and offers by post and e-mail but not by telephone.

You are entitled to ask us (by letter or e-mail) what personal data of yours is being held or processed, for what purpose and to whom it may be or has been disclosed. No fee will be charged for responding to this request unless it is obviously unfounded or excessive or we have previously provided the same information. We promise to respond to your request without delay and in any event within one month unless the request is complex or you have made numerous requests in which case we may be able to extend our response time by a further two months.

Under certain circumstances, by law you have the right to:

•  Request access to your personal data. This enables you to receive details of the personal data we hold about you and to check that we are processing it lawfully.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
• You have the right to object where we are processing your personal information for direct marketing purposes. 

We have put in place reasonable and appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

 We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.We will not process your personal data in a form which enables you to be personally identified for any longer than is necessary in order to fulfil the purpose for which it was originally collected or for any other legitimate business purpose. If you have consented to receiving marketing communications from us, we may continue to use your personal data for this purpose until you withdraw your consent or otherwise for as long as we reasonably consider your consent remains valid and effective. 

Yes, you can ask us to erase your personal data in certain circumstances, for example where you have withdrawn your consent to further marketing where the data in question has only been processed for this purpose, our further using this for marketing purposes. However, this is not always the case. Please see the previous paragraph for further information on the period of time we may retain personal data.

While we cannot guarantee that unauthorised access will never occur, we can assure you that we take great care in maintaining the security of your personal data to prevent unauthorised access to it, through the use of appropriate technology and internal procedures.

We take a number of steps to protect your information from unauthorised access, use or alteration and unlawful destruction. We limit access to the information we collect about you (for instance, only those of our personnel who need your information to carry out our business activities are allowed access). We put in place physical, electronic, and procedural safeguards in line with industry standards.

As general best practice on the Internet, it is recommended that individuals take great care with user accounts, and follow some basic rules:

Do not use trivial passwords (such as single dictionary words).

Do not use the same password for multiple accounts.

Do use very long passwords (at least 10 characters, but preferably much longer)

 Do use passwords which contain a combination of upper and lower case letters, numbers and special characters e.g. $%^& etc.

Do keep passwords securely (never written down, or shared with anyone) and changed periodically.

• We may disclose your personal data to other members of our company insofar as reasonably necessary for the purposes, and on the legal bases, set out in this policy.
•  We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
•  We may disclose non-sensitive personal data to our subcontractors so far as is reasonably necessary for fulfilling any contract with you.
• Financial transactions relating to our website and services may be handled by our payment services providers. We will share transaction data with our payment services providers only to the extent necessary for the purposes of processing your payments, refunding such payments and dealing with complaints and queries relating to such payments and refunds.
• We may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

We may update this policy from time to time by publishing a new version on our website.

You should check this page occasionally to ensure you are happy with any changes to this policy.

• You may instruct us to provide you with any personal information we hold about you; provision of such information will be subject to: 
  (a) the supply of appropriate evidence of your identity (for this purpose, we will usually accept a photocopy of your passport certified by a solicitor or bank plus an original copy of a utility bill showing your current address).
• We may withhold personal information that you request to the extent permitted by law.
• You may instruct us at any time not to process your personal information for marketing purposes.
• In practice, you will usually either expressly agree in advance to our use of your personal information for marketing purposes, or we will provide you with an opportunity to opt out of the use of your personal information for marketing purposes.

Your principal rights under data protection law are:
(a) the right to access;
(b) the right to rectification;
(c) the right to erasure;
(d) the right to restrict processing;
(e) the right to object to processing;
(f) the right to data portability;
(g) the right to complain to a supervisory authority; and
(h) the right to withdraw consent.

You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee

You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.

In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful but you oppose erasure; we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.

You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.

You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

To the extent that the legal basis for our processing of your personal data is:
(a) consent; or
(b) that the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.

If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

You may exercise any of your rights in relation to your personal data by written notice to us.

Changes to this notice

We may make changes to this Privacy Notice from time to time. Any changes we may make to our privacy notice in the future will be provided to you by being updated on our website, which will always contain the latest version.

Cookies

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.

Cookies may be either "persistent" cookies or "session" cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.

Cookies used by our service providers

Our service providers use cookies and those cookies may be stored on your computer when you visit our website.

We use Google Analytics to analyse the use of our website. Google Analytics gathers information about website use by means of cookies. The information gathered relating to our website is used to create reports about the use of our website. Google's privacy policy is available at: https://www.google.com/policies/privacy/.

Managing cookies

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:
(a) https://support.google.com/chrome/answer/95647?hl=en (Chrome);
(b) https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
(c) http://www.opera.com/help/tutorials/security/cookies/ (Opera);
(d) https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);
(e) https://support.apple.com/kb/PH21411 (Safari); and
(f) https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).

Blocking all cookies will have a negative impact upon the usability of many websites.

If you block cookies, you may not be able to use all the features on our website.

Our details

This website is owned and operated by the company at the address given in the contact details of this website.

Our principal place of business is as given in the contact details on this website.

You can contact us:
(a) by post, to the postal address given in the contact details on this website.
(b) by telephone, on the contact number published on our website.

Data protection officer

Our data protection officer's contact details are as given in the contact details on this website. Please address all correspondence to “The Data Protection Officer”.