ONE Private Limited is incorporated in the United Kingdom (company registration number 11642532) ) ("ONE Private Travel/we/us").
From 25 May 2018, you and your personal data are protected by the EU General Data Protection Regulation (which is otherwise known as GDPR) and a new UK Data Protection Act 2018. In this privacy notice, we refer to this legislation as data protection laws.
What is our role in relation to your personal data?
What personal data will we collect from you and how will we do this?
In order to respond to an enquiry, process and fulfil your booking or send you a brochure or other promotional material, we need to collect personal data from you. When we refer to personal data, we mean any information which relates to an identified or identifiable individual. Where we refer to process or processing, we mean anything which we may do with your personal data including collecting, storing, using, disclosing to third parties and erasing it.
You may provide or we may otherwise obtain personal data to us in various ways. This may be as a result of our direct communications or through a third party such as a travel agent. We have provided examples of the personal data we process below. This may be provided over the telephone, on-line through our website or in emails to us. Additionally, in order to allow you to experience a more personalised service when you visit our website, we may find out about your interests. We may do so by asking you to provide this information, by reading your comments and/or by looking at the areas of our website you have visited as referred to below.
Depending on what's required, the personal data we collect may include names and contact details (such as telephone numbers, postal and e-mail addresses) and credit/ debit card or other payment information. It may also include special categories of personal data such as information which concerns your health. Please see below for further information on this subject.
Examples of when and how we may collect your personal information include the following:
If you order a brochure or newsletter we will ask for your name, address and e-mail address. This is so we can effectively e-mail or post out the requested items.
If you become a member and / or book a consultation we will ask for your name, telephone number and e-mail address. This is so we can effectively respond to your request.
If you enter a competition or promotion we will ask for your name, address and e-mail address. This is so we can run the competition effectively and let you know if you have won or allow you to participate in the promotion. If we would like to use the personal data you have provided for any purpose in addition to the specific competition or promotion, we will make this clear and seek your specific consent to this.
If you want to make a booking with us, we will ask for the personal information of all persons travelling. This is likely to include the personal data set out above. This is required so that we can make and provide your holiday arrangements.
If you submit a CV to us, we will ask for your name and email address in order to effectively respond to your application
If you submit feedback to us, we will ask for your name and email address in order to effectively respond to your feedback.
What are special categories of personal data?
Personal data which concerns your health or which reveals your racial or ethnic origin, religious beliefs or your sexual orientation are special categories of personal data. Other information also comes within special categories but this is unlikely to be relevant to the booking and provision of travel arrangements.
Generally speaking, the processing of special categories of personal data requires your explicit consent.
Accordingly, information concerning any disability, medical condition, restricted mobility or any other health issue (and related requirements) as well as dietary restrictions which may disclose your religious beliefs or any health issue are special categories of personal data. We will ask for your consent to our processing this information at the time you make your booking or your booking enquiry or whenever you otherwise provide or indicate that you intend to provide such information.
Is there any other personal information you may collect about me?
The information collected by cookies and web beacons is not personally identifiable, it includes general information about your computer settings, your connection to the internet e.g. operating system and platforms, IP address, your browsing patterns and timings of browsing on our website and your geographical location.
Who will we provide your personal data to?
Where you make a booking or booking enquiry, appropriate personal data will be passed on to the relevant suppliers (such as airlines, hotels, car hire companies etc) and any other third party (such as banks and/or credit card companies) who need this information so that your chosen arrangements can be booked and provided or your booking enquiry answered. Once your booking has been made, your personal data may also be provided to government / public authorities such as customs or immigration if required by them, or as required by law. Certain information may also be passed on to security or credit checking companies.
We may also make personal data available to companies who provide services on our behalf, such as mailing brochures and marketing material.
We only provide third parties with the personal data they require in order to deliver their services. Other than in relation to government / public authorities (over whom we have no control), we will take appropriate steps which are intended to ensure that anyone to whom we pass your personal data for any reason agrees to keep it secure, only uses it for the purpose of providing their services and does not collect any personal data from you in the course of performing their services.
Where will we process your personal data?
Your personal data may be stored, used and otherwise processed within the UK and/or any other country(ies) of the European Economic Area (EEA). EEA countries are all member states of the European Union together with Norway, Iceland and Liechtenstein. We may also store, use or otherwise process personal data outside the EEA. Data protection laws may not be as strong outside the EEA as they are in the EEA. Personal data will not be transferred to a country outside the EEA unless (1) the country to which it is transferred is one which the European Commission considers to provide an adequate level of data protection or (2) the personal data is transferred to a company which is required by our contract with them only to deal with the data in accordance with our instructions and to maintain appropriate security to protect the personal data which we are satisfied they have or (3) we are obliged to provide the personal data to a government / public authority in order to provide your holiday.
How do we protect your personal data?
We take appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, which is appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures.
Can we use your personal data to send you information about our holidays or other services in the future?
We will only retain and use your personal data for marketing purposes where you have specifically consented to our doing so or we are permitted to do in accordance with data protection laws (including as set out below).
We may send you e-mail marketing where we comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). PECR permits us to e-mail you information about the travel services we offer where you have previously provided us with your e-mail address in the course of entering into a contract with us for holiday / travel arrangements or negotiations for such arrangements and we wish to e-mail you marketing material about our similar services or products. You will of course be given the opportunity to opt out of receiving such e-mail marketing communications whenever we send you any e-mail marketing.
Where you have previously requested or agreed to receive information about our travel services from us by post, we may continue to send you such information in the same way until you ask us not to (which you can do by telephone, e-mail or post). Everything we send you will tell what you should do if you no longer wish to hear from us. We will send you this information as this is necessary for the purposes of our legitimate interests in communicating with you unless it is or becomes clear that our interests are overridden by your interests or fundamental rights and freedoms in which case we will cease communicating with you.
How can you find out what information we are holding about you?
You are entitled to ask us (by letter or e-mail) what personal data of yours is being held or processed, for what purpose and to whom it may be or has been disclosed. No fee will be charged for responding to this request unless it is obviously unfounded or excessive or we have previously provided the same information. We promise to respond to your request without delay and in any event within one month unless the request is complex or you have made numerous requests in which case we may be able to extend our response time by a further two months.
What should you do if the personal data we are holding is inaccurate, out of date or incomplete?
If you believe this is the case, please tell us by letter or e-mail as soon as possible. We will rectify the problem within one month or within three months if the rectification request is complex.
How long can we retain and process your personal data?
We will not process your personal data in a form which enables you to be personally identified for any longer than is necessary in order to fulfil the purpose for which it was originally collected or for any other legitimate business purpose.
If you have consented to receiving marketing communications from us, we may continue to use your personal data for this purpose until you withdraw your consent or otherwise for as long as we reasonably consider your consent remains valid and effective.
Where you have provided your personal data to enable us to provide the holiday arrangements or other services you have contracted, we are entitled to retain this information for a period of ten years after the end of those arrangements. In certain limited circumstances, we may be able to retain it for a longer period.
Can you ask us to delete your personal data?
Yes, you can ask us to erase or remove your personal data in certain circumstances, for example where you have withdrawn your consent to further marketing where the data in question has only been processed for this purpose. However, this is not always the case. Please see the previous paragraph for further information on the period of time we may retain personal data.
What should I do if I have a complaint about the processing of my personal data?
If you have any complaint about the way in which your personal data has been dealt with, please let us know by e-mail to firstname.lastname@example.org. We will investigate and respond to you as soon as we reasonably can. If you remain dissatisfied, you may complain to the Information Commissioner's Office. For further details, see www.ico.org.
Last updated 21 November 2018. Version 2018.01