Last updated: 03-11-2025

Friendztravel UK Limited (operating as Friendztravel.co.uk) takes your privacy and the security of your personal data extremely seriously. This Data Protection Policy outlines how we collect, use, store, and protect your personal information, confirming our compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy is designed to be clear, transparent, and easy to understand, ensuring you are fully informed about your privacy rights and our obligations.

1. Important Information and Contact Details

Our Commitment to Privacy

This Policy details our methods for handling your personal data when you use our website, make a booking, subscribe to our marketing, or contact us.

We are committed to processing your data lawfully, fairly, and in a transparent manner.

Controller Details

For the purpose of the UK GDPR, Friendztravel UK Limited is the Data Controller (referred to as "we," "us," or "our"). This means we are responsible for deciding how and why your personal data is processed.

• Our Operating Name: Friendztravel.co.uk
• Contact for Data Protection Queries:
• Email:support@friendztravel.co.uk
• Telephone: 0203 893 8768

Supervisory Authority

You have the right to lodge a complaint with the UK's supervisory authority for data protection issues: the Information Commissioner’s Office (ICO).

• ICO Website: www.ico.org.uk

We would appreciate the opportunity to resolve your concerns directly before you approach the ICO.

Policy Changes

We may update this Policy periodically to reflect changes in our data practices or legal requirements. We encourage you to review it regularly. It is vital that the personal data we hold about you is accurate and current. Please inform us if your personal details change during your relationship with us.

Third-Party Links

Our website may contain links to third-party websites, plug-ins, or applications. We do not control these third-party sites and are not responsible for their privacy practices. We advise you to read the Privacy Policy of every website you visit after leaving ours.

2. The Data We Collect About You

Personal data is any information that can be used to identify an individual. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store, and transfer various categories of personal data, which we have grouped as follows:

Special Categories of Personal Data

To finalise your travel arrangements, we may need to collect limited sensitive information, which falls under 'Special Categories' of personal data:

• Health Data: Information related to mobility needs, medical assistance (e.g., wheelchair), or specific dietary requirements relevant to your travel.
• In specific instances, such as travel during late pregnancy, medical clearance may be required.

We do not collect data concerning your race, ethnicity, religious beliefs, political opinions, or sexual orientation.

Children's Data

Our services are aimed at customers aged 16 and over. We do not knowingly collect personal information from children other than what is legitimately required to fulfil a travel booking made by an adult (e.g., a child's name and date of birth for a flight reservation).

If You Cannot Provide Personal Data

If we are required by law or under the terms of a contract (e.g., to process your booking) to collect personal data and you fail to provide it when requested, we may not be able to fulfil your reservation or provide our services. We will notify you if this results in a cancellation.

3. How and Why We Use Your Personal Data (Lawful Basis)

We will only use your personal data when the law allows us to. We rely on the following lawful bases for processing your data under the UK GDPR:

1. Contractual Necessity

This is necessary for the performance of the contract we are about to enter into or have entered into with you, specifically to:

• Process Your Bookings and Deliver Our Services: Using Identity, Contact, Financial, Transaction, and Special Categories Data to make and manage your reservations, send confirmations, and liaise with travel partners (airlines, hotels, etc.).

1. Legitimate Interests

This is where processing is necessary for our business interests (or those of a third party) and your fundamental rights do not override those interests, specifically to:

• Manage Your Account and Customer Relationship: Using your data to set up/manage your account, respond to queries, provide after-sales service, and ensure service consistency.
• Improve and Personalise Your Experience: Analysing Usage, Profile, and Technical Data to understand website usage, improve functionality, and provide tailored recommendations and offers.
• Improve Our Website and Services: Using Technical and Analytics Data to measure performance, debug issues, and develop new features.
• For Legal, Regulatory, and Security Purposes: Processing data to prevent fraud, adhere to legal/tax standards, and assist with investigations.

1. Legal Obligation

This is necessary for us to comply with a legal or regulatory obligation, specifically to:

• Comply with Legal, Tax, and Accounting Requirements.

1. Consent

This is where you have given us clear consent for a specific processing purpose, specifically for:

• Marketing and Promotional Communications: Sending you special offers, travel updates, and newsletters. You can withdraw your consent at any time via the 'unsubscribe' link in our emails or by contacting us directly.

4. Disclosure and International Transfers of Your Data

Sharing Your Data

We respect your privacy and do not sell or rent your personal data to any third parties. We only share your data when necessary to provide the service you have requested, as required by law, or to enhance your experience.

We may share your data with the following recipients:

• Travel Partners and Service Providers: Airlines, hotels, car rental firms, and other suppliers who fulfil the services included in your booking.
• Third-Party Vendors and Technical Support: Trusted partners for payment processing, IT services, data storage, customer support, and marketing assistance. These partners are required to adhere to strict confidentiality and data protection contracts.
• Professional Advisors: Legal consultants, auditors, and insurers, where necessary to protect our business or resolve a dispute.
• Regulatory Authorities and Legal Compliance: Government agencies or law enforcement where legally required.
• Business Transfers: If we merge or restructure, your data may be transferred to the new entity, subject to continued protection under this Policy.

International Data Transfers

Many of our travel partners and service providers are based outside the UK and the European Economic Area (EEA). This means your personal data may be transferred or accessed in countries outside these areas.

When transferring your data internationally, we ensure a high standard of protection, compliant with the UK GDPR. We implement safeguards which may include:

• Adequacy Decisions: Transferring data to countries formally recognised by the UK as offering an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Implementing legally binding agreements approved by the ICO for transfers to countries without an adequacy decision.
• Transfer Necessity: Transferring data based on the necessity to perform our contract with you (e.g., providing your booking details to a non-UK airline).

5. Data Security and Retention

Data Security

We have implemented strong technical, organisational, and administrative security measures to prevent your personal data from being accidentally lost, used, accessed, disclosed, or altered in an unauthorised way.

Access to your personal data is restricted to employees, agents, contractors, and trusted third-party partners who have a clear business need to know. All such parties are subject to a duty of confidentiality and must process your data only on our instructions and in line with relevant data protection laws.

We have procedures to deal with any suspected data breach and will notify you and the appropriate regulator where legally required.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including for satisfying any legal, accounting, or reporting requirements.

• To comply with UK tax and record-keeping laws, we must retain certain basic personal and transactional information for six (6) years after you cease to be a customer.
• If you have not booked or engaged with us for an extended period (e.g., 6 years), your data will be securely deleted or anonymised.

In some circumstances, you may request the deletion of your data (see Your Rights below). We may retain anonymised data for statistical or research purposes indefinitely.

6. Your Legal Rights

The UK GDPR grants you a number of rights over your personal data. You can exercise these rights at any time by contacting us at support@friendztravel.co.uk.

To protect your privacy, we may need to request specific information from you to confirm your identity before processing any rights request. We aim to respond to all legitimate requests within one month.

7. Glossary of Key Data Protection Terms