Privacy Policy

1. Who We Are

Super Destinations Ltd is a company registered in England and Wales (Company No. 08243733), with our registered address at 344–348 High Road Ilford, Essex, IG1 1QP, UK. We are an ATOL protected travel agency (ATOL licence no. 10713) and a member of IATA.

For the purposes of UK data protection law, Super Destinations Ltd is the data controller of your personal information.

2. Information We Collect

Information you provide directly

• Full name, date of birth, and passport details (required for bookings)
• Contact details: email address, phone number, postal address
• Payment information (processed securely via our payment providers — we do not store card numbers)
• Travel preferences, dietary requirements, medical conditions relevant to travel
• Enquiry and correspondence content when you contact us by phone, email, or web form

Information collected automatically

• IP address, browser type, device information
• Pages visited, time on site, referral source (via Google Analytics)
• Cookie data (see Section 6)

3. How We Use Your Information

We use your personal information to:

• Process and fulfil your travel bookings and related services
• Communicate with you before, during and after your trip
• Send you quotes, itineraries, invoices, and ATOL Certificates
• Comply with legal obligations (including airline and border control requirements)
• Send marketing communications where you have consented or where we have a legitimate interest
• Improve our website and services through analytics
• Prevent fraud and ensure the security of our services

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract: processing is necessary to fulfil your booking or pre-booking enquiry
• Legal obligation: we are required to share certain data with airlines, ATOL, and border authorities
• Legitimate interests: improving our services, fraud prevention, and direct marketing to existing customers
• Consent: for email marketing to new enquirers and cookie-based analytics

5. Sharing Your Information

We share your personal data only where necessary:

• Airlines and transport providers — to fulfil your flight bookings
• Hotels and accommodation providers — to fulfil your stay bookings
• ATOL/CAA — as required under our ATOL obligations
• Payment processors — Stripe, WorldPay or equivalent, subject to their own privacy policies
• CRM and marketing tools — we use secure, GDPR-compliant platforms to manage customer communications
• Legal and regulatory authorities — where required by law

We do not sell your personal data to third parties.

6. Cookies

Our website uses cookies to improve your experience and to understand how visitors use our site. Cookies we use include:

• Essential cookies — required for site functionality (cannot be disabled)
• Analytics cookies — Google Analytics, used to understand site usage (opt-out available)
• Marketing cookies — used for remarketing via Google Ads and Meta (Facebook/Instagram), subject to your consent

You can manage your cookie preferences via our cookie consent banner or via your browser settings. For more detail, see our Cookie Policy.

7. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, and to comply with our legal obligations:

• Booking and transaction records: 7 years (HMRC requirement)
• Marketing consent records: until you withdraw consent
• Enquiry data (no booking made): 12 months
• Website analytics data: 26 months (Google Analytics default)

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data ("right to be forgotten")
• Right to restrict processing — to limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making — we do not use solely automated decision-making

To exercise any of these rights, please contact us at info@superdestinations.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS/TLS), access controls, and staff training.

Payment card data is processed exclusively by our PCI-DSS compliant payment providers and is never stored on our servers.

10. Third-Party Links

Our website may contain links to third-party websites (e.g., hotel partner sites, airline websites). We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children without verified parental consent. If you believe we have inadvertently collected data from a child, please contact us immediately at info@superdestinations.co.uk.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. We will post the updated policy on this page with a revised "Last updated" date. Where changes are material, we will notify you by email or by a prominent notice on our website.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Email: info@superdestinations.co.uk
• Phone: 0203 727 6363
• Post: Super Destinations Ltd, 344–348 High Road Ilford, Essex, IG1 1QP, UK