Privacy Notice

1. Who we are

Carry On Travelling is a sole-trader travel consultancy operated by Richard Swinburne. Carry On Travelling acts as an authorised agent of Your Travel Consultant Ltd (company number 16034077) for the purpose of arranging travel bookings.

For the purposes of UK data protection law, the data controller is:

• Business name: Carry On Travelling
• Operator: Richard Swinburne
• Email: [email protected]
• Telephone: +44 (0) 7368 661477
• Website: carryontravelling.com

Carry On Travelling is not currently registered with the Information Commissioner's Office (ICO) as a data controller. If you have a question about whether registration applies, please contact Richard directly.

2. What information we collect and why

2.1 Travel enquiry form

When you submit a travel enquiry through this website, we collect the information you provide in the form. This may include:

• Your name and email address (required)
• Your telephone number (optional)
• Your destination idea, preferred travel style, approximate timing, and party size
• Your preferred departure airport and approximate budget (optional)
• Any additional information you choose to include in the free-text field

Purpose: To respond to your enquiry and, if you proceed, to arrange your travel booking.

Lawful basis: Your explicit consent, given by ticking the consent checkbox before submitting the form. You may withdraw consent at any time by contacting Richard directly; withdrawal does not affect the lawfulness of processing before withdrawal.

Submitting an enquiry does not enrol you in any mailing list. Marketing emails are only sent if you separately tick the optional marketing consent checkbox.

2.2 Direct contact by telephone, email or WhatsApp

If you contact Richard by phone, email or WhatsApp, we will hold the content of that communication and any personal information you share within it for the purpose of responding to you and, if relevant, arranging your travel.

Lawful basis: Legitimate interests — responding to a direct communication you initiated. Where a booking results, the lawful basis is performance of a contract.

2.3 Mailing list sign-up

If you sign up to receive travel inspiration and news from Carry On Travelling, we collect your email address and, optionally, your name. We record the date and time of your consent and your IP address for audit purposes. Your details are held in Mailchimp, operated by The Rocket Science Group LLC. Mailchimp processes data on our behalf as a data processor under a data processing agreement.

Purpose: To send you occasional travel inspiration, destination ideas and news from Carry On Travelling.

Lawful basis: Your explicit consent. You can unsubscribe at any time by clicking the unsubscribe link in any email, by replying with "unsubscribe", or by contacting Richard directly.

2.4 Booking data passed to Your Travel Consultant Ltd

When a booking is made, the personal information necessary to complete that booking (such as full names, dates of birth, passport details, and contact information) is passed to Your Travel Consultant Ltd, who act as the principal for the booking. Your Travel Consultant Ltd processes this data as a data controller in their own right. Please refer to their privacy notice for details of how they handle your information.

Lawful basis: Performance of a contract (your travel booking).

2.5 Website analytics

This website uses GoDaddy's built-in analytics platform (GoDaddy Signals / C2) to collect anonymised data about how visitors use the site, such as pages visited, session duration and general location. This data is collected only if you accept cookies when the cookie banner is shown. GoDaddy's servers are located in the UK and EU.

Purpose: To understand how the website is used and to improve it.

Lawful basis: Your consent, given via the cookie banner.

Richard does not have direct access to individual-level analytics data. The analytics platform is operated by GoDaddy as part of the website hosting service.

2.6 Live chat widget (Inbox)

This website includes a live chat widget provided by GoDaddy Inbox (powered by Reamaze). The widget is only loaded if you accept cookies when the cookie banner is shown. If you use the chat widget, any messages you send are received by Richard through the Inbox platform. GoDaddy's servers are located in the UK and EU.

Lawful basis: Your consent, given via the cookie banner.

2.7 Compass tool

The Carry On Compass is an on-page questionnaire that suggests travel styles based on your answers. Your answers are stored only in your browser's local storage and are never transmitted to any server. No personal data is collected by this tool.

3. How we share your information

We do not sell your personal information. We share it only in the following circumstances:

• Your Travel Consultant Ltd — when a booking is made, the data necessary to complete the booking is passed to YTC as the booking principal (see section 2.4 above).
• GoDaddy (website hosting and Inbox) — this website is hosted by GoDaddy. Enquiry form submissions and chat messages are processed through GoDaddy's Inbox platform. GoDaddy acts as a data processor on our behalf. Servers are located in the UK and EU.
• Microsoft 365 and GoDaddy Email — emails sent to and from Richard are processed through Microsoft 365 and GoDaddy's email hosting service. Both act as data processors on our behalf. Microsoft's servers may be located in the UK, EU, or United States; transfers to the US are covered by standard contractual clauses. GoDaddy's email servers are located in the UK and EU.
• Mailchimp — if you have subscribed to our mailing list, your email address and name are held in Mailchimp (The Rocket Science Group LLC). Mailchimp's servers are located in the United States; transfers are covered by standard contractual clauses and Mailchimp's EU-US Data Privacy Framework certification. Please refer to Mailchimp's privacy policy for details.
• O2 (mobile carrier) — telephone calls and SMS messages are carried by O2 (Telefonica UK Ltd) as your mobile network operator. Please refer to O2's privacy policy for details.
• WhatsApp — WhatsApp messages are processed by Meta Platforms Ireland Ltd under their own privacy policy. Please refer to WhatsApp's privacy policy for details.
• Legal obligation — we may disclose personal information if required to do so by law or in response to a valid request from a public authority.

We do not share your information with advertising networks, data brokers, or any third party for marketing purposes without your explicit consent.

4. International transfers

Most of the personal data we process is held on servers located in the UK or EU. The following transfers outside the UK may occur:

• Microsoft 365 — Microsoft may process email data in the United States. Transfers are covered by standard contractual clauses approved by the UK Information Commissioner's Office (ICO).
• Mailchimp — subscriber data is held in the United States. Transfers are covered by standard contractual clauses and Mailchimp's EU-US Data Privacy Framework certification, which the UK recognises as providing adequate protection.
• WhatsApp / Meta — WhatsApp messages may be processed in the United States by Meta Platforms Inc. Transfers are covered by standard contractual clauses.

In each case, appropriate safeguards are in place to ensure your data is protected to a standard equivalent to UK GDPR.

5. How long we keep your information

We retain personal information only for as long as is necessary for the purposes described in this notice, or as required by law. Our retention periods are:

• Enquiries that do not result in a booking: 12 months from the date of the enquiry, after which the information is deleted.
• Booking records and related correspondence: 6 years from the end of the tax year in which the booking was completed, in accordance with HMRC requirements and UK GDPR storage limitation principles.
• Mailing list subscribers: Until you unsubscribe, after which your email address is removed from the mailing list promptly. Consent records (date, time, IP address) are retained for 3 years as evidence of lawful processing.
• Cookie consent records: 12 months from the date of consent.

6. Your rights under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal information:

• Right of access — you can ask for a copy of the personal information we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete information.
• Right to erasure — you can ask us to delete your personal information in certain circumstances.
• Right to restrict processing — you can ask us to limit how we use your information in certain circumstances.
• Right to data portability — where processing is based on consent or contract and carried out by automated means, you can ask for your data in a portable format.
• Right to object — you can object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact Richard by email at [email protected] or by telephone on +44 (0) 7368 661477. We will respond within one calendar month.

7. Complaints

If you are unhappy with how we have handled your personal information, you have the right to lodge a complaint with the UK's supervisory authority:

• Information Commissioner's Office (ICO)
  ico.org.uk
  Telephone: 0303 123 1113

We would appreciate the opportunity to address your concern directly before you contact the ICO. Please get in touch with Richard in the first instance.

8. Cookies and similar technologies

This website uses cookies and browser local storage in the following ways:

• Cookie consent preference — stored in browser local storage under the key c2_analytics_consent. Records whether you accepted or declined analytics cookies, and the date of your choice. Expires after 12 months.
• Analytics cookies (GoDaddy Signals / C2) — only set if you accept cookies via the banner. Used to collect anonymised data about website usage. Managed by GoDaddy. Servers in the UK and EU.
• Live chat widget (GoDaddy Inbox / Reamaze) — only loaded if you accept cookies. May set session cookies to maintain the chat session. Servers in the UK and EU.
• Compass tool preference — stored in browser local storage under the key carry-on-compass. Stores your answers to the Compass questionnaire locally in your browser only. Never transmitted to any server.

You can withdraw your cookie consent at any time by clicking "Manage cookies" in the website footer, or by clearing your browser's local storage and cookies.

This website does not use advertising cookies, tracking pixels, or any cookies set by social media platforms.

9. Artificial intelligence tools

Carry On Travelling does not use any artificial intelligence tools to draft responses to enquiries or to process customer personal data. All communications with clients are written personally by Richard Swinburne.

10. Changes to this notice

We may update this privacy notice from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this notice periodically.