This notice sets out how Sunny Socials Ltd collects, uses, discloses and retains personal data in the course of arranging travel, whether for an individual client or on behalf of a corporate customer. It is provided in accordance with Articles 13 and 14 of the UK GDPR.
1. Data controller
Sunny Socials Ltd, trading as Travel with Sunny, is the data controller in respect of the personal data described in this notice.
- Company
- Sunny Socials Ltd
- Registration
- Registered in England and Wales, company number 16668367
- Registered office
- Flat 6 Parkstead Lodge, 31 Upper Park Road, London NW3 2UL
- ICO registration
- ZC118212
- Data protection contact
- travel@livingthesunnylife.co.uk · 07503 423527
Sunny Socials Ltd operates as an independent travel advisor affiliated with InteleTravel, through whom bookings are placed. Inteletravel UK Limited holds ABTA membership P7384, ATOL 12022 and IATA accreditation 10548020.
2. Scope
This notice applies to personal data processed when an enquiry is made regarding travel arrangements, when a booking is made or administered, and where an organisation instructs Sunny Socials Ltd to arrange travel on behalf of its personnel.
3. Categories of personal data collected
The personal data processed varies according to the arrangements requested, and may include:
- Identity and contact data: name, email address and telephone number.
- Corporate booking data: employing organisation, the booker's role, and purchase order, cost centre or project references, together with any applicable corporate travel policy.
- Traveller data: full name as shown in the passport, date of birth and nationality.
- Preference data: seat and room preferences and loyalty programme membership numbers.
- Special category data: dietary requirements and accessibility or mobility requirements, as addressed at section 6.
- Data relating to children: the number of children travelling and their ages, and where a supplier requires it, their names and dates of birth.
- Itinerary data: destinations, dates, budget parameters and related booking requirements.
Passport numbers are not collected through the booking forms. They are requested separately at the point of booking, and only where an airline or other supplier requires them.
4. Sources of personal data
Personal data is ordinarily provided directly by the data subject. In corporate bookings, and in certain personal bookings, it is provided by a third party, such as an employer's appointed travel booker or a family member organising travel for others.
Where a third party submits personal data relating to other individuals, that party is required to confirm at the point of submission that those individuals have agreed to their data being disclosed for the purpose of the booking. Any individual whose personal data has been provided in this manner may contact Sunny Socials Ltd at the address given at section 1 to request details of the data held.
5. Purposes of processing and lawful bases
- Responding to enquiries and preparing travel options. Article 6(1)(b), being steps taken at the request of the data subject prior to entering into a contract, where the data subject is the customer. Where the customer is the data subject's employer, Article 6(1)(f), the legitimate interest being the arrangement of travel requested on the data subject's behalf.
- Making and administering bookings, including disclosure of the data necessary for a supplier to hold and fulfil a reservation. Article 6(1)(b) or Article 6(1)(f), as above.
- Maintaining accounting and business records. Article 6(1)(c), compliance with a legal obligation.
- Issuing marketing communications where these have been requested. Article 6(1)(a), consent, which may be withdrawn at any time.
6. Special category data
Dietary requirements may reveal religious or philosophical beliefs, and accessibility or mobility requirements constitute data concerning health. Both fall within the special categories of personal data defined at Article 9 of the UK GDPR and attract additional protection.
Such data is processed solely to give effect to the booking, for example to secure accommodation that is genuinely accessible, or to notify a caterer of an allergy. The lawful basis is explicit consent under Article 9(2)(a), obtained by way of the confirmation required before a booking form may be submitted. Consent may be withdrawn at any time, although withdrawal may prevent the arrangement of any element of the booking that depends upon it.
7. Data relating to children
Where a booking includes children, Sunny Socials Ltd may be provided with their ages and, where required by a supplier, their names and dates of birth, as airlines, accommodation providers and attractions determine pricing and eligibility on that basis. Such data is supplied by the adult making the booking, who remains responsible for its accuracy and for obtaining any consent required. It is processed solely for the purposes of the booking.
8. Payment data
Payment is made by the customer directly to the supplier. In most instances a payment link is issued by the accommodation provider or operator and settled directly with them. Where a supplier accepts payment only by telephone, card details are entered into that supplier's own system at the time of the call and are neither recorded nor retained.
Sunny Socials Ltd does not store card or bank details, and no customer funds pass through the company at any point.
9. Disclosure and recipients
In order to arrange travel, personal data is disclosed to the following categories of recipient:
- InteleTravel, through whom bookings are placed;
- travel suppliers, including airlines, accommodation providers, ground transport and vehicle hire operators, ticket agents, cruise lines and tour operators;
- Jotform, which hosts the booking forms;
- Microsoft, which provides email services.
Travel suppliers act as independent controllers and process personal data in accordance with their own privacy notices. Personal data is not sold, and is not disclosed to any third party for that party's own marketing purposes.
10. International transfers
Where travel is arranged outside the United Kingdom, the transfer of personal data to the destination country is inherent in the arrangement, as a supplier cannot hold or fulfil a reservation without it. Such transfers are made on the basis that they are necessary for the performance of a contract with the data subject, or for the implementation of pre-contractual measures taken at the data subject's request. Where a choice of systems or suppliers exists, those offering appropriate safeguards are preferred.
11. Retention
- Enquiries not resulting in a booking: twelve months from the date of last contact, after which the data is deleted.
- Booking records: six years from the end of the tax year to which they relate, consistent with statutory record-keeping requirements.
- Marketing consents and associated data: retained until consent is withdrawn.
Passport details are transmitted to the supplier requiring them and are not retained beyond the operational requirements of the booking.
12. Rights of data subjects
Under the UK GDPR, you have the right to request access to the personal data held about you, and to request its rectification, erasure or the restriction of its processing. You have the right to data portability, the right to object to processing carried out on the basis of legitimate interests, and the right to withdraw consent where processing is based upon consent.
Requests should be directed to travel@livingthesunnylife.co.uk. No fee is payable, and a response will be provided within one month of receipt.
13. Cookies and analytics
This website does not set cookies and does not operate analytics or tracking of any kind. The booking forms are hosted by Jotform, and the booking site referred to on this website is operated by InteleTravel. Both set their own cookies and publish their own privacy notices.
14. Complaints
Any concern regarding the handling of personal data should be raised with Sunny Socials Ltd in the first instance, using the contact details at section 1, so that the matter may be addressed directly.
You also have the right to lodge a complaint with the Information Commissioner's Office, the supervisory authority for data protection in the United Kingdom, at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
15. Amendment of this notice
This notice may be amended from time to time to reflect changes in the processing of personal data or in applicable law. The version number and effective date recorded at the head of this document will be updated accordingly.