Privacy Policy

1. Who we are

Holidays to Asia is a trading name of Halo Holidays Ltd, a company registered in England & Wales. We are the data controller responsible for your personal data.

We are registered with the Information Commissioner's Office (ICO) under UK data protection law. If you have any questions about this policy or our data practices, please contact us:

• Email: privacy@holidaystoasia.co.uk
• Post: Data Protection Officer, Holidays to Asia, London, UK

2. What personal data we collect

We may collect the following categories of personal data:

• Identity data: name, date of birth, passport details
• Contact data: email address, telephone number, postal address
• Travel data: destination preferences, travel dates, dietary requirements, medical/accessibility information (where voluntarily provided)
• Financial data: payment card information (processed securely via our payment provider — we do not store full card numbers)
• Technical data: IP address, browser type, pages visited, referring URL, cookie identifiers
• Marketing preferences: your opt-in or opt-out choices for marketing communications
• Communications data: records of correspondence with us by email, telephone, or enquiry forms

3. How we use your personal data

We use your personal data for the following purposes:

• Processing and managing your holiday booking and related arrangements
• Communicating with you about your enquiry or booking
• Fulfilling our legal and regulatory obligations (including ATOL reporting to the Civil Aviation Authority)
• Sending you marketing communications where you have opted in, or where we have a legitimate interest and you have not opted out
• Improving our website and services through analytics
• Fraud prevention and security

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract performance (Article 6(1)(b)): Processing necessary to fulfil your booking, issue ATOL certificates, and arrange flights and accommodation on your behalf.
• Legal obligation (Article 6(1)(c)): Complying with ATOL regulations, HMRC requirements, anti-money-laundering rules, and other statutory duties.
• Legitimate interests (Article 6(1)(f)): Sending you relevant travel information, improving our services, preventing fraud, and conducting internal analytics. We have balanced our interests against your rights and are satisfied this processing is proportionate.
• Consent (Article 6(1)(a)): Marketing emails and newsletters where you have given explicit opt-in consent. You may withdraw consent at any time by clicking “unsubscribe” in any email or contacting us directly.

5. Data retention

We retain your personal data for as long as necessary to fulfil the purposes described above:

• Booking records: 7 years from the end of the travel year (HMRC/ATOL requirements)
• Enquiry records (no booking made): 2 years from last contact
• Marketing opt-ins: Until you withdraw consent or 3 years of inactivity, whichever is sooner
• Website analytics data: 26 months (anonymised after 14 months)

After the applicable retention period, data is securely deleted or anonymised.

6. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access (DSAR): You may request a copy of the personal data we hold about you, free of charge, within one calendar month.
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): You may request deletion of your data where there is no compelling reason for continued processing, subject to legal retention obligations.
• Right to data portability: Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or direct marketing at any time.
• Right to restrict processing: You may ask us to pause processing in certain circumstances.

To exercise any of these rights, please email privacy@holidaystoasia.co.uk. You also have the right to lodge a complaint with the ICO at ico.org.uk.

7. Cookies

Our website uses cookies to improve your experience and analyse site traffic. We use the following categories:

• Essential cookies: Required for the website to function (e.g. session management, security). These cannot be disabled.
• Analytics cookies: We use anonymised analytics (e.g. Google Analytics with IP anonymisation) to understand how visitors use our site. These are only set with your consent.
• Marketing cookies: Used to show relevant adverts on third-party platforms. Only set with your consent.

You can manage your cookie preferences at any time using the cookie banner that appears on your first visit, or by adjusting your browser settings.

8. Third parties

To fulfil your holiday booking, we share relevant personal data with trusted third parties. These include:

• Airlines and ground handlers: For flight reservations and airport services (names, passport details, special assistance requirements)
• Hotels and accommodation providers: For reservation purposes
• Payment processors: Secure payment processing (PCI DSS compliant); we do not store card numbers
• The Civil Aviation Authority (CAA): ATOL reporting obligations
• Insurance providers: Where you purchase travel insurance through us
• IT service providers: CRM, email, and website hosting (data processing agreements in place)
• Analytics providers: Google Analytics (anonymised data only, subject to your consent)

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes without your explicit consent.

9. International data transfers

Where we transfer personal data outside the UK (for example, to hotels or airlines in Asia), we ensure that appropriate safeguards are in place — such as standard contractual clauses approved by the ICO, or transfers to countries with an adequacy decision — to protect your rights.

10. Changes to this policy

We may update this Privacy Policy from time to time. Any material changes will be communicated by updating the “Last updated” date at the top of this page. We encourage you to review this page periodically.