Guardian Holidays Privacy and Cookies Policy

Introduction

This is the privacy policy for Guardian Holidays and explains how Guardian News & Media Limited (collectively referred to as “Guardian”, “we”, “us” or “our” in this policy) collect, use, share and transfer your personal data when you use the services provided on Guardian Holidays website at https://holidays.theguardian.com/ (“our site”) and interact with us.

This privacy policy is separate to how we use personal data collected via theguardian.com website. For information on how personal data is used on theguardian.com website, please read the privacy policy here and the cookie policy here.

Our values guide everything that we do – including how we use personal data. We are strongly committed to keeping your personal data safe. This commitment exists throughout the lifecycle of your personal data, from the design of our site which uses personal data to the deletion of that data.

We think carefully about our use of personal data, and below you can find the details of what we do to protect your privacy. This policy covers, among other topics:

Information about your rights, the choices available to you, and our obligations.
Transparency about how we collect and use your personal data, including when and how it is shared.
Information on how we protect your personal data.
Information on how we will facilitate your rights and respond to your questions.

Find out more about how we manage your personal data below.

About this privacy policy
Who we are
The types of personal data we collect about you
How we collect personal data
How we use your personal data
Personal data that we receive about you from other organisations
Children’s personal data
Security of your personal data
When we share your personal data
International data transfers
How long we keep your personal data
How we may contact you
Cookies and similar technologies
Your privacy and data protection rights with regard to the personal data that we hold about you
Contact us for information about how we use your personal data
Changes to this privacy policy
Contact us for information about how we use your personal data
Changes to this privacy policy

About this privacy policy

This privacy policy explains how we collect, use, share, transfer and sell (for California residents only) your personal data when you use the services provided on our site or interact with us. This privacy policy also explains your data privacy rights.

Personal data is any information about you by which you are identified or could be identified. This can include information such as:

Your name, date of birth, email address, postal address, phone number, mobile number or financial details, such as payment cards you use to purchase services.
Information about your device (such as the IP address, which is a numerical code to identify your device that can provide information about the country, region or city where you are based).
Information relating to how you use and interact with our site and services.

When we refer to “personal data” in this policy, we are also referencing “personal information,” as it is defined under California law, and as it is defined under Australian law.

Guardian Holidays advertises holidays offered by carefully selected third party travel operators. Our site contains links to the third party websites and services of the travel operators whose holiday offers are advertised on our site and to other third party sites and services. These websites and services have their own privacy policies. If you follow a link to a third party, you should read the privacy policy shown on that site to see how they use your personal data. 

Who we are

Guardian News & Media Limited, Kings Place, 90 York Way, London N1 9GU is the data controller in respect of your personal data that you share with us. This means that we are responsible for deciding how and why we hold and use your personal data. If you want to contact us directly, you can find our contact details in the “Contact us for information about how we use your personal data” section below.

The types of personal data we collect about you

We collect your personal data about you when you visit our site, use our products or services, or when you interact with us. We collect your personal data in the following ways:

Directly from you, e.g. when you sign up for our services, purchase products or services, including by signing up for newsletters or selecting specific topics you are interested in, and when you browse or use our site.
Personal data we generate about you, e.g. personal data we use to authenticate you, or personal data we generate about you from your IP address or your preferences.
Personal data we collect from third parties, e.g. personal data that helps us to combat fraud or which we collect, with your permission, when you interact with us through your social media accounts and/or payment service providers (e.g. Paypal).

More details about the types of personal data we collect are provided below.

The personal data we collect when you use Guardian Holidays

When you use the Guardian Holidays services we may collect:

Your contact details, such as name, address, email address.
Booking details about the passengers, departure date, accommodation details and billing details.

You can change or remove these details by contacting the relevant holiday partner.

Personal data we generate about you

When you use our site we may also also use cookies or similar technologies to collect extra data, including:

Your IP address - a numerical code to identify your device, together with the country, region or city where you are based.
Your geolocation data - your IP address can be used to find information about the latitude, longitude, altitude of your device, its direction of travel, your GPS data and data about connection with local Wi-Fi equipment.
Information on how you interact with our services.
Your browsing history of the content you have visited on our site, including how you were referred to our site via other websites.
Details of your computer, mobile, TV, tablet or other devices, for example, the unique device ID, unique vendor or advertising ID and browsers used to access our content.
We will not collect special categories of data from you - such as personal data concerning your race, political opinions, religion, health or sexual orientation - unless you have chosen to provide that type of personal data to us.

How we collect personal data

We collect personal data when you:

Submit a request for a brochure or a call back.
Submit booking details for a specific holiday through our site.
Save your favourite holiday offers on our site.
Sign up for marketing communications.
Enter our competitions.
Use mobile devices to access our content.
Access and interact with any of our sites.
Contact our customer service team.

We also collect personal data through cookies and other similar technologies. Please refer to our cookie policy for more details on how we use cookies.

How we use your personal data

We use personal data collected through our site only when we have a legal ground to do so. We determine the legal grounds based on the purposes for which we have collected your personal data.

Legal grounds for using your personal data

The legal ground may be one of the following:

Consent: Often we will use your personal data because we have asked for your consent, which you can withdraw at any time. Please refer to the table below for examples of where we ask for your consent.
Performance of a contract with you (or in order to take steps prior to entering into a contract with you): We will use your personal data if we need to in order to perform a contract with you.
Compliance with law: In some cases, we may have a legal obligation to use or keep your personal data, for example for auditing purposes.
Our legitimate interests: We may process your personal data where it is necessary for our legitimate interests in a way that might be expected as part of running the Guardian and in a way which does not materially impact your rights and freedoms. For example, it is in our legitimate interests for us to understand our customers, promote our services and operate our site efficiently for the provision of our services. Please refer to the table below for examples of when we rely on our legitimate interests to use your personal data.

Purpose	Lawful Basis	Our Legitimate Interest (if applicable)
To place non-essential cookies, or other similar technologies.	Consent	N/A
To place cookies so you can save your favourite holidays in the “Favourites” section, to tailor your emails based on the information provided to us	Legitimate Interest	To personalise our services for you and remember your settings
To send marketing communications to you.	Consent or Legitimate Interest	We send marketing if you have signed up for those communications, signed up for a newsletter, or if you have registered and have not opted out of our marketing. You can opt out of these communications at any time by clicking on the “unsubscribe” link at the bottom of the email or following the instructions in the message. You can also opt out and select communication preferences (such as email, SMS, mail) in the “Emails and Marketing” tab, when signed into your Guardian account.
To analyse what content has been viewed on our site.	Legitimate Interest	To understand how our site is used, improve our content and personalise your signed in experience.
To backup our systems and databases.	Legitimate Interest	For recovery purposes in the event of any issue with our systems.
To refer you to the travel operators for booking and facilitating requests for brochures and call backs.	Legitimate Interest	To provide you with our services. In some cases, we will collect booking information for the holidays sold and operated by the travel operators through our site.

In addition to the above, we also rely on the legitimate interests below to use your personal data:

For internal administrative purposes related to our services - such as our accounting and records.
To calculate our commission with regard to the bookings that you have made when referred through our site
To inform you of any changes to our services, such as updates to our terms and conditions.
To enable you to share our content with others using social media or email.
When we respond to your queries and to resolve complaints.
To troubleshoot technical issues on our site and their functionalities.
When we de-identify or anonymise personal data, or aggregate it so that it can no longer identify you.
For security and fraud prevention, and to ensure that our site is safe and secure and used in line with our terms of use.
To contact you directly via social media or email if you send us emails or engage with the Guardian on social media or contact us.

Where we rely on cookies to collect any personal data please see our cookie policy for more information and how to manage your cookie choices through our “Privacy Settings” link on our site in the footer of every page.

Where personal data has been de-identified or anonymised, it will not be used in order to re-identify individuals.

Updating your personal data and your profile page on our site

When you register for an account with theguardian.com, you have access to a profile page. Under “edit profile” you can review and update what personal data is public when you comment on our articles, or if people look up your profile. For more information on how to manage your account please see https://manage.theguardian.com/help-centre.

You may also update your marketing preferences in the “Emails and marketing” and/or “Data privacy” tabs in your account.

Personal data that we receive about you from other organisations

Information that we receive from the travel operators about your bookings

When you make a holiday booking with one of the travel operators advertised on our site, you will be directed to the travel operator’s site to make the booking. We will receive details of your holiday booking made with the travel operator, in order to calculate our commission.

Children’s personal data

We do not aim any of our services directly at children under the age of 13 and we do not knowingly collect personal data about children under 13 in providing our services, unless you include information about children as passengers in your booking.

Security of your personal data

We have implemented appropriate technical and organisational controls to protect your personal data against unauthorised processing and against accidental loss, damage or destruction. You are responsible for choosing a secure password when we ask you to set up a password to access parts of our site. You should keep this password confidential and you should choose a password that you do not use on any other site. You should not share your password with anyone else, including anyone who works for us. Unfortunately, sending information via the internet is not completely secure. We cannot guarantee the security of any personal data sent to our site while still in transit and so you provide it at your own risk.

When we share your personal data

Within the Guardian group of companies

Depending on where you live, we may share your personal data within the Guardian group of companies in the UK, US, or Australia. We may share it in order to perform a contract with you, for administrative purposes, or when we have a legitimate interest in doing so. For example:

Sometimes we may receive a letter, email or another form of communication from you that we consider to be significant to the history of the Guardian. We may decide to share this with the Guardian Archive run by the Guardian Foundation for historic and archiving purposes.
We may share your data to understand how you interact across our group products or to tailor and offer relevant advertising to you.

With external organisations

We share your personal data with other organisations that are not directly linked to us under the following circumstances:

Service providers - We may share your data with other organisations that provide services on our behalf. We may do this to perform a contract we have entered into with you, where it is in our legitimate interests or with your consent. Examples of when we may share your data with service providers include sharing with:

Website hosting provider, Vibe Systems Limited, to manage the Guardian Holidays website on our behalf.
Life-cycle engagement platforms such as Braze, to help us build and manage our campaigns and send our email communications.
Service providers that help provide us with insights and analytics that help us to improve our products and services. For example, we use Google Analytics to understand how visitors engage with our site. If you don’t want Google Analytics to be used in your browser, you can install the ‘Google Analytics Opt-Out Browser Add-On’, provided by Google.
Data management companies, such as Formstack, that help us collect data via online forms and surveys.

Advertising partners - We may also share your data collected through our sites with our advertising partners, as set out in our cookie policy. These partners help us deliver relevant advertising across our sites. For example, we use Google Ad Manager to assist us with the delivery of relevant ads.

Agencies and authorities if required by law - We may reveal your personal data to any law enforcement agency, court, regulator, government authority, or in connection with any legal action if we are required to do so to meet a legal or regulatory obligation, where the request is proportionate, or otherwise to protect our rights or the rights of anyone else (for example, in response to a valid and properly served legal process such as subpoena or warrant). If we have your contact details, we will take reasonable steps to attempt to notify you prior to disclosing your data unless (i) prohibited by applicable law from doing so, or (ii) there are clear indications of unlawful conduct in connection with your use of our services.

Holidays partners - We share your personal data where you have requested a brochure or a call, we forward your contact details to the relevant travel operator. Where the travel operator has enabled us to do so, we will also collect and share the booking details. However, we do not process payment details. All payments are processed by third parties and we do not have access to your payment information.

Social media organisations - We may share your personal data with other organisations when our site uses social plug-ins from these organisations (such as sharing on social media). These other organisations may receive and use personal data about your visit to our site. If you browse our site, personal data they collect may be connected to your account on their site. For more information on how these organisations use personal data, please read their privacy policies.

Organisation/s that buy any of the Guardian group companies - We may share your personal data to any other organisation that buys, or to which we transfer all, or substantially all, of our assets and business. If this sale or transfer takes place, we will use reasonable efforts to try to make sure that the organisation we transfer your personal data to uses it in line with our privacy policy.

When we share your personal data, as specified above, with any organisation which accesses your data in the course of providing services on our behalf will be governed by strict contractual restrictions to make sure that they protect your data and comply with applicable law. We may also independently audit these service providers to make sure that they meet our standards.

International data transfers  

Data we collect may be transferred to, stored and processed in any country or territory where one or more of our Guardian group companies or service providers are based or have facilities. While other countries or territories may not have the same standards of data protection as those in your home country, we will continue to protect personal data that we transfer in line with this privacy policy.  

Whenever we transfer your personal data out of the European Economic Area (EEA), we ensure similar protection and put in place at least one of these safeguards:

We will only transfer your personal data to countries that have been found to provide an adequate level of protection for personal data.
We may also use specific approved contracts that use Standard Contractual Clauses for the protection of personal data where appropriate, with our service providers that are based in countries outside the UK or the EEA, including those based in the US and Australia. These contracts give your personal data the same protection it has in the UK or the EEA.

If you are located in the EEA, you may contact us for a copy of the safeguards which we have put in place for the transfer of your personal data outside the UK or the EEA.

How long we keep your personal data

We keep your data for only as long as we need to. How long we need your personal data depends on what we are using it for, as set out in this privacy policy. For example, we may need to use it to answer your queries about a product or a service and as a result may keep your personal data while you are still using our product or services. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. We may also need to keep your personal data for accounting purposes, for example, where you have booked a holiday.

If we no longer need your data, we will delete it or make it anonymous by removing all the details that identify you. If we have asked for your permission to process your personal data and we have no other lawful grounds to continue with that processing, and you withdraw your permission, we will delete your personal data. However, when you unsubscribe from marketing communications, we will keep your email address to ensure that we do not send you any marketing in future.

How we may contact you

Service communications

From time to time we may send you service emails, for example, thanking you when you book a holiday with us.

Marketing communications

If you select the “favourite” button to bookmark a specific holiday, we may send you an email with information about the holiday and a link to manage your bookmark.

If you want to receive the Guardian Holidays newsletter, you will need to sign up through a Guardian account on theguardian.com. You can manage your marketing preferences in the “Emails and marketing” tab of your Guardian account. Please view the privacy policy of theguardian.com to see how your personal data is used when you register for a Guardian account.

You can decide not to receive these emails at any time and will be able to “unsubscribe” directly by clicking a link in the email or through your email preferences in the tab “Emails and marketing” when you are signed in to your Guardian account.

For more information on how to manage your account please see https://manage.theguardian.com/help-centre.

Guardian research

If we have your permission or you have not opted out, we may contact you for research purposes, for example about the Guardian app. You can opt out from being contacted in this way by signing into your Guardian account and going to the tab “emails and marketing”.

Responding to your queries or complaints

If you have raised a query or a complaint with our support team, we may contact you about this to answer your query or to resolve your complaint.

Cookies and similar technologies

When you visit our site, we may collect personal data from you automatically using cookies or similar technologies.

This privacy policy includes our cookie policy, where you can find more information about our use of cookies.

Your privacy and data protection rights with regard to the personal data that we hold about you

You have a number of rights with regard to the personal data that we hold about you and you can contact us with regard to the following rights in relation to your personal data:

You have the right to receive a copy of the personal data we hold about you.
You have the right to correct the personal data we hold about you.
Where applicable, you may also have a right to receive a machine-readable copy of your personal data.
You also have the right to ask us to delete your personal data or restrict how it is used. There may be exceptions to the right to erasure for specific legal reasons which, if applicable, we will set out for you in response to your request.
Where applicable, you have the right to object to processing of your personal data for certain purposes.
Where you have provided us with consent to use your personal data, you can withdraw this consent at any time.
If you do not want us to use your personal data for marketing analysis, you can change your settings in the “Data privacy” tab of your Guardian account.

If you would like to exercise any of your rights specified above, please email dataprotection@theguardian.com or write to the Data Protection Officer at Guardian News & Media Limited, Kings Place, 90 York Way, London N1 9GU. We will respond to all standard legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a large number of requests. In this case, we will notify you and keep you updated.

We may need verification of your identity to proceed with a request. If you provide us with proof of identity containing information that does not match our records, we may request further proof of identity from you. This is a security measure to ensure that your personal data is not disclosed to any person who has no right to receive it.

You will not have to pay a fee to obtain a copy of your personal data (or to exercise any of the other rights). However, for any further copies requested by you, we may charge a reasonable fee based on administrative costs. 

Contact us for information about how we use your personal data or complaints 

If you have any questions about how we use your personal data or if you have a concern about how your personal data is used, please contact the Data Protection Officer at Guardian News & Media Limited, Kings Place, 90 York Way, London N1 9GU or email dataprotection@theguardian.com.

Complaints will be dealt with by the Data Protection Team, and will be responded to within 30 days.

If you are not satisfied with the way your concern has been handled, you can refer your complaint to the Information Commissioner’s Office.

If you have a question about anything else, please see contact holidayoffers@theguardian.com.

Changes to this Privacy Policy

If we decide to change our privacy policy, the updated privacy policy will be posted on this page. If the changes are significant, we may also choose to email all our registered users with the new details. If required by law, we will get your permission or give you the opportunity to opt out of any new uses of your data.

Changes to this privacy policy to date

The most recent changes to this privacy policy were made on: