Back to Home
Legal

Privacy Policy

Last updated: 8 September 2025

1. Who We Are

Oxo Travels Ltd ("we", "us", or "our") is a travel agency registered in England & Wales. We operate the website at oxotravels.co.uk and are the data controller responsible for your personal information.

If you have any questions about this policy or our data practices, you can contact our Data Protection Officer at privacy@oxotravels.co.uk.

2. What Data We Collect

We may collect and process the following categories of personal data:

  • Identity Data: First name, last name, title, date of birth, gender, and passport or travel document details where required for bookings.
  • Contact Data: Email address, telephone number, and billing/shipping address.
  • Booking & Travel Data: Flight itineraries, hotel reservations, passenger names, seat preferences, baggage information, and special requests.
  • Financial Data: Payment card details processed securely by Stripe. We do not store full card numbers on our servers.
  • Technical Data: IP address, browser type and version, time zone, browser plug-in types, operating system, and other technology on the devices you use to access our website.
  • Usage Data: Information about how you use our website, including pages visited, search queries, and time spent on pages.
  • Communications Data: Emails and messages sent via our contact form, including your enquiry subject and message content.

3. How We Use Your Data

We use your personal data for the following purposes:

To process and manage your bookingsPerformance of a contract
To send booking confirmations and travel documentationPerformance of a contract
To process payments via StripePerformance of a contract
To respond to your enquiries and contact form submissionsLegitimate interests
To send transactional emails (receipts, itineraries)Performance of a contract
To improve our website and servicesLegitimate interests
To comply with legal obligationsLegal obligation
To send marketing communications (with your consent)Consent

4. Data Sharing & Third Parties

We may share your data with the following categories of third parties:

  • Airlines and carriers for flight booking fulfilment (via Duffel API)
  • Hotels and accommodation providers for reservation management
  • Stripe, Inc. for secure payment processing
  • Resend for transactional email delivery
  • Supabase for secure account and authentication management
  • Government authorities (e.g. immigration and border control) where required by law
  • Professional advisors including lawyers and accountants

We do not sell your personal data to any third party for marketing purposes.

5. International Transfers

Some of our third-party service providers are based outside the UK/EEA. Wherever we transfer your data outside the UK, we ensure an appropriate level of protection is in place, such as through Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) or adequacy decisions.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes it was collected for, including legal, accounting, and regulatory requirements. Booking records are typically retained for 7 years after the travel date for financial and legal compliance. Marketing preferences are retained until you withdraw your consent.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure
Request deletion of your data ("right to be forgotten")
Right to Restriction
Limit how we process your data in certain circumstances
Right to Portability
Receive your data in a structured, machine-readable format
Right to Object
Object to processing based on legitimate interests or direct marketing
Right to Withdraw Consent
Withdraw consent at any time where processing is based on consent
Right to Complain
Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, please contact us at privacy@oxotravels.co.uk.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. All payment transactions are encrypted using TLS and processed by Stripe, which is PCI DSS Level 1 certified. Access to your data is restricted to authorised personnel only.

9. Cookies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use, please read our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. Where changes are significant, we will notify you by email.

Have a Privacy Question?

Our Data Protection Officer is happy to assist with any queries about your personal data.

Contact Privacy Team
Terms & ConditionsRefund PolicyCookie Policy