Privacy Notice

1. Who we are

Plume & Frost Travel is a trading name of Plume & Frost Travel Ltd, a company registered in England and Wales (company number 17529061). Plume & Frost Travel Ltd is an Associate of Your Travel Consultant Ltd (company number 16034077). For the information described in this notice, Plume & Frost Travel Ltd is the data controller: we decide how and why it is used.

If you have any questions about your information, or want to use any of your rights, please contact Neil directly:

• Email: neil@plumeandfrost.co.uk
• Phone: 0161 327 5028
• ICO registration number: ZC281462

2. How we work with Your Travel Consultant

Plume & Frost Travel is an Associate of Your Travel Consultant Ltd (“YTC”), whose ATOL and PTS licences financially protect your bookings. There are two stages to how your information is looked after:

• Planning your journey. From your first enquiry or discovery call, through proposals and conversations, we look after your information ourselves, as described in this notice.
• Booking your journey. When you decide to book, we enter the details needed for your booking into YTC’s booking systems. YTC then processes that information to make, manage and protect your booking, issue your ATOL Certificate and meet its legal obligations, as set out in YTC’s privacy policy. The travel companies who provide your holiday, such as airlines, cruise lines, hotels and tour operators, also receive the details they need, and look after them under their own privacy policies.

3. What we collect

Information you give us

• Contact details: your name, email address, phone number and the best time to talk.
• Your travel plans: anything you share in our enquiry form or in conversation, such as the kind of journey you’re dreaming of, destinations, dates and length, who’s travelling, where you’d depart from, a special occasion, your budget, your perfect journey, your non-negotiables and nice-to-haves, and any notes.
• Holidays you save: holidays you add to “My enquiry” on our Collection pages, once you send them to us.
• Travel inspiration sign-up: if you sign up with the form at the foot of our pages, your email address.
• WhatsApp messages: if you choose to message us on WhatsApp, your name, phone number and the messages you send.
• Discovery calls: if you book a call, Google’s appointment booking page asks for your name and email (and sometimes a phone number) so the call can be arranged.
• Booking details: if you go ahead, the information needed to book, such as full names as they appear on passports, dates of birth, passport details, contact and payment details, and any special requests.
• Details about the people travelling with you. Please only share someone else’s details with their agreement, and let them know about this notice.

More sensitive information

To plan a journey that genuinely works for you, we sometimes need more sensitive details about you or the people travelling with you. Data protection law calls this “special category” information, and gives it extra protection. It can include:

• health and medical conditions, including allergies, pregnancy and medication that affects travel;
• mobility, disability and accessibility needs, such as step-free access, wheelchair assistance or an accessible cabin or room;
• dietary requirements, which can sometimes reveal health conditions or religious beliefs.

How we handle it:

• Only with your explicit consent. We ask you to confirm, clearly and separately, that you’re happy for us to record and use these details before we rely on them: with the optional tick-box on our enquiry form, or by email or phone. If you mention them without ticking the box, we’ll check with you first. We keep a record of when and how you agreed. You can say no: we’ll still help, but we may not be able to arrange services that depend on them.
• Only to arrange and look after your travel. We use them to choose suitable flights, cabins, rooms and experiences, and to request assistance or special meals.
• Shared only where needed: with Your Travel Consultant and the travel companies who must know in order to look after you (for example, an airline arranging wheelchair assistance). Never for marketing.
• Kept secure: stored encrypted in our client records, so only Neil can read them.
• Kept briefly: deleted from our records within three months of your return, or within three months of our last contact if you don’t travel with us, unless you ask us to keep them for future trips, or we need them to deal with a complaint or legal claim.
• About other people: please only share someone else’s sensitive details if they have agreed, or if you are their parent or guardian.
• You can withdraw your consent at any time by contacting Neil. We’ll stop using the details and delete them, though anything already passed to travel companies for your booking stays with them under their own policies.

If you leave the enquiry form part-way

Our enquiry form has several short steps. If you give your name and email on the first step and then leave the page, or switch away from it (for example to another tab or app), before pressing send, what you have entered so far is sent to us so we can follow up if you’d like help. Your answers to “Your non-negotiables” and “Anything else?” are never sent this way: we only receive them when you press send. If you’d rather we didn’t, just tell us and we’ll delete it.

Information collected automatically

• Technical information: like every website, ours is delivered by a hosting provider (Cloudflare), which processes your IP address and browser details to deliver pages and protect the site from attacks. When you send an enquiry or sign up for emails, Cloudflare Turnstile also checks that a person, not an automated program, is sending it, using your IP address and information your browser shares. It doesn’t use cookies. We do not use any of this to identify you.
• Fonts: our typefaces are stored on our own website, so loading them doesn’t connect you to any other company.
• Counting visits: our website counts which pages are viewed and which buttons are pressed (such as “Enquire” or “WhatsApp”), with the website you came from, your country and type of device. It uses a code made from your IP address and browser details to group what one browser does on the same day, including sending an enquiry or booking a call. The code changes every day, so visits can’t be followed from one day to the next, and the counts aren’t stored with your name, email address or the details of your enquiry. It uses no cookies, never records what you type, and is kept for three months. You can switch it off; see “Counting visits” in our Cookies Policy.
• No tracking: we do not use advertising or tracking cookies, or any outside analytics service. See our Cookies Policy.

4. How we use it, and why we’re allowed to

Data protection law requires a lawful reason (a “lawful basis”) for each use of your information:

We never sell your information, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

5. Travel inspiration by email

From time to time we may send ideas, destination news and offers we think you’ll love. We only do this if you have agreed to hear from us and confirmed it, as described below. Enquiring or booking with us does not add you to the list.

When you tick the box on our enquiry form, or sign up with the form at the foot of our pages, we email you a link to confirm it was you. We only add you to the list once you open it and press “Yes, sign me up”, and we keep a record of what you agreed to and when.

You can unsubscribe at any time, using the link in any of our emails or by contacting Neil. Unsubscribing won’t affect any booking or plans in progress.

6. Who we share it with

We only share what is needed, with:

• Your Travel Consultant Ltd, when you book, as explained in section 2.
• Travel companies (such as airlines, cruise lines, hotels, tour operators, transfer and insurance providers) who provide your arrangements.
• Service providers who support our business, under contracts that require them to protect your information and use it only on our instructions:
  • Cloudflare, which hosts our website, delivers the enquiry form to Neil by email, stores our encrypted records of enquiries and clients (our CRM), checks that form submissions come from people rather than automated programs (Turnstile), counts visits to our website (see section 3), and sends our emails, including the automatic reply when you send an enquiry and our travel inspiration emails
  • Google Workspace, for our business email, calendar and discovery-call booking page. Our CRM adds follow-up and travel dates to a private Google calendar, showing your name, destination, trip type and Neil’s short follow-up note, never your email, phone number or any health details
• WhatsApp (WhatsApp Ireland Limited, part of Meta), only if you choose to message us there. Messages are end-to-end encrypted, and WhatsApp handles your account details under its own privacy policy. If you’d rather not use it, phone or email us instead.
• Authorities and advisers, where the law requires it (for example, regulators or the police), or to establish or defend legal claims.

7. Information sent outside the UK

Arranging travel abroad naturally means sharing details with travel companies in the countries you visit. Some of our service providers, such as Google, Cloudflare and (if you message us there) WhatsApp’s owner Meta, may also process information outside the UK, including in the United States. Where this happens, we rely on the safeguards UK law requires, such as UK adequacy regulations (including the UK-US Data Bridge) or the UK International Data Transfer Agreement or Addendum.

8. How long we keep it

• Enquiries that don’t go ahead, including unfinished enquiries and discovery-call bookings: up to 2 years after we were last in touch, then deleted.
• Clients who book: up to 6 years after your journey ends, for accounting, tax, insurance and legal purposes. YTC keeps booking and ATOL records according to its own policy.
• Travel inspiration emails: until you unsubscribe. We then keep your email address on a “do not contact” list, so we don’t email you again by mistake.
• Website visit counts: three months, then deleted automatically.
• Sensitive information (such as health, accessibility or dietary details): deleted within three months of your return (or of our last contact, if you don’t travel with us), unless you ask us to keep it for future trips or we need it for a complaint or claim.

9. Keeping it safe

We protect your information with sensible technical and organisational measures, including encrypting every enquiry and client record so only Neil can read it, encrypted devices, secure business accounts, and keeping business and personal systems separate. Our website uses encrypted connections (HTTPS). No system can be completely secure, but if something ever went wrong in a way that put you at risk, we would tell you and the Information Commissioner’s Office (ICO) as the law requires.

10. Your rights

Under UK data protection law you have the right to:

• access the information we hold about you and receive a copy;
• have inaccurate or incomplete information corrected;
• have your information deleted, where we no longer need it or have no lawful reason to keep it;
• restrict how we use it, or object to our use of it based on legitimate interests;
• object to marketing at any time; we will always stop;
• withdraw consent at any time, where we rely on it (this doesn’t affect anything done before you withdrew it);
• receive information you gave us in a portable format (data portability).

To use any of these rights, contact Neil. We may need to confirm your identity, and we will reply within one month. There is normally no charge.

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right: email or write to Neil, and we’ll acknowledge your complaint within 30 days, look into it, tell you the outcome and keep a record of it. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

11. Children

Our website and services are for adults. We only collect details about children when a parent or guardian provides them to arrange a family journey, and we use them only for that purpose. Any sensitive details about a child, such as a medical or dietary need, are handled as described in section 3 with the parent’s or guardian’s explicit consent.

12. Changes to this notice

We may update this notice from time to time, for example if we start using a new service. The date at the top shows when it last changed. If a change significantly affects you, we will let you know.