Explicit Consent Text For Sending Commercial Electronic Message

All Year Cyprus Travel UK Limited (‘A1’/‘us’/‘our’/‘we’) is committed to protecting and respecting your privacy. 

We created this Privacy Policy (‘Policy’) to provide you with information on who we are and how and why we collect, store, use and share any information relating to you in connection with your use of our website “http://www.ptholidays.com/” (‘Website’). The services we provide to you  will be called the ‘Services’. By visiting our Website or creating a user account you are accepting and consenting to the practices described in this Policy. 

This website is not intended for children and we do not knowingly collect data relating to children.

IF YOU DO NOT AGREE WITH THIS POLICY, DO NOT ACCESS OR USE OUR SERVICES OR INTERACT WITH ANY OTHER ASPECT OF OUR BUSINESS. 

This Privacy Policy is provided in a layered format so you can click through to the specific areas set out below. 

0. SUMMARY

1. Who we are?

2. What types of personal data do we collect about you?

3. How do we collect your personal data?

4. How and why do we use your personal data?

5. Marketing

6. Analytics and Online Tracking

7. Cookies and other tracking technologies

8. Who do we share your personal data with?

9.International transfers

10.How do we keep your information safe?

11.How long do we keep your personal data?

12.What are your legal rights?

13.How do we communicate with you?

14.How can you submit a query or a complaint?

15.Contact Details

16.Our Policy Towards Children

17.Links to third-party websites

18.Changes to our Policy

SUMMARY

This section summarises how we obtain, store and use information about you. It is intended to provide a very general overview only. It is not complete in and of itself and it must be read in conjunction with the corresponding full sections of this Policy.

Data controller: All Year Cyprus Travel UK Limited, a limited company incorporated in England and Wales with registered number 07491353 and with our registered office at 239-241 Kennington Lane, London, United Kingdom, SE11 5QU is a data controller and responsible for your personal data.  

UK Information Commissioner’s Office (ICO) Registration number: ZB759713

What types of information we collect: We may collect, use, store and transfer different kinds of personal data about you which we have grouped as Identity Data (e.g. name), Contact Data (e.g. e-mail address), Technical Data (e.g. your IP address, device or browser type), Usage Data (e.g. which pages you have viewed, the time when you view them and what you clicked on, the geographical location from which you accessed our website (based on your IP address)), Marketing and Communications Data, Profile Data (e.g. your username), Transaction Data (e.g. your booking information) and Legal Data (e.g. our agreements with you)

Do we collect any sensitive personal information? Special category data (e.g., health, ethnicity, beliefs) is only collected with your explicit consent when necessary to provide our services or in case of an emergency. 

How we collect or obtain information about you: We collect personal data from you directly when you provide it to us (e.g. by contacting us; creating a user account on our Website); and automatically from your use of our Website, using cookies and similar technologies; and occasionally, from third parties. 

How we use your information: We use your information to provide, improve and administer our Services, communicate with you, for security and fraud prevention, advertise our goods and services, analyse your use of our Website, and comply with the law. We may also use your information for other purposes with your consent. We process information only when we have a valid legal reason to do so.

How we share your information with third parties: Only to the extent necessary to run our business and to provide you with our Services, to our service providers, to fulfil any contracts we enter into with you, where required by law or to enforce our legal rights. 

International Transfers of your data: We may transfer your data outside of the UK to provide our Services to you. Where we do so, we will ensure appropriate safeguards are in place together with enforceable rights and effective legal remedies for you and we will only share the minimum amount of data necessary to provide the relevant Services. 

How long we keep your information: for no longer than necessary, taking into account any legal obligations we have, any other legal basis we have for using your information (e.g. your consent, performance of a contract with you or our legitimate interests as a business). 

How we secure your information: We have appropriate security measures to prevent personal data from being accidentally lost, used or accessed unlawfully. We limit access to your personal data to those who have a genuine need to access it. 

Use of cookies and other tracking technologies: We use cookies and similar information-gathering technologies such as web beacons on our Website including functional, analytical and targeting cookies. For more information, please visit our Cookie Policy here. 

Your rights in relation to your information: to access your information and to receive information about its use; to have your information corrected and/or completed to have your information deleted; to restrict the use of your information to receive your information in a portable format; to object to the use of your information; to withdraw your consent to the use of your information not to have significant decisions made about you based solely on automated processing of your information including profiling to complain to a supervisory authority.

Who we are?

Data controller: All Year Cyprus Travel UK Limited, a limited company incorporated in England and Wales with registered number 07491353 and with our registered office at 239-241 Kennington Lane, London, United Kingdom, SE11 5QU is a data controller and responsible for your personal data.  

UK Information Commissioner’s Office (ICO) Registration number: ZB759713

What types of personal data do we collect about you?

“Personal Data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name and last name, username, national identity number or passport number, marital status, date of birth and gender.
• Contact Data includes billing address, email address and telephone number.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us such as Booking Information (Hotel/Facility Name, City/Region, Number of People, Room Count, Check-in and Check-out Dates), Booking Information (Hotel Name, Number of People, Room Count, Check-in/Check-out Dates, Transport Requests, Destination, Departure, Arrival Time), Tour Information (Tour Type, Date Range, Number of Participants, Itinerary), Flight Information (Airline, Flight Info, PNR number).
• Technical Data includes internet protocol (‘IP’) address, device ID, your login data, browser type and version, time zone setting and location (only country code of the user), browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our Website.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our Website and Services, including your device ID and the full Uniform Resource Locators (‘URL’) clickstream to, through and from our Website (including date and time); products you viewed or searched for such as Hotel or Tour Preferences, Date Ranges, Number of Participants, Filters Applied; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Legal Data includes Terms of Use Approval Information, Cookie Consent Information, GDPR Consent Information and Operation Logs.

If you fail to provide necessary personal data to us (we will let you know when this is the case, for example, by making this information clear in our registration forms), we may not be able to provide you with our goods and/or services.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data because this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

We do not collect, store and/or use ‘special category data’ about you unless you give us your explicit consent. This means details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.  We may need to collect your health data or other special category data if it is necessary to provide our services, such as in cases where specific health-related information is required to accommodate your needs or preferences during your stay. In such instances, we will ensure that we obtain your explicit consent before processing such special category data. This type of data will be handled with the utmost care and in compliance with applicable data protection laws to safeguard your privacy.

How do we collect your personal data? 

When you use our Services or interact with us through some other means we collect personal data either directly from you or through you. This information is divided into three main categories: (1) information you provide to us directly, (2) information we automatically collect from you, and (3) information we collect from third parties.

Data provided by you directly

We may collect personal data from you when you enter or send us information such as when you:

• Create a user account on our Website: Signing up is not mandatory, and you can use limited A1 Services without creating a user account on our Website. However, creating an A1 user account is needed when you want to access certain features such as tour bookings and hotel bookings. We collect the following information: Identity Data, Contact Data, Profile Data, Marketing and Communications Data, Legal Data and any other information you provide to us when you complete the registration form.
• Buy our Services: We collect the following information: Identity Data, Contact Data, Transaction Data, Profile Data, Legal Data, Financial Data, and Special Category Data (if you choose to give it to us).
• Request Marketing Communications: During the registration process for creating an account, you will be asked to indicate your preferences for receiving direct marketing communications from us.
• Give us reviews, feedback, or other user-provided content:  We collect and use your information when you provide reviews on our social media pages, reach out to us through our customer support channels or through surveys we send out. This may include Identity Data and Contact Data. 
• Personal data you provide about others: We process personal data about other individuals that you provide, such as those included in your booking. By sharing their personal data, you must ensure that you have their consent to do so and that you are authorised to provide it. You should also make sure they understand, where appropriate, how we may use their personal data.

Information we collect from you automatically

When you visit our Website, we will automatically collect information using cookies, web beacons, server logs and other similar technologies. The type of information that we collect includes Technical and Usage Data. For additional information, please see our Cookie Policy. 

Information we collect from third parties

We will receive personal data about you from various third parties and public sources:

• Technical Data is collected from analytics providers (such as Google - outside the UK); advertising networks (such as Facebook Ads, Google Ads - outside the UK); and search information providers (such as Google - outside the UK).
• Contact, Financial and Transaction Data is collected from providers of technical, payment and delivery services (such as PayPal, Stripe, Amazon Payments).
• Identity and Contact Data is collected from data brokers or aggregators (such as Experian) and from publicly available sources (such as Companies House and the Electoral Register based inside the UK).
• Identity, Contact Data and Special Category Data may be collected through your insurance company, payment provider along with their agents and medical staff, when it is necessary to act on your behalf, in the interest of other customers, in the event of an emergency or if you give us your consent.

The information we receive depends on the settings, permissions and privacy policy controlled by that third-party service. You should always check the privacy settings and notices in these third-party services to understand what data may be disclosed to us or shared.

How and why do we use your personal data?

Legal basis

We're required by GDPR and UK GDPR to tell you the legal reasons we have for processing your personal data. Here's why we might use your information:

• Consent: We may use your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose.
• Performance of a Contract: We may use your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request before entering into a contract with you. 
• Legal Obligations: We may use your information to follow the law, work with legal bodies, defend our rights, or show evidence in court.
• Legitimate Interests: We may use your information where it is necessary to conduct our business and pursue our legitimate interests, for example, to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). 

Purposes for which we will use your personal data

Marketing

Direct Marketing

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view of which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Third-Party Marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of Marketing

You can ask to stop sending you marketing communications at any time by logging into the Website and checking or unchecking relevant boxes to adjust your marketing preferences under your user account or by following the opt-out links within any marketing communication sent to you or by contacting us via [email protected].

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes (for example relating to order confirmations for tours, updates to our Terms and Conditions, checking that your contact details are correct).

Analytics and Online Tracking

We work with certain other parties (including analytics companies) to provide us with information regarding traffic on and use of the Services. Some of these parties collect information when you visit the Services or other online websites and services. These other parties set and access their own tracking technologies (including cookies, embedded scripts, and web beacons) and may otherwise collect or have access to your IP address or other unique identifiers, log information, and related information about you. These tracking technologies, including the Google Analytics User ID feature, may be used to assist in providing analytics, marketing, and for other purposes. We also use Google services to provide you with in-site search functionality. Both we and Google may collect, receive, and use your information as a consequence of your use of the Google services. Google’s data practices are set out in its privacy policy available at https://policies.google.com/privacy .

We do not control the information collection, use, or sharing practices of such parties, and we encourage you to consult their online policies. Some other parties may collect information about your online activities over time and across different websites when you use the Services.

Cookies and other tracking technologies

A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or other electronic device) when you use our Website. We use cookies and web beacons, action tag and single-pixel gifs on our Website. These help us recognise you and your device and store some information about your preferences or past actions.

For further information on cookies and any similar technologies (e.g. web beacons, action tag and single-pixel gifs), our use of ‘cookies’ and/or to relevant similar technologies, when we will request your consent before placing them and how to disable them, please see our Cookie Policy.

Who do we share your personal data with?

In delivering our Services to you, we may share your personal data with:

• Third parties in order to undertake various activities or services on our behalf in supporting our Services. They include: 
  • Our Business Partners: hotels and similar accommodation service providers, transportation companies such as airlines or bus companies, travel insurance companies if you opt-in to get a travel insurance, and event organisers related to your tour bookings.
  • Our Suppliers: website and application support providers (e.g. Google Analytics), and hosting and backend infrastructure (e.g. WordPress); analytics and search engine providers (e.g. Google Analytics); and providers for the delivery of promotional, digital advertising, co-marketing, or other communications. 
  • Financial Institutions: for the completion of payments related to the products and services you have purchased from us.
• If our business enters into a joint venture, purchases or is sold to or merged with another business entity, your information may be disclosed or transferred to the target company, or new business partners or owners or their advisors. 
• We may use the information that you provide if we are under a duty to disclose or share your information in order to comply with (and/or where we believe we are under a duty to comply with) any legal obligation; or to enforce the relevant terms of service and any other agreement; or to protect our rights or the rights of third parties. 
  • We may be required to share your personal data with government authorities for immigration, border control, or security purposes. Some countries require passenger data in advance (e.g., United Kingdom), and you are responsible for checking these requirements. We may assist you where appropriate.
  • We may share your personal data with credit reference and fraud prevention agencies when you order or purchase services. This may include details such as your name, address, and account information. These agencies may record a "footprint" of the search. If inaccurate or fraudulent information is detected, it may be shared with fraud prevention agencies (FPAs) and law enforcement.
• If you have a spouse or a financial associate, we may link your records. It is your responsibility to ensure you have their consent to disclose their personal data with us. Credit Reference Agencies (CRAs) may also link your records unless a successful disassociation is filed. Late payments may be reported to CRAs, affecting your credit file. For more information on how credit agencies use your data, please refer to the Credit Reference Agency Information Notice (CRAIN).

We will only provide these third parties with the minimum amount of personal data they need to fulfil the services requested or to fulfil our legal obligation. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law, such as Turkiye and Northern Cyprus. Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:

• We will only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data. A list of countries the UK currently has adequacy regulations in relation to is available here. We rely on adequacy regulations for transfers to the following countries: e.g. the European Union.
• We may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement or International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers; or
• a specific exception applies under UK laws.

How do we keep your information safe?

We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:

• only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible; 
• using secure servers to store your information; verifying the identity of any individual who requests access to information before granting them access to information; 
• using Secure Sockets Layer (SSL) software to encrypt any information you submit to us via any forms on our website and any payment transactions you make on or via our Website; and
• pseudonymisation of passwords.

However, despite our efforts to secure your information, no electronic transmission over the Internet or information storage technology can guarantee 100% security. Therefore, we cannot promise or guarantee that hackers, cybercriminals, or unauthorised third parties will not be able to bypass our security measures and access, steal, modify, or collect your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. It is essential that you only access our Services within a secure environment.

Where you have chosen a password which allows you to access our Website for using specific features (e.g. buying tour packages, making reservations), you are responsible for keeping this password confidential. We advise you not to share your password with anyone. We will not be liable for any unauthorised transactions entered into using your personal data, including but not limited to your username, and/or password. If you suspect unauthorised access, you should change your password with a strong password. 

How long do we keep your personal data?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

• By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.
• when you make an enquiry or correspond with us for any reason, whether by email or via our contact form, we will retain your information for as long as it takes to respond to and resolve your enquiry, and for 6 (six) further months, after which point we will delete your information.
• we will keep your personal data for as long as we have a contract with you.  If you delete your user account, we will retain your data for a further 90 days and then securely delete it.
• In some circumstances you can ask us to delete your data: see “What are your legal rights” section for further information.
• In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

What are your legal rights?

You have a number of rights under data protection laws in relation to your personal data. You have the right:

• Right to access: You have the right to request a copy of your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Right to rectification: You can ask us to change or complete any personal data we hold about you which is inaccurate or incomplete, though we may need to verify the accuracy of the new data you provide to us.
• Right to be forgotten/erasure: Under certain circumstances, you have the right to ask us to delete any personal data we hold about you. Please note that there may be situations where we must retain your personal data after a request for erasure where we have a lawful basis for doing so.
• Right to restrict the processing of your personal data: You can request us to restrict our use of your personal data if you do not believe your data is accurate, you believe the data processing is unlawful but you do not want us to delete the data, we no longer need the data for its intended purpose but you require it for the establishment, exercise or defence of a legal claim, or you have objected to our use of your personal data and want us to restrict its use until we have decided your objection.  
• Right to object to the processing of your personal data: You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). Please provide us with any information that you can based on which you believe your interest overrides ours.  If you do, we shall reassess our legitimate interest based on the new facts that you have provided and if granted will stop using your personal data for this purpose. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object. When objecting to our use of your personal data for direct marketing purposes we shall stop using your data for such purposes.
• Right to request the transfer of your personal data to you or to a third party: When you request this, we will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Right to object to automated decision-making and profiling: You have the right to be informed about the existence of any automated decision-making and profiling of your personal data, and where appropriate, be provided with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing that affects you.  
• Withdrawal of Consent: Whenever you have given your consent to the processing of your personal data, you can withdraw that consent at any time, doing so is free of charge. You can withdraw your consent directly in your account settings or otherwise at the bottom of any marketing communication that we send you. Please note that you can also withdraw consent for each communication channel separately, including email, text messages (SMS), allowing you to manage your preferences with precision.

If you wish to exercise any of the rights set out above, please contact us at [email protected].

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, in certain circumstances we reserve the right to charge a reasonable fee if your requests are clearly unfounded or excessive.

How do we communicate with you?

We may contact you through email or via your phone number. 

How can you submit a query or a complaint?

We are always happy to answer your queries regarding privacy. Please contact us by sending an e-mail to [email protected].

If you have a complaint, please get in touch with us so that we can resolve any concerns. 

If you are located in the UK, you also have a right to lodge a complaint with the Information Commissioners Office if you believe your personal data has been processed in a way which does not comply with the applicable law. You may call the ICO helpline on 0303 123 1113 or visit their website here.

If you are located in the EEA and you believe we are unlawfully processing your personal information, you may also complain to your Member State data protection authority. 

Contact Details

If you have any general questions about the Website or the information we collect about you and how we use it, you can contact us directly via [email protected]. 

Our Policy Towards Children

We respect the privacy of children and encourage parents and guardians to take an active role in managing their children's online activities. If you are under 18, please make sure you have consent from your parent and/or guardian before using the Services. We do not knowingly collect personal information from children in connection with those Services. This Policy is written for adults and assumes age-appropriate information will be made available for younger users by adults.

We only collect the personal information necessary to provide and improve our Services. We do not use children's data in ways that could be detrimental to their well-being.

If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at [email protected].

Please note that children and their parents or guardians have rights regarding the personal information we hold, including the right to access, correct, and delete this information. We provide clear instructions on how you can exercise these rights.

Links to third-party websites

Our Services may contain links to other external websites. We aren’t responsible for the practices, policies or content of such websites and suggest that you check their privacy policies to ensure that you are happy to continue browsing. We do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by the use of such third-party websites, services or applications. 

We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this privacy notice. We are not responsible for the content or privacy and security practices and policies of any third parties including other websites, services, or applications that may be linked to or from Services. You should review the policies of such third parties and contact them directly to respond to your questions. 

Changes to our Policy

We update and amend our Policy from time to time.

Minor changes to our Policy

Where we make minor changes to our Policy, we will update our Policy with a new effective date stated at the beginning of it. Our processing of your information will be governed by the practices set out in that new version of the Policy from its effective date onwards.

Major changes to our Policy or the purposes for which we process your information

Where we make major changes to our Policy or intend to use your information for a new purpose or a different purpose than the purposes for which we originally collected it, we will notify you by email (where possible). 

We will provide you with the information about the change in question and the purpose and any other relevant information before we use your information for that new purpose.

Wherever required, we will obtain your prior consent before using your information for a purpose that is different from the purposes for which we originally collected it.