Privacy Policy
Draft: not yet legally reviewed
This document is a working draft and has not yet been reviewed by a travel-trade solicitor. It is published here for transparency only and does not yet represent the final terms of any booking.
The short version: we collect what we need to answer your enquiry and arrange your trip, and nothing else. We do not sell your data, we do not run advertising trackers, and you can have your record deleted by asking.
Who we are
ZanNex Travels Ltd, registered in England and Wales (Company No. 17271800), is the data controller for personal data submitted through this site. Write to privacy@zannextravels.com about anything on this page.
What we collect, and why we are allowed to
UK GDPR requires a lawful basis for every use of personal data, so here is each one separately rather than as a single list.
| What | Why | Lawful basis |
|---|---|---|
| Enquiry details: name, email, phone, party size, dates, and anything you write in the notes | To reply to you and to quote and arrange the trip | Steps before a contract, and our legitimate interest in running the business |
| Booking and payment records | To deliver what you booked and to keep the accounts | Performance of a contract, and legal obligation for the tax records |
| Your IP address at the moment you submit a form | Bot checking and rate limiting, so the form is not abused | Legitimate interest in keeping the site usable |
| Page views: which page, which language, where you arrived from. Switched off at present, so none of this is collected | To see which pages are useful. No profile is built and it is never used to target you | Your consent. If we switch it on you will be asked first, and nothing is recorded unless you accept |
Where we rely on legitimate interests you can object at any time, by emailing privacy@zannextravels.com.
How visitor counting works
Our visitor numbers come from Netlify, our hosting provider, which counts requests from its own server logs. That happens at the server, so nothing is placed in your browser and no script runs on your device to make it happen.
The site also has its own page-view counting built in, and it is switched off. Off here means the code is not sent to your browser and the endpoint that would receive it is not there, rather than collected and ignored. If we ever turn it on, you will be asked before anything is sent, and a no is remembered. Should you accept, we still would not store your IP address alongside your browsing: your IP address and browser type would be combined with the day's date and a secret key held only on our server and turned into a short code, which cannot be worked back to you, is different the next day, and is not shared with anyone.
Who else sees it
Only the suppliers needed to run the service, each under a written contract, and none of them may use your data for their own purposes: our hosting provider (Netlify), our database and accounts provider (Supabase, whose servers for this site are in London), our form delivery (Formspree), our email delivery (Brevo and Resend), our CRM (HubSpot), our payment provider (Stripe, which we never send card details to because you enter them on Stripe's own page), and our error monitoring (Sentry). Where a trip requires it we also share what is necessary with the airline, hotel or ground operator concerned. We do not sell your data and we do not share it for advertising.
If you create an account
You do not have to. Everything on this site works without one, and an enquiry never requires it.
There are no passwords. You either receive a one-time link by email or sign in with a Google account, and in both cases we store your email address and, if Google supplies it, your name. We do not receive or store a password, and we never see your Google password.
Choosing “Continue with Google” tells Google something. Google learns that you signed in to ZanNex Travels and when. That is inherent to how it works and we cannot prevent it, which is why the email link is offered alongside and involves nobody but us and the company that carries the mail. The choice is entirely yours and neither route gets you anything the other does not.
Signing in attaches enquiries you have already sent to your account, so you can see them. We match them only on an email address that has been proved to be yours, by clicking the link we sent to it or by Google confirming it. We never match on an address somebody has merely typed into a form, because that would let a stranger claim your records.
Ask us at privacy@zannextravels.com to close an account and we will delete it, subject to the record-keeping periods below where a booking has been made.
Data leaving the UK
Some of those suppliers are based in the United States, and some travel arrangements require sending details to a hotel or operator in Saudi Arabia or elsewhere in the Gulf. Where data leaves the UK we rely on the UK International Data Transfer Addendum or the UK Extension to the EU Standard Contractual Clauses, except for transfers needed to perform your own booking, which are made under the contract exception. Ask us at privacy@zannextravels.com for the detail on any specific supplier.
How long we keep it
- Enquiries that never became a booking: 24 months from the date you sent them, then the identifying fields are removed.
- Bookings: 7 years after the trip, because HMRC requires the financial records to be kept for six full tax years.
- Page-view records: none exist, because the counting is switched off. Were it ever switched on and accepted, 14 months, and they would contain no identifier that can be traced to you.
You can ask for earlier deletion at any time.
Your rights
Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to receive it in a portable format, and to object to processing based on legitimate interests. Email privacy@zannextravels.com and we will respond within one month, free of charge.
If you are not satisfied with our answer you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.
Automated decisions and children
Nothing here is decided automatically: every quote is put together by a person. This site is not aimed at children, and we do not knowingly collect data from anyone under 13. Where a booking includes children, we collect their details from the adult making the booking and use them only to arrange that trip.
Cookies
There is no cookie banner because there is nothing to consent to: everything stored on your device is either needed for the site to work or a setting you chose. The one thing that would need consent, page-view counting, is switched off, and turning it on turns the ask on with it. The complete list of what is stored on your device is on the cookie policy.