1. Who we are
DesireHub Travel LP (“DesireHub”, “we”, “us” or “our”) is the controller of personal information described in this notice, except where another organisation is identified as an independent controller.
Registered name: DesireHub Travel LP
Company number: [COMPANY NUMBER]
Registered office: [REGISTERED OFFICE, UNITED KINGDOM]
Email: info@desirehub.org
Website: www.desirehub.org
ICO registration: [ICO REGISTRATION NUMBER, IF APPLICABLE]
2. Information we may collect
- Identity and contact details: name, age confirmation, email address, telephone or WhatsApp number, country of residence and preferred language.
- Enquiry details: destination, dates, budget, package interest, accommodation and transport preferences, and messages exchanged with us.
- Booking and verification details: where necessary, legal name, date of birth, nationality, passport or identity-document information, emergency contact and travel-document status.
- Transaction information: amount, currency, payment date, payer name, reference and confirmation received through bank transfer, Wise or Revolut. We do not ask for online-banking passwords, PINs or complete card credentials.
- Technical information: IP address, device and browser information, pages viewed, referring URL, approximate location, cookie identifiers and security logs.
- Communications: email, contact-form and WhatsApp correspondence, complaints, support requests and records of agreed arrangements.
- Supplier information: information received from airlines, accommodation providers, transport providers and other suppliers when needed to administer an arrangement or address a problem.
3. Why we use information and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Answering an enquiry and preparing a proposal | Steps requested before entering a contract; legitimate interests in responding to genuine enquiries. |
| Confirming and administering travel or concierge arrangements | Performance of a contract; compliance with legal obligations. |
| Taking and reconciling payments | Performance of a contract; legal obligation; legitimate interests in financial administration and fraud prevention. |
| Sharing necessary details with airlines, hotels, transport operators and other selected providers | Performance of a contract or pre-contract steps; explicit consent where special-category information must be shared. |
| Customer support, complaints and legal claims | Performance of a contract; legal obligation; legitimate interests in resolving concerns and protecting legal rights. |
| Website security, abuse prevention and service improvement | Legitimate interests in operating a secure and effective service. |
| Google Analytics and other non-essential measurement | Consent, obtained through our cookie controls. |
| Email or message marketing | Consent where required, or another lawful basis expressly permitted by applicable direct-marketing law. You may opt out at any time. |
Where we rely on legitimate interests, we assess whether the use is necessary and balanced against your rights. You may request further information about that assessment.
4. Adult preferences and other sensitive information
Please do not provide graphic, excessive or irrelevant intimate details. If limited sensitive information is genuinely necessary to review or coordinate a lawful request, we will identify the purpose and seek a separate, specific and explicit consent where required. You may withdraw that consent, although withdrawal will not affect earlier lawful processing and may mean we cannot continue the relevant request.
We do not accept information suggesting underage, forced, coerced, exploitative, abusive or unlawful activity. We may refuse service, preserve relevant evidence or make a report where reasonably necessary to protect a person, prevent crime or comply with law.
5. Who may receive information
We disclose only what is reasonably necessary. Recipients may include:
- Odoo and other website, hosting, email, security and technical providers;
- Google, where you consent to Analytics cookies;
- WhatsApp/Meta when you choose to communicate through WhatsApp;
- Wise, Revolut, banks and payment or fraud-prevention providers involved in a transaction;
- airlines, ticketing agents, accommodation providers, transport operators, venues, concierge providers and other suppliers needed for a requested arrangement;
- professional advisers, insurers, auditors and debt-recovery providers;
- courts, regulators, tax authorities, law-enforcement bodies or safeguarding organisations where disclosure is legally required or reasonably necessary.
Independent suppliers may act as separate controllers and provide their own privacy notices. We do not sell personal information.
6. International transfers
Because enquiries and travel arrangements may be international, information may be processed outside the United Kingdom. Where UK data-protection law requires safeguards, we use an applicable adequacy regulation, approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. In limited cases, a transfer may be necessary to perform a contract requested by you or may occur with your explicit consent after relevant risks are explained.
You may contact us for information about the safeguard used for a particular transfer.
7. How long we keep information
| Record | Typical retention approach |
|---|---|
| Unsuccessful or inactive enquiries | Normally up to 12 months after the last meaningful contact, unless needed for security, dispute or legal reasons. |
| Confirmed bookings, contracts and service communications | Normally up to 6 years after completion or termination, reflecting potential legal and accounting claims. |
| Invoices and financial records | Kept for the period required by tax, accounting and anti-fraud law, commonly 6 years or longer where legally required. |
| Identity-document copies | Deleted or securely restricted as soon as no longer necessary for the stated verification or booking purpose, subject to legal requirements. |
| Marketing preferences and suppression records | Until consent is withdrawn; minimal suppression information may be retained to respect an opt-out. |
| Analytics information | According to the configured Google Analytics retention period and your cookie choices. |
We may keep information longer where a complaint, chargeback, investigation, legal claim or safeguarding concern is active. We may retain anonymised information that no longer identifies a person.
8. Security
We use proportionate organisational and technical safeguards, including access restrictions, authentication, secure service providers, staff confidentiality, data minimisation and incident-response procedures. No internet transmission or storage system is completely secure. If a personal-data breach creates a legal notification duty, we will notify the appropriate regulator and affected individuals as required.
9. Automated decisions
We do not currently make decisions producing legal or similarly significant effects solely through automated processing. Security and analytics tools may automatically flag unusual activity, but material service decisions should receive human review.
10. Children
DesireHub is intended only for adults aged 18 and over. We do not knowingly offer services to or solicit personal information from minors. If you believe a minor has provided information, contact us so we can investigate and take appropriate action.
11. Your data-protection rights
Depending on the circumstances and applicable law, you may have rights to:
- receive information about our processing and obtain a copy of your personal data;
- correct inaccurate or incomplete information;
- request deletion or restriction;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time where processing relies on consent;
- complain to a supervisory authority.
Rights are not absolute. We may need to verify identity and may retain information where law or valid legal claims require it. We normally respond within the legally applicable period.
12. Cookies and external services
Our use of cookies and Google Analytics is explained in our Cookie Policy. Links to external websites or services are governed by their own privacy notices.
13. Changes to this notice
We may update this notice when our services, suppliers or legal obligations change. The current version and effective date will appear on this page. Material changes may also be communicated through an appropriate additional notice.
Contact and complaints
For privacy questions or to exercise a right, email info@desirehub.org. You may also complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address your concern first.