1. Categories of personal information we collect

• Identifiers — name, email address, account credentials, IP address.
• Booking information — traveller details, travel dates and the products you reserve.
• Commercial information — records of bookings and refunds (payment card data is handled by our processor, Stripe; we do not store full card numbers).
• Internet/network activity — pages viewed, device and approximate location, analytics data.
• Inferences — travel preferences derived to power AI trip-planning suggestions.

2. We do not sell your personal information

Holiday Lydian does not sell your personal information for money, and we do not knowingly "share" it for cross-context behavioural advertising as those terms are defined under the CPRA. If this ever changes, we will update this notice and provide a clear opt-out before any such activity begins.

3. Your California rights

• Right to know — the categories and specific pieces of personal information we have collected, the sources, purposes and any third parties involved.
• Right to delete — request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out — of any sale or sharing of personal information (we currently do neither).
• Right to limit — the use of sensitive personal information to what is necessary to provide the service.
• Right to non-discrimination — we will not deny service, charge different prices or provide a lesser quality of service because you exercised a right.

4. How to submit a request

Email our privacy contact (below) with "California Privacy Request" in the subject line. We will verify your identity using information associated with your account before acting on a request to know, delete or correct. You may use an authorised agent, in which case we may require proof of authorisation.

5. Response timing

We confirm receipt within 10 business days and respond to verifiable requests within 45 calendar days, with a possible extension of up to a further 45 days for complex requests, as permitted by law.

6. Shine the Light

California's "Shine the Light" law permits residents to request information about disclosures of personal information to third parties for their direct-marketing purposes. Because we do not disclose personal information to third parties for their own direct marketing, there is nothing to report — but you may still ask.