1. What data we process

To operate the platform we process account details (name, email, password hash), booking details (traveller names, dates, chosen products), payment metadata handled by our card processor (Stripe — we do not store full card numbers), support correspondence, and technical/analytics data such as device, approximate location and usage. AI trip-planning inputs you provide are used to generate suggestions only.

2. Lawful bases for processing

• Performance of a contract — to create your account, process bookings and issue refunds.
• Legal obligation — to meet tax, accounting and consumer-protection requirements.
• Legitimate interests — to secure the platform, prevent fraud and improve our services, balanced against your rights.
• Consent — for non-essential cookies, analytics and marketing communications, which you can withdraw at any time.

3. Your data subject rights

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no overriding legal reason to keep it.
• Right to data portability — receive your data in a structured, machine-readable format, or have it transmitted to another controller where technically feasible.
• Right to object — object to processing based on legitimate interests, and to direct marketing at any time.
• Right to restrict processing — ask us to pause processing while a dispute is resolved.
• Right to withdraw consent — where processing relies on consent, withdraw it without affecting prior lawful processing.

4. How to exercise your rights

Email our data protection contact (below) with your request and enough information to verify your identity. We respond within one month, as required by the GDPR, and will tell you if we need an extension for complex requests. Exercising your rights is free unless a request is manifestly unfounded or excessive.

5. International data transfers

Holiday Lydian is headquartered in the United States and works with service providers (including our card processor and infrastructure providers) that may process data outside your country. Where personal data of EEA/UK individuals is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent mechanisms.

6. Data retention

We keep personal data only as long as necessary for the purposes described here — typically for the life of your account and for the period required by tax, accounting and consumer-protection law after your last booking. When data is no longer needed it is deleted or anonymised.

7. Automated decisions and profiling

Our AI trip-planning assistant produces recommendations to help you plan; it does not make decisions with legal or similarly significant effects about you without human involvement. Booking, pricing and refund outcomes follow the published terms of the products you choose.

8. Right to lodge a complaint

If you believe we have not handled your data lawfully, you may contact our data protection team first, and you also have the right to lodge a complaint with your local supervisory authority (for EEA/UK residents, your national data protection authority).