Privacy Policy
Learn more about Hummingbird Travel privacy policy
About this policy
Hummingbird Travel Limited respects your privacy and is committed to protecting your personal data. This policy explains what personal data we collect, where it comes from, how and why we use it, who we share it with, how long we keep it, and the rights available to you.
This policy applies when you use our website, communicate with us, use our booking or travel services, attend our events, apply to work with us, interact with us through WhatsApp, or otherwise provide personal data to us. It also applies when a travel agent, employer, travelling companion or another person provides your information to us for a booking or service.
This policy applies alongside any more specific notice we provide when collecting personal data. Our Cookies Policy gives additional information about cookies and similar technologies used on our website.
Who we are
Hummingbird Travel Limited is the controller responsible for the personal data described in this policy. We are a company registered in England and Wales under company number 09494278.
Registered office: Unit 3 Linen House, Kilburn Lane, London, England W10 4BQ
Email: [email protected]
Website: https://hummingbird.travel
Whose personal data we process
We may process personal data about:
customers, travellers and people making or managing enquiries and bookings;
travel agents, tour operators, corporate clients and their personnel;
people travelling as part of a family, group or business booking;
hotel, transport, excursion and destination-service contacts;
website visitors, event attendees and marketing recipients;
job applicants, contractors and prospective personnel; and
people who contact us, including through WhatsApp or social media.
How we collect personal data
We collect personal data from the following sources:
directly from you when you enquire, book, pay, travel, attend an event, subscribe, apply for a role or contact us;
from travel agents, tour operators, employers, group organisers, relatives or travelling companions acting for you or arranging services involving you;
from hotels, airlines, transport companies, excursion providers, destination-management partners and other suppliers involved in a booking;
from Meta and WhatsApp when you communicate with us through the WhatsApp Business Platform;
from payment providers, fraud-prevention services and financial institutions;
automatically from our website and online services through server logs, cookies, analytics tools, pixels and similar technologies; and
from public sources and authorities where this is lawful and relevant to our services or legal duties.
If you provide personal data about another person, you should have authority to do so and should make this policy available to them where appropriate.
Personal data we collect
Category | Examples |
|---|---|
Identity and contact data | Name, title, postal address, email address, telephone number, nationality, date of birth and customer or account identifiers. |
Booking and travel data | Travel dates, destinations, itinerary, accommodation, transfers, flight details, booking references, preferences, loyalty information and information needed to deliver requested services. |
Passport and immigration data | Passport details, visa information and other travel-document information where required to arrange or deliver travel services. |
Health and accessibility data | Dietary requirements, allergies, disability or mobility needs, medical information and emergency information where relevant to a safe or requested service. |
Financial and transaction data | Billing details, bank or payment information, amounts paid, refunds, invoices and transaction records. |
Communication data | Emails, call notes, form submissions, feedback, complaints and correspondence, including WhatsApp messages and attachments. |
WhatsApp service data | Telephone number, WhatsApp profile name, message and attachment content, timestamps, delivery information, travel dates, preferences and booking references. |
Technical and usage data | IP address, device and browser information, identifiers, server logs, referring pages, website activity, cookie choices and analytics information. |
Marketing data | Marketing preferences, subscription status, campaign interactions and the source and date of consent where consent is used. |
Recruitment data | Application, CV, employment and education history, references, interview records, right-to-work information and related correspondence. |
Some travel requirements may reveal special category data, particularly health, disability, dietary or religious information. We process this information only where it is necessary for the requested service and an additional legal condition applies, such as your explicit consent, protection of vital interests or the establishment, exercise or defence of legal claims.
How we use personal data and our lawful bases
Purpose | Data used | Lawful basis |
|---|---|---|
Respond to enquiries and prepare quotations | Identity, contact, communication, booking and travel data | Steps requested before entering a contract; legitimate interests in responding to business enquiries |
Create and administer bookings and deliver travel services | Identity, contact, booking, travel, passport, financial, communication, health and accessibility data | Contract; legal obligation; vital interests where necessary |
Take payment, issue invoices and prevent fraud | Identity, contact, financial and transaction data | Contract; legal obligation; legitimate interests in preventing fraud and protecting our business |
Provide customer support and manage changes, disruptions, complaints and claims | Identity, contact, booking, travel, communication and relevant health or transaction data | Contract; legitimate interests in service management and legal claims; vital interests where necessary |
Communicate through WhatsApp for enquiries, quotations, bookings, confirmations, reminders and support | WhatsApp service data, communication, identity, contact, booking and travel data | Steps requested before entering a contract; contract; legitimate interests in providing responsive customer service |
Operate, secure and improve our website and systems | Technical, usage, identity and communication data | Legitimate interests in security, administration and service improvement; consent for non-essential cookies where required |
Manage business relationships, events and service communications | Identity, contact, communication and event data | Contract; legitimate interests in managing professional relationships; consent where required |
Send permitted marketing outside the stated WhatsApp support service | Identity, contact, marketing and campaign data | Consent or legitimate interests, subject to applicable electronic-marketing rules and the right to opt out |
Recruit personnel and manage applications | Identity, contact, recruitment and right-to-work data | Steps requested before entering a contract; legal obligation; legitimate interests in recruitment |
Comply with law, protect rights and respond to authorities | Any relevant category | Legal obligation; legitimate interests in protecting rights, preventing misuse and handling legal claims |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether your interests, rights or freedoms override our interests. You may ask us for further information about this assessment.
WhatsApp communications
We use Meta's hosted WhatsApp Cloud API to handle enquiries, prepare quotations, assist with bookings, send booking confirmations or service reminders, and provide customer support. We do not use this WhatsApp service for promotional marketing under the use described in this policy.
When you contact us through WhatsApp, we receive your telephone number, WhatsApp profile name, message and attachment content, timestamps and delivery information. You may also choose to provide travel dates, preferences, booking references and other information relevant to your enquiry or booking. Meta and WhatsApp process information involved in transmitting these communications under their own terms and privacy arrangements.
Relevant messages may be copied into our customer relationship management or booking system so that our staff can respond, maintain service continuity and keep an appropriate record of an enquiry or booking. Routine WhatsApp conversation records are kept for 24 months after the last interaction. Information incorporated into a booking, accounting record, complaint or legal claim may be retained for the longer period applicable to that record.
Do not send passport details, full payment-card information, bank security credentials, medical records or other unnecessary sensitive information through WhatsApp. If we need information of this kind, we will direct you to an appropriate channel. If you send such information without being asked, we will handle it only as reasonably necessary and may ask you to provide it again through a more suitable channel.
You may ask us to stop communicating with you through WhatsApp at any time. Stopping future messages does not automatically delete records already held by us. The deletion process is explained in the section headed Requesting deletion of WhatsApp data and on our standalone WhatsApp deletion page.
Sharing personal data
We share personal data only where necessary and lawful. Recipients may include:
Meta, WhatsApp and communications providers that transmit or support WhatsApp messages;
customer relationship management, booking, hosting, document-management and IT service providers;
travel agents, tour operators, hotels, airlines, transport providers, excursion providers and destination partners involved in an enquiry or booking;
payment processors, banks, accountants, auditors, insurers and fraud-prevention providers;
professional advisers, including legal advisers, and parties involved in a claim or business transaction;
government, immigration, border, regulatory, law-enforcement and tax authorities where disclosure is required or permitted; and
another controller where you ask us to make the disclosure or where it is necessary to protect vital interests.
We require processors acting for us to protect personal data, use it only on our instructions and provide appropriate confidentiality and security commitments. Some recipients, including travel suppliers and authorities, act as independent controllers and apply their own privacy policies.
International transfers
Travel services often require personal data to be sent to destinations and suppliers outside the United Kingdom and European Economic Area. Our technology and communications providers may also process data in other countries.
Where UK or EU data-protection law restricts an international transfer, we use an available lawful safeguard. Depending on the destination and relationship, this may include a UK adequacy regulation, an EU adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or another safeguard permitted by law. We may also rely on a specific legal exception where this is necessary to perform a contract or provide requested travel arrangements.
You may contact us for more information about the safeguard used for a particular transfer and, where available, a copy of the relevant protection.
How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including service, legal, accounting and reporting requirements. We consider the nature and sensitivity of the data, the risk from unauthorised use, the purpose of processing and applicable legal requirements.
Record | Retention approach |
|---|---|
General enquiries and quotations that do not become bookings | Normally 24 months after the last substantive contact |
Routine WhatsApp conversations | 24 months after the last interaction |
Booking, customer-service and contractual records | Normally six years after the booking or service is completed, or longer while a claim, complaint or legal duty remains active |
Financial, invoice and accounting records | Normally six years after the end of the relevant accounting period, subject to applicable law |
Passport, visa and travel-document information | Only for as long as needed to arrange or deliver the travel service and satisfy a legal or supplier requirement, then securely deleted or anonymised |
Health, accessibility and dietary information | For the relevant booking and any necessary complaint or claim period, then securely deleted or anonymised |
Marketing records | Until you opt out or the information is no longer needed; a minimal suppression record may be retained to honour the opt-out |
Unsuccessful recruitment applications | Normally six months after the recruitment process, or up to 12 months where you agree to remain in a candidate pool |
Website analytics and cookies | As described in the Cookies Policy and the settings of the relevant tool |
When a retention period ends, we delete or anonymise the information unless a lawful reason requires continued retention. Backup copies may remain for a limited period until overwritten under our normal backup cycle and are protected from ordinary use during that period.
Security
We use appropriate organisational and technical measures designed to protect personal data from accidental or unlawful destruction, loss, alteration, disclosure or access. Access is restricted to personnel and service providers that need the information for authorised purposes and are subject to confidentiality obligations.
No method of communication or storage is completely secure. Please use the channel we specify for sensitive documents and tell us promptly if you believe personal data has been sent to the wrong recipient or an account has been compromised.
Children and group bookings
Our services are not directed to children acting independently. We may process a child's personal data when an adult, travel agent or authorised organiser includes the child in a booking. The person providing the information should have authority to do so. We use a child's information only as needed to arrange and deliver the travel service, meet legal requirements or protect the child's vital interests.
Marketing and communication choices
You may unsubscribe from marketing at any time by using the unsubscribe link in a message or contacting us. We may retain a minimal suppression record so that we do not contact you again for the marketing you declined. Service communications about an enquiry, booking, disruption, safety issue or contract are not marketing and may continue while they remain necessary.
The WhatsApp service described in this policy is used for enquiries, bookings and customer support, not promotional marketing. If we introduce promotional WhatsApp messaging in the future, we will first update this policy and obtain any consent required by law and WhatsApp's rules.
Cookies and online technologies
Our website uses cookies, analytics and similar technologies. Where required, non-essential technologies are used only after you have made a consent choice. You can change available choices through the website's cookie controls and your browser settings.
For more information, read our Cookies Policy.
Your data protection rights
Depending on the law that applies and the circumstances, you may have the right to:
request access to your personal data and information about how it is used;
ask us to correct inaccurate or incomplete personal data;
ask us to delete personal data in certain circumstances;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests and object at any time to direct marketing;
receive personal data you provided in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where the right to portability applies;
withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing; and
seek safeguards in relation to a decision based solely on automated processing where that decision has legal or similarly significant effects.
To exercise a right, email [email protected]. We may ask for information needed to confirm your identity and locate the relevant records. We normally respond within one month. We may extend the period by up to two further months for a complex request or multiple requests, but we will explain the extension within the first month. A right may be limited where an exemption or another person's rights apply.
Your data protection rights
Depending on the law that applies and the circumstances, you may have the right to:
request access to your personal data and information about how it is used;
ask us to correct inaccurate or incomplete personal data;
ask us to delete personal data in certain circumstances;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests and object at any time to direct marketing;
receive personal data you provided in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where the right to portability applies;
withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing; and
seek safeguards in relation to a decision based solely on automated processing where that decision has legal or similarly significant effects.
To exercise a right, email [email protected]. We may ask for information needed to confirm your identity and locate the relevant records. We normally respond within one month. We may extend the period by up to two further months for a complex request or multiple requests, but we will explain the extension within the first month. A right may be limited where an exemption or another person's rights apply.
Requesting deletion of WhatsApp data
Email [email protected] with the subject WhatsApp Data Deletion Request. Include your WhatsApp telephone number in international format and enough information to help us locate the conversation, such as the approximate date and the enquiry or booking reference if available. Do not include passport details or payment-card information in the request.
After any necessary identity check, we will delete or irreversibly anonymise WhatsApp data that we are not required or entitled to retain. If information must be kept for a booking, financial record, legal duty, complaint or claim, we will restrict it to that purpose where appropriate and explain the reason. We will confirm completion or the outcome of the request.
Full instructions are available on our WhatsApp Data Deletion page.
Complaints
Please contact us first at [email protected] if you have a concern about our use of personal data. We will investigate and respond.
You may also complain to the UK Information Commissioner's Office. Information about making a complaint is available at https://ico.org.uk/make-a-complaint. If EU data-protection law applies to you, you may also complain to the supervisory authority in the EU country where you live, work or believe an infringement occurred.
Changes to this policy
We may update this policy when our services, systems or legal obligations change. The current version will be published on this page with its last-updated date. We will provide additional notice where a change materially affects how we use personal data and the law requires notice.
If you have any questions about this ‘Privacy Notice’ or how and why we process personal data, please contact us at: [email protected]
ADDRESS:
Or: - Hummingbird Travel
253 Kilburn Lane, London W10 4BQ
CHANGES TO OUR PRIVACY NOTICE
Updates to this Privacy Notice will appear on this website.
This Privacy Notice was last updated in 19th October 2026.