Privacy notice and your data rights

1. Who is responsible for your data

iLuxuryTravels (iluxurytravels.com) decides how and why personal data on this site is used, and is therefore the data controller under the EU and UK General Data Protection Regulation (GDPR) and a business under the California Consumer Privacy Act as amended by the CPRA (CCPA).

For any privacy matter, email privacy@iluxurytravels.com or use the request form at the end of this page. We answer within 30 days (GDPR) and 45 days (CCPA).

2. What we collect and why

We keep collection to the minimum needed to answer a stay request. We do not run advertising profiles and we do not build guest profiles beyond the enquiries you send us.

• Stay requests: your name, email, optional phone number, the property or destination, your dates and guest numbers, and anything you write in the message. Legal basis: steps taken at your request before entering a contract (GDPR Art. 6(1)(b)).
• Audience measurement: an anonymous per-tab identifier, the page path, time on page and internal links clicked. No name, email or IP address is stored against it. Legal basis: your consent.
• Partner attribution: a campaign reference attached to booking partner links so a completed booking can be credited. Legal basis: your consent. Under the CCPA this may count as sharing, so it is off unless you switch it on.
• Strictly necessary storage: your privacy choice itself and basic security state. No consent is required for these.

3. Who we share it with

We are a curation service: bookings are completed with the supplier holding the dates. When you follow a booking link, that partner (for example Booking.com, Expedia, Hotels.com or the property's own system, routed through Stay22) becomes responsible for the data you give them, under their own privacy policy.

Our infrastructure providers process data on our instructions only, under written data processing terms: our hosting and database platform, and our email delivery provider. We do not sell personal data for money. We never share special category data, and we do not knowingly collect data from anyone under 16.

4. Where data is stored and how it is protected

Personal data is held in a managed Postgres database. It is encrypted in transit with TLS and encrypted at rest with AES-256 on the storage layer, with encrypted automated backups. Access is restricted by row-level security rules: enquiry records can only be read by authenticated administrators, never by other visitors, and the site's public pages have no read access to them at all.

Administrative access requires an individual signed-in account with an administrator role; there are no shared logins and no credentials are held in the website code. Where data is transferred outside the EEA or UK, it is covered by the European Commission's Standard Contractual Clauses.

5. How long we keep it

Stay requests are kept for 24 months from your last contact, so we can handle follow-up questions and any dispute about a booking, then deleted. Anonymous measurement records carry no identifier and are kept in aggregate. Records of privacy requests are kept for 24 months, stripped of identifying details once fulfilled, as proof that we acted on them.

6. Your rights

Wherever you live, you can use the form below. We will not treat you differently for exercising any of these rights.

• Access — a copy of the personal data we hold about you.
• Erasure ('the right to be forgotten') — deletion of your enquiries and any data we hold about you, unless we are legally required to keep it.
• Correction — fix anything inaccurate.
• Portability — receive your data in a machine-readable file.
• Objection and restriction — ask us to stop or pause a particular use.
• Withdraw consent — at any time, using Privacy choices in the footer; this does not affect anything done before you withdrew it.
• California residents — the right to know, delete, correct, and to opt out of the sale or sharing of personal information (switch off Partner attribution), plus the right to limit use of sensitive personal information, which we do not collect. An authorised agent may act for you with written proof.
• EU/UK residents — the right to complain to your supervisory authority (in the UK, the Information Commissioner's Office).

7. Cookies and similar storage

This site uses browser storage rather than advertising cookies. Nothing outside the strictly necessary category runs until you allow it, and you can change or withdraw your choice at any time using Privacy choices in the footer.

8. Manage your privacy choices

Turn audience measurement or partner attribution on or off at any time. Switching partner attribution off is also how California residents opt out of the sharing of personal information.

9. Make a data request

Use this form to ask for a copy of your data, a correction, deletion, or to opt out of sharing. Requests are logged and actioned by a named administrator.