Privacy & Cookies Policy

1. Who we are

Travel Orbit Ltd (“Travel Orbit”, “we”, “us”) is a travel agency registered in England & Wales (Company No. 17221281), with its registered office at 80 Gardenia Avenue, Luton, LU3 2NT, United Kingdom. We are the data controller responsible for the personal data described in this policy.

For any privacy question, to exercise your rights, or to raise a concern, contact us at [email protected] or by telephone on 02039323459.

2. The personal data we collect

Depending on how you interact with us, we may collect:

• Identity and contact data — name, date of birth, gender, postal address, email address, and telephone number.
• Travel document data — passport number, nationality, expiry date, and passport copies, where required to ticket or to process a visa (including Umrah visa applications).
• Booking and enquiry data — departure airport, destinations, travel dates, passenger counts, fare and package preferences, and the content of enquiries you submit.
• Payment data — information necessary to take payment. Card details are processed by our regulated payment provider; we do not store full card numbers on our own systems.
• Special category data — health or accessibility requirements (for example, mobility, dietary or medical needs for a trip) and information that may reveal your religious beliefs (which can be implicit in arranging Umrah travel). We do not require this data unless you choose to provide it for a specific trip. Where we process it, our lawful condition is your explicit consent under Article 9(2)(a) UK GDPR. You give that consent by knowingly providing the information for the stated purpose, and you can withdraw it at any time by contacting us at [email protected] — withdrawal will not affect processing carried out before you withdrew. Where we process special category data on any basis other than your explicit consent, we maintain an Appropriate Policy Document as required by Schedule 1 to the Data Protection Act 2018.
• Website measurement data — when you view a page, we record the page address, the website that linked you to us (its domain name only), any campaign tag in the link you followed, a broad device type (mobile, tablet or desktop), an approximate location (country, and where available region and city) worked out by our hosting provider from the network connection, and whether the quote pop-up was shown, closed or used on that page. Unless you turn it off, we also give each visit to our website a random reference number, which your browser holds in its session storage (not a cookie) until you close the tab. We record that number with each page you view during the visit, the order you view them in, and roughly how long each page stays open on your screen. If you send us an enquiry during the visit, the same number is stored with your enquiry. We do not store your IP address, and we do not store your browser’s user-agent string. See section 9 for detail.
• Advertising measurement data (Meta) — only if you click Accept on our cookie banner, Meta’s advertising cookies (called _fbp and _fbc) are set in your browser and Meta’s Pixel tells Meta which pages you view on our website. We do not send Meta a page-view event for our Umrah pages. Separately, when you send us an enquiry we send Meta a record that an enquiry was made, using Meta’s Conversions API, unless you have clicked Reject on our cookie banner, your browser sends a Global Privacy Control or Do Not Track signal, or you tick “Don’t send me offers”. That record contains: your email address, telephone number and name, each converted into a coded form (a “hash”) before it leaves our systems; your country, also hashed, where we can tell you are in the UK; your IP address and your browser’s user-agent string; the address of the page you sent the enquiry from, without anything after a “?” (the address can show which part of our website you were on; for an enquiry sent from one of our Umrah pages it shows only our home page address); reference numbers for the enquiry; the identifiers held in the Meta cookies (only if you clicked Accept); and, if you reached us from a Facebook or Instagram advert, that advert’s click identifier, which we read from the page address we already record for your enquiry. We do not send Meta the content of your enquiry, your travel details or the type of trip you chose. We use your IP address and user-agent string only to send this record and do not save them for this purpose.
• Sales-stage updates (Meta) — after you send us an enquiry, including an enquiry you make through one of our Facebook or Instagram lead forms, we tell Meta when it moves through our sales stages: contacted, qualified, booked (our system calls this “converted”) or closed (our system calls this “lost”). Each update contains: for an enquiry made through a Facebook or Instagram lead form, Meta’s own reference for your form entry and, where we hold them, your email address and telephone number, each converted into a coded form (a “hash”) before it leaves our systems; for an enquiry made on our website, your email address, telephone number and name, each hashed in the same way, and, if you reached us from a Facebook or Instagram advert, that advert’s click identifier, which we read from the page address we already record for your enquiry; and, in both cases, a reference number for the enquiry, the name of the stage, and the date and time of the update. We do not send Meta the content of your enquiry, your destination, your travel details or the type of trip you chose.

Where your data comes from. Usually you give us your data directly. Sometimes we receive it from a third party — for example, the lead traveller who books a trip for a group, or a partner who passes on an enquiry you made. Where we receive your data indirectly, it comes from that person or organisation, and this policy explains how we use it.

Enquiries made through our Facebook and Instagram lead forms. If you send us an enquiry through one of our lead forms on Facebook or Instagram, the details you entered on the form reach us through Meta’s lead-form service and we treat them like any other enquiry. Meta already holds the details you gave on its form. The sales-stage updates described above apply to these enquiries in the same way as to enquiries made on our website.

Providing certain data is necessary. To ticket a flight or arrange a visa we must collect passport and related details. If you do not provide them, we will not be able to complete that booking.

3. How we use your data and our lawful bases

• To arrange and manage your booking (performance of a contract) — taking enquiries, obtaining quotes, ticketing, and liaising with suppliers.
• To meet legal and regulatory obligations (legal obligation) — including ATOL reporting, anti-fraud checks, and records we are required to keep.
• To receive, store, and follow up on enquiries you submit (legitimate interests: receiving travel enquiries, retaining them in our CRM system, and following up is a core commercial activity essential to the operation of a travel agency; enquiry data is limited to what you choose to provide and is retained only as long as necessary — see §6 below; this interest is not overridden by your rights). From June 2026, enquiry data is stored durably in our Supabase database (London region) rather than delivered by email only — this allows us to manage leads reliably and ensures no enquiry is silently lost.
• To send you a confirmation of your enquiry (legitimate interests: confirming receipt provides a better customer experience and reduces duplicate enquiries) — a transactional confirmation email is sent via Zoho ZeptoMail when you submit a form.
• To send you occasional travel offers by email (legitimate interests, under the 'soft opt-in' rule in the Privacy and Electronic Communications Regulations) — only about travel services like the ones you asked about. You can say no when you enquire by ticking 'Don't send me offers', and every email has an unsubscribe link.
• To measure and improve our advertising on Facebook and Instagram using the Meta Pixel and its cookies (consent: the Pixel and its cookies are switched on only if you click Accept on our cookie banner, and you can withdraw your consent at any time using “Cookie settings” in the footer of any page — see sections 8 and 9).
• To tell Meta that an enquiry was made, so we can measure which of our adverts lead to enquiries and show our offers to people likely to be interested (legitimate interests: the same interest as above; we send Meta only the data listed in section 2, mostly in hashed form, and never the content of your enquiry; you have the right to object — see section 8). We do not send this record if you clicked Reject on our cookie banner in the browser you used, if your browser sends a Global Privacy Control or Do Not Track signal, or if you ticked “Don’t send me offers” when you sent your enquiry.
• To tell Meta when an enquiry moves through our sales stages, so we can measure and improve our advertising and help Meta show our adverts to people likely to book (legitimate interests: knowing which of our adverts lead to bookings, and helping Meta show our adverts to people likely to book, is a legitimate interest of a business that advertises online; we send Meta only the data listed in section 2, mostly in hashed form, and never the content of your enquiry, your destination or the type of trip; you have the right to object — see section 8). We do not send these updates if you ticked “Don’t send me offers” when you sent your enquiry or later asked us not to send you offers, if you clicked Reject on our cookie banner (or your browser sent a Global Privacy Control or Do Not Track signal) in the browser you used to send a website enquiry, or if you object.
• To understand how our website is used, and which pages and sources lead to enquiries, so we can improve it (legitimate interests: knowing which pages work, where visitors come from and where they leave is a legitimate interest of a business that relies on its website; this is switched on by default, and you can turn it off at any time by choosing Reject on our cookie banner or “Cookie settings” in the footer of any page — see section 9; you also have the right to object — see section 8).

We do not make decisions about you that produce legal effects, or similarly significant effects, based solely on automated processing. If you choose a Fly-Now-Pay-Later option, the finance provider may carry out an automated affordability or credit assessment under its own privacy policy; we will tell you who the provider is before you apply.

Marketing emails

If you send us an enquiry, we may email you travel offers similar to what you asked about. We never sell your details. You can stop these emails at any time by clicking 'unsubscribe' in any email, replying to ask, or emailing [email protected]. We will then stop, and keep a short record of your choice so we don't email you again by mistake.

4. Who we share your data with

We share personal data only as needed to deliver your travel arrangements, to operate our website infrastructure, or to measure our advertising, with:

• Principal Suppliers — airlines, hotels, ground operators, and destination management companies fulfilling your booking.
• Ticketing and consolidation partners through whom we source fares, and parties connected to our ATOL/IATA obligations.
• Payment and finance providers — our payment processor and, where you use a Fly-Now-Pay-Later facility, the relevant lender.
• Government and visa authorities — including the Saudi authorities for Umrah visa applications, and border or security authorities where legally required.
• Professional advisers and IT providers who support our business under appropriate confidentiality and data-processing terms.
• Advertising partner — Meta Platforms Ireland Limited, for advertising measurement (see “Advertising partner” below).

Technology sub-processors introduced from June 2026

When you submit an enquiry through our website, your data passes through the following sub-processors. Each operates under a signed Data Processing Agreement (DPA) with Travel Orbit Ltd and is bound by appropriate UK GDPR safeguards.

• Supabase, Inc. — database and backend infrastructure
  Your enquiry data (name, contact details, travel preferences, and website attribution data) is stored in a Supabase database hosted in the London region (AWS eu-west-2). This means your personal data remains within the United Kingdom and does not leave the UK for database storage. Supabase acts as a data processor strictly under our instruction; the DPA has been signed via the Supabase platform. See Supabase’s privacy information at supabase.com/privacy.
• Zoho Corporation (ZeptoMail) — transactional email delivery
  When you submit an enquiry, Zoho ZeptoMail is used to deliver a confirmation email to you and a notification to our team. Emails are sent from our verified travelorbit.co.uk domain. Zoho acts as a processor of your email address and the enquiry summary for this purpose only. See Zoho’s privacy information at zoho.com/privacy.html.
• Cloudflare, Inc. — spam protection and rate-limiting
  Our enquiry form uses Cloudflare Turnstile, a privacy-preserving challenge mechanism that detects automated submissions without setting third-party tracking cookies. If you submit the form, Cloudflare’s Turnstile may process your IP address and browser signals to distinguish humans from bots. We also use Cloudflare’s infrastructure to host this website, to rate-limit requests so our systems are protected from abuse, and to determine an approximate location (country, and where available region and city) for the website measurement described in section 9 — Cloudflare works that out from the network connection and passes us only the result, so no IP address reaches our systems for that purpose. See Cloudflare’s privacy information at cloudflare.com/privacypolicy.
• Sendinblue SAS (Brevo) — marketing email delivery.
  If we send you offers, Brevo stores your name and email address and sends the emails for us, and records whether an email was opened or a link clicked. Brevo acts as a processor under a Data Processing Agreement. See brevo.com/legal/privacypolicy.

Advertising partner

Meta Platforms Ireland Limited (Facebook and Instagram). If you click Accept on our cookie banner, Meta receives data from its Pixel in your browser. When you send us an enquiry (unless you clicked Reject, your browser sends a Global Privacy Control or Do Not Track signal, or you tick “Don’t send me offers”), we send Meta the record described in section 2. We also tell Meta, through the same service, when an enquiry moves through our sales stages, as described in section 2; this includes enquiries made through our Facebook and Instagram lead forms. Meta uses this data to give us advertising measurement and optimisation services and, as explained in Meta’s own privacy policy and business tools terms, for its own purposes. See Meta’s privacy policy at facebook.com/privacy/policy/ and its cookies policy at facebook.com/privacy/policies/cookies/.

5. International transfers

Delivering travel often requires sending your data outside the United Kingdom — for example, to a hotel abroad or to the Saudi authorities for an Umrah visa. Where we transfer personal data internationally, we rely on an adequacy decision where one exists, or otherwise put in place an appropriate safeguard such as the UK International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses, and carry out a transfer risk assessment where required.

Where we rely on a safeguard, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can request a copy of the relevant safeguard by emailing [email protected]. Some transfers necessary to perform your booking (for example, sending your details to an overseas hotel or to a visa authority at your request) may instead rely on Article 49 UK GDPR (transfer necessary to perform a contract with you).

Meta Platforms Ireland Limited is based in Ireland. Meta may transfer data to the United States and other countries, and describes the safeguards it relies on in its privacy policy (facebook.com/privacy/policy/).

6. How long we keep your data

We keep personal data only for as long as necessary. In practice:

• Booking and financial records (including invoices and ATOL/IATA documentation): retained for 6 years after the end of the financial year in which the booking was completed, to meet HMRC and Companies Act record-keeping requirements.
• Passport copies and visa-application data: deleted within 6 months of trip completion, unless we are legally required to retain them longer.
• Enquiry and lead data stored in our database (including data submitted via our website forms from June 2026): retained for 24 months and then deleted. Where an enquiry converts to a confirmed booking, the booking records are retained under the financial-records period above.
• Marketing preference records (including opt-outs and unsubscribes): kept for as long as we hold your contact details, so we keep respecting your choice.
• Website measurement data (page views, visit reference numbers and page-time records): retained for 13 months and then deleted. If you send us an enquiry, the visit reference number stored with it is kept for as long as the enquiry record itself (see above).

Where we cannot state a fixed period, we determine retention by reference to the purpose, any legal or regulatory obligation, and limitation periods for potential claims.

7. How we protect your data

Our website is served over HTTPS, and we apply appropriate technical and organisational measures to protect your data, including sensitive documents such as passport copies. Access is restricted to staff who need it to perform their role.

Enquiry data submitted via our website is stored in a Supabase database hosted in the London region (AWS eu-west-2), meaning UK customer PII is held within the United Kingdom. Database access is restricted to our backend systems via a service-role key held as a server secret — the database is not publicly writeable. Submissions are protected from automated abuse by Cloudflare Turnstile before any data is written to the database.

8. Your rights

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• request erasure of your data in certain circumstances;
• restrict or object to certain processing;
• data portability; and
• withdraw consent at any time where we rely on consent.

Complaints. If you are unhappy with how we have handled your personal data, please contact us first at [email protected]. We will acknowledge your complaint within 30 days and respond as quickly as we can. You can also use the contact form on our website to raise a data-protection concern.

To exercise any of these rights, contact us at [email protected]. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, although we would welcome the chance to resolve your concern first.

Withdrawing consent and objecting (Meta advertising). You can withdraw your consent to Meta advertising cookies at any time by selecting “Cookie settings” in the footer of any page and choosing Reject. In that browser this stops Meta’s Pixel, deletes the Meta cookies (_fbp and _fbc), and means we send Meta no record when you later send us an enquiry. Your choice is remembered in your browser, so you will need to make it again in another browser or on another device. You can also tick “Don’t send me offers” on our enquiry form before you send it, so that no record is sent to Meta. If you have already sent an enquiry and object to the record we sent to Meta about it, email [email protected] and we will record your objection and stop any further sharing about you with Meta. You can also control the adverts you see in your Facebook and Instagram ad settings.

Objecting to sales-stage updates (Meta). You can stop us telling Meta how your enquiry progresses. When you send a website enquiry, tick “Don’t send me offers” or click Reject on our cookie banner before you send it. At any time, including if you sent your enquiry through a Facebook or Instagram lead form, email [email protected] or tell the person you are speaking to, and we will record your objection and stop any further sharing about you with Meta. This does not undo updates we have already sent. Meta explains how it uses data it receives in its own privacy policy, and you can control the adverts you see in your Facebook and Instagram ad settings.

Turning off our visit measurement. You can switch off our visit reference number and page-time measurement at any time by clicking Reject on our cookie banner, or by selecting “Cookie settings” in the footer of any page and choosing Reject (see section 9). Your choice is remembered in your browser, so you will need to make it again in another browser. If you have already sent an enquiry and object to us holding the visit reference number that was stored with it, email [email protected]: we will record your objection and remove the number from your enquiry record.

9. Cookies

We use the following types of cookies:

• Strictly necessary cookies — required for the site to function (for example, to remember your form progress). These do not require consent.
• Remembering that you closed our quote pop-up — if you close the small 'WhatsApp me a quote' box that can appear when you are about to leave a page, or if you send us your number through it, we save one small note in your browser's own storage (not a cookie) so we do not show you the box again: for seven days after you close it, or not at all after you have asked for a quote. The note holds only the date you closed it, or a yes/no that you sent the form. It contains no identifier, it is never sent to us, and nothing else on the site reads it. We treat this as remembering a choice you made; you can remove it at any time by clearing this site's data in your browser.
• Third-party map cookies (Google Maps) — loaded only if you click “Load interactive map” on our Contact page. Google sets cookies upon loading the map. See Google’s Privacy Policy for details.
• Advertising cookies from Meta (_fbp and _fbc) — these are not strictly necessary for the site to work, so we set them only if you click Accept on our cookie banner. They let Meta recognise your browser and link a visit that began with a Facebook or Instagram advert to an enquiry, so we can measure our advertising. You can withdraw your consent at any time (see below); if you do, Meta’s Pixel stops and we delete these cookies.

Other than the cookies listed above, we do not use advertising, analytics or other tracking cookies, and we do not sell your data or share it with data brokers.

Advertising cookies and the Meta Pixel (off unless you click Accept)

Meta’s Pixel and its cookies are off until you choose. A banner asks you to Accept or Reject them; the two choices are equally easy to make. If you close the banner without choosing, they stay off. You can change your mind at any time by choosing “Cookie settings” in the footer of any page. We remember your choice in your browser’s own storage (not a cookie) so that we do not ask again on every page.

If you click Reject, or later withdraw your consent, Meta’s Pixel stops, the cookies _fbp and _fbc are deleted from your browser, and we send Meta no record of any enquiry you later send from that browser. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a Reject for Meta: the Pixel does not load and we send Meta no record of your enquiry. We keep our own records of your enquiry, as described elsewhere in this policy. If you click Accept, the Pixel is switched on.

Advert click identifier. If you arrive from a Facebook or Instagram advert, the link carries a click identifier (called fbclid). The click identifier is read from the page address we already record for your enquiry, so that if you send us an enquiry we can tell Meta which advert led to it. We do not store it separately and we do not set a cookie for it.

Our Umrah pages. We do not send Meta a page-view event for our Umrah pages. For an enquiry sent from an Umrah page, the record we send Meta shows only our home page address, and we send no browser event for it.

Enquiry records are sent from our servers. The record we send Meta through its Conversions API when you send an enquiry is described in sections 2, 3 and 4. It is sent from our servers, and your cookie choice travels to our servers with your enquiry: if you clicked Reject (or your browser sends a Global Privacy Control or Do Not Track signal), we do not send it. If you have made no choice, we send it without the Meta cookie identifiers, because none have been set, unless you tick “Don’t send me offers”.

Our own website measurement (no cookies; on by default; you can turn it off)

We measure how our website is used — how many visits there are, where they come from, which pages people arrive on and leave from, how long pages stay open, and which pages and sources lead to enquiries — so we can improve the site and tell whether our marketing works. That measurement is built and run by us on our own website. It is not Google Analytics or any comparable third-party product, and we do not share it with any other company.

When you view a page, we record:

• the address of the page you viewed, without anything after a “?” (so a term you typed into our search box is never recorded);
• the domain name of the site that linked you to us — for example “google.com” — and never the full link, which could contain a search term you typed on that other site;
• any campaign tag (a “utm” label) present in the link you followed;
• whether you are on a mobile, a tablet or a desktop computer;
• an approximate location — your country, and where available a region and city — determined by our hosting provider, Cloudflare, from the network connection;
• whether the request appeared to come from an automated program rather than a person; and
• unless you have turned it off: a random reference number for your visit, the number of the page within the visit (first, second and so on), a label saying how you arrived (search, an AI assistant, social media, email, an advert, another website, or directly), and roughly how long the page was open and visible on your screen (up to 30 minutes), sent when you leave the page or switch away from it.

We also count, in the same way and with the same limits, how often the quote pop-up was shown, closed, or used to send a number. Those counts are totals only. They are not connected to the note described above, to the number you send us, or to anything that could identify you.

The visit reference number. It is a random number made up on your device when you arrive. It is held in your browser’s session storage — not a cookie — together with a small page counter, and both disappear when you close the tab. It is not made from your IP address, your device or anything else about you, and it is different on your next visit, so we cannot recognise you when you return or follow you across visits, other websites or devices. Within one visit it lets us see which pages were viewed in what order, so we can work out, for example, how many visits ended after one page and which pages people leave from. If you send us an enquiry during the visit, we store the same number with your enquiry, so that we can see which source and which first page led to it. Because it can be linked to an enquiry, we treat it as personal data. We use it only for these statistics: we do not use it to advertise to you, we do not send it to Meta or to any other company, and our reports show totals, never one visitor’s journey.

What we deliberately do not do. We set no cookie for this. The only things we keep on your device for this measurement are the visit reference number and the page counter described above. We do not store your IP address, in any form — not encrypted, and not converted into a code. We do not store your browser’s user-agent string. We do not build a fingerprint of your device, and this measurement does not use any third-party service to try to identify you. We can count how many visits there were, but we cannot count how many separate people visited, because the reference number changes with every visit.

Your choice. This measurement is switched on by default and you can turn it off at any time. Click Reject on our cookie banner, or choose “Cookie settings” in the footer of any page and click Reject. We then delete the visit reference number and the page counter from your browser, and we stop recording a reference number and page time. We still count that a page was viewed, with only the information in the first six points of the list above, with no reference number linking it to your other page views. Clicking Accept leaves this measurement on and also allows Meta’s advertising cookies (see above). Your choice is remembered in your browser, so you will need to make it again in another browser.

Why this measurement needs no consent. The rule that requires a cookie banner in the UK — regulation 6 of the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025 from 5 February 2026 — allows a website to store information on your device, or read it, without consent where the only purpose is to collect statistics about how the website is used in order to improve it, the information is not shared with anyone else except to help us improve the site, you are given clear information about the purpose, and you are given a simple, free way to object. This section is that information, and Reject and “Cookie settings” are that way to object. The lawful basis under UK GDPR is legitimate interests (section 3), and you have the right to object (section 8). Nothing on this page changes how we handle enquiry data you send us, which is covered by the rest of this policy.

Your browser’s privacy signals. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we do not record your page views at all and we do not create a visit reference number. We honour those signals even though the law does not require us to for this measurement.

We keep this measurement data for 13 months and then delete it (section 6).

If we ever introduce analytics that uses cookies, shares your data with another company for that company’s own purposes, or goes beyond statistics about how our website is used, we will update this policy and, where the law requires it, obtain your consent before doing so.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date above shows when it was last revised. Material changes will be reflected on this page.

Travel Orbit Ltd · Registered in England and Wales · ATOL Protected