Privacy Policy

This Privacy Policy applies to Kosmar Holidays Limited whose Company Registration Number is 11367550 and Registered Address is 32 Eyre Street, Sheffield S1 4QZ.

We collect certain personal data about you and about any other person you include on your booking/product. The sort of personal data we collect is information that you provide to us, that we collect from you or observe about you, or that we obtain from other sources.

• When you make a booking or other purchase or enquiry we will ask you for your name, address, e-mail address, telephone number, date of birth, security questions and personal travel preferences. We need to collect this information in order to arrange the travel arrangements, products or other services you are requesting.
• When you make an enquiry or request to make a booking or purchase, depending on the arrangements you ask us to make for you, we will ask if you have any special requirements or any existing medical conditions. You may give us information concerning dietary requirements, medical /health conditions, disabilities, sexual orientation, race or religion. This information is referred to as special categories of personal data and when you give us this information we’ll use it to try and ensure your particular needs in relation to a booking/purchase are met. We may have to share that data with our third party suppliers and transfer it outside the UK, EU or European Economic Area (EEA), as described in this Privacy Policy. If you do not want to provide this information to us, or after you have provided us with this information you ask us or our data compliance department to stop processing this information, it may mean we won’t be able to provide all or parts of the services you have requested. If we have to cancel your booking/purchase as a result, you may incur a cancellation charge.
• If you enter a competition or promotion, complete a survey, or if you give feedback or report a problem with any of our Services, we will collect your name and relevant contact information and any other personal information you choose to give us.
• If you participate in Kosmar Rewards, we will collect your purchase history in order to record and manage your rewards.
• We may ask to see and retain a copy of passport details and other identification documents if, for example, you are purchasing foreign currency or completing a money transfer.
• If you contact us online, we may keep a record of your e-mail or other correspondence, and if you call us by telephone, we may monitor and/or record phone conversations for training and customer service reasons.
• If, when using our Services, you make a search on our websites or with one of our travel consultants and you enter or provide any of your personal data (including telephone number or e-mail address), but do not make a booking or other purchase, we will keep and use the data you’ve provided for a limited time and purpose, as mentioned below.

To help us keep your information current, accurate and complete, please ensure you tell us if anything needs to be changed.

Based on how you have used our Services in the past and your activity on our website, social media channels, or with our contact centre and stores, we collect the following personal data about you:

• Details of the services we have provided to you in the past, including your previous travel arrangements, such as holidays and other purchases, and matters related to those arrangements, such as details of your previous enquiries, requirements or complaints.
• We collect details of your visits to our Sites and Apps (including, but not limited to, traffic data, location data and weblogs) whether this is required for our own purposes or otherwise, and of the resources that you access. We use third party technology services, such as Google Analytics to administer these services.
• We collect details of website(s) you visited before you use a link to our Sites, pages visited in our Sites, and time spent on each page.
• We may collect information about your computer (or mobile device/tablet) including, where available, your IP address, operating system, device location, browser type, cookie identification numbers, for system administration purposes, marketing purposes (both our own, and third party advertisers for whom we provide advertising services) and to report aggregate information to our advertisers. This is statistical data about our users’ browsing actions and patterns, and any reports we share do not identify any individuals.
• Images of you taken on our CCTV systems at our premises.

We might also receive your personal data from third party sources who collect information about you on our behalf. This includes:

• If you tell a third party that you would like to receive marketing communications from Kosmar, they will securely transfer your contact details and marketing preferences to us.
• If you book one of our holidays through a third party travel agent, certain personal data (as applicable to your booking, such as your name, date of birth or any special requirements you have) will be passed to us to provide the services you have requested/booked.
• If you complete any of our customer feedback questionnaires/surveys, the information you provide will be processed on our behalf and provided to us by a third party such as InMoment Inc, MARU/EDR Limited, Trust Pilot A/S or Feefo Holdings Ltd.
• If you provide feedback on us via a Twitter survey, the feedback, but not your personal data, will be processed by Twitter and passed to us.

Your personal data is held on a combination of our own systems and systems of the suppliers we use to provide our services.

When you give your personal data to us, some of the personal data you provide will need to be given to and processed and stored by relevant third parties. These third parties include:

• our technology and data management partners who help us to administer the services we provide;
• our contact centre (including live chat) partners who provide services to support customer bookings and enquiries;
• our travel partners, such as airlines, airports, hoteliers, insurance companies and ground handling agents (depending on the travel services you book), so that they can provide you with the arrangements and assistance you require.
• our travel money card, gift card and currency providers who provide services and operate websites on our behalf.
• companies that help us to process payments customers make to us for their travel purchases, and our suppliers of credit/finance arrangements to customers which customers use to pay for travel services. These suppliers assist us in detecting and preventing fraudulent payments or bookings.

Some of these third parties may be based outside of the UK, EU or European Economic Area (EEA). Organisations that are based outside of the UK, EU or EEA may not be subject to the same level of controls in regard to data protection as exist within the UK and the EEA. We aim only to transfer your data to third parties outside of the UK, EU or EEA where either:

(a) your personal information will be subject to one or more appropriate safeguards set out in the law, if you’d like more information about our safeguards, please contact us. These safeguards might be the use of standard contractual clauses in a form approved by regulators, or having our suppliers sign up to an independent privacy scheme approved by regulators (like the US Privacy Shield scheme); or

(b) the transfer is necessary to enable your contract to be performed.

Due to the decision of the UK leaving the EU, the way your data is transferred from the UK to other countries may change to ensure continuing compliance with data protection regulations but it will not change the security of your data. This will depend on the data protection rules in place for the international transfers of data outside of the UK once the UK has left the EU.

In order for you to travel overseas, we may be required to disclose certain of your personal data to government bodies or other authorities in the UK and in other countries, such as those responsible for immigration, border control, law enforcement, security and anti-terrorism.

Even if it is not mandatory for us to provide information to such authorities, we may exercise our discretion to assist them where appropriate in the interests of detecting and preventing criminal activity.

We may disclose your personal information to any member of our Group for business purposes, (those business purposes include holding your data on central/shared systems for administering bookings and supporting customers in destination countries). Our Group means our subsidiaries and our ultimate holding company and its subsidiaries. We may share your data with members of our Group who are in the UK or outside the UK. To support any potential company sale or acquisition or corporate reorganisation we may disclose your personal data to the prospective seller or buyer of such business or assets or professional advisors helping with any sale, acquisition or corporate reorganisation (e.g. lawyers, auditors).

In order to provide our services to you, we use the information we hold in a number of different ways. We process your information where we have legal basis to do so, such as, because it is necessary when you enter into a contract for travel services or because we have a legitimate business reasons for doing so.

The following activities are carried out by us using your personal data because it is necessary in relation to a contract which you have entered into or because you have asked for something to be done so you can enter into a contract;

• Administering your booking internally and providing services within Kosmar and externally through our suppliers, to ensure the services you have requested are arranged;
• To communicate with you regarding your booking, services or any other purchase, including sending booking confirmation and travel documents and changing, updating and renewing insurance policies;

We may use and process your personal information as set out below where it is necessary for us to carry out activities for which it is in our legitimate interests as a business to do so:

• To improve customer experience:
  • To allow you to participate in interactive features of our Sites and Apps, when you choose to do so. When using the Kosmar App, you can choose not to use interactive features by changing your settings on the App itself;
  • To ensure that content from our Sites, Apps and booking systems is presented in the most effective manner for you and for your device;
  • To inform you about our service in destination and to check you have everything you need for your forthcoming trip;
  • To notify you about changes to our service.
• To protect our business and our suppliers against financial loss;
  • For debt collection or credit vetting
  • For payment card and booking verification (including using Google reCAPTCHA on some of our Sites to ensure only genuine customer bookings are made).
• To investigate, respond to, settle and/or defend customer complaints and claims:
  • We may use and process your personal information and may pass it to third parties involved in providing travel services to you and acting on our behalf, (such as external law firms and their employees),for resolving complaints, dealing with disputes and legal proceedings. This might include contacting you proactively if we need to resolve any issues you may be experiencing or have experienced with a booking or other purchase;
• To maintain a safe and secure environment and prevent and detect criminal activity;
  • Using CCTV in our premises.
• To promote our business, improve our products and services;
  • To send marketing correspondence about products and services similar to those you have previously bought from us. You can opt out and object to our sending you electronic marketing information and this option will be included in every marketing message we send you. See the section, When and how do we use your information for marketing for more information.
  • To contact you if you make an enquiry with us on our website but do not complete a booking/purchase in order to check if there was a problem or you need any assistance to book;
  • For internal research/analysis to improve the quality of our Services, the products we offer and new products we are developing by:
    • Inviting customers to take part in surveys or customer/business discussion groups;
    • Using aggregated customer data to make informed decisions based on analysis of customer booking or other purchase trends and behaviours.
• To promote our business, brands and products and measure the reach and effectiveness of our campaigns;
  • To contact you with targeted advertising delivered online using Google DoubleClick and through social media and other platforms operated by other companies. You may receive advertising based on information about you that we have provided to the platform or because, at our request, the platform has identified you as having similar attributes to the individuals whose details it has received from us. To find out more, please refer to the information provided in the help pages of the platforms on which you receive advertising from us;
  • To obtain more information about you by sharing your personal information with technology companies or platforms who may also hold information about you and can match their records with ours. We/these companies may use cookies to match the personal information each of us hold about you.

We use this information in two ways:

1. We identify links between your attributes and your behaviours and market to others with the same attributes, in our direct marketing campaigns and through targeted advertising delivered through our Sites, Apps or third party platforms including social media channels.
2. We tailor and personalise our interactions with you to make them more relevant to your interests. These interactions include your journey around our Sites and the content that appears on it and marketing communications we send or show to you in our direct marketing campaigns and through online targeted advertising described in the paragraph above. Please see How we personalise marketing for you for more information;

To support any potential company sale or acquisition:

• In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets.

We may use and process your personal information as set out below where we consider that it is in your vital interests that we do:

• To assist you or arrange for assistance to be provided to you by third parties either in the event of an incident or emergency.

We may use and process your personal information as set out below where we have your consent to do so:

• To assist you or arrange for assistance to be provided to you by third parties where you have special requirements in relation to special categories of personal data (please refer to the section, What types of personal data do we collect about you and why do we collect it).;
• To send marketing correspondence about products and services available from Kosmar and/or from our business partners/affiliates, where we have asked for your permission to do so. See the section, When and how do we use your information for marketing for more information.

We may use and process your personal information and may pass it to third parties where there is a legal requirement for us to do so:

• For responding to requests from any government body, law enforcement agency, court or regulatory authority, that requires us to disclose personal data in line with applicable data protection laws.
• For anti-money laundering and terrorist financing purposes

Processing subject to national laws: We may also use and process your personal information (including special category data such as information on your health specifically for insurance purposes) where we have a specific legal basis to do so under applicable national law. In the UK and Ireland, we rely on local Data Protection Laws that allows us to use health data in connection with your insurance policy, we may need to use health data for the purposes of providing quotes, processing claims, fraud investigation and handling complaints you may have.

If you have made an enquiry or purchase on one of our Sites, through our stores or contact centres, your personal data may be used by us in the ways the law allows, to contact you by post, electronic means (e-mail or text message) and/or by phone with information and offers relating to products or services that you can book/purchase from Kosmar companies. We will only do this if you did not opt out of such marketing at the point where we collected your contact details.

If you have not made an enquiry or purchase, we will only send you information and offers by e-mail or text message if you sign up (opt in) to receive such marketing, either directly through us or by telling a third party that you would like to receive marketing from us. We will only send you information and offers by App push notifications if the permissions that are set in the Settings section of your device allow for this to happen. If you do not wish to receive App push notifications, you can change your settings and opt-out at any time.

We will not pass your contact details to a third party that is not one of our business partners involved in providing Kosmar services or products for them to contact you or send you marketing communications unless you have expressly agreed that we may do so.

To try and ensure that our marketing communications and advertising are relevant to you, we work with third parties to offer a better experience to customers and potential customers

Using new technologies and with the help of our advertising agencies and marketing activation platforms, we may use your personal information in the following ways:

• to try to ensure any marketing communications we send to you are offering products or services likely to be of interest to you.
• to tailor and track our digital marketing (for example, our internet banner advertisements) and links from our marketing partners websites to our Sites. This digital marketing may include marketing related to Kosmar or marketing related to business partners to whom we provide advertising services.

Our business partners and advertising networks may serve you with non-personalised adverts on our Sites via advertising technology Google Double Click for Publishers. Non-personalised adverts are targeted using contextual information regarding the pages visited on our site, rather than the past behaviour of a user. We allow third parties to collect information about your online activities using cookies and other technologies. The third parties may include other Kosmar companies, our suppliers/business partners who collect information when you view or interact with an advert on one of our Sites, and advertising networks. We also collect information about your online activities using cookies and other technologies when you use websites other than our Sites to provide advertising services on behalf of our business partners. This technology allows us to display an advert to you relating to a business partner on other websites based on your page visits and other behaviours whilst on our Sites.

You have the right at any time to ask us not to process your personal data for marketing purposes. You can exercise your right to prevent such processing by selecting the no marketing option on the forms we use to collect your data. You can also exercise this right at any later time by using the unsubscribe link on any marketing e-mail you receive.

You can choose to opt-out by following the opt-out instructions on any direct marketing communication sent by post or by sending an unsubscribe request to:

Database Manager, Marketing, Kosmar Holidays Limited, 32 Eyre Street, Sheffield S1 4QZ.

You can opt out of App push notifications in the Settings section of your device.

You have a number of rights in relation to your personal information under data protection law.

You have the right to make a Data Subject Access Request in many circumstances. That is a request for access to the personal information that we hold about you. If we agree that we have to provide personal information to you (or someone else on your behalf), we’ll provide it to you or them free of charge.

We may ask for proof of identity and sufficient information about your interactions with us that we can locate your personal information. That may include information about your previous booking(s) or other purchases. If someone is acting on your behalf they will need to provide written and signed confirmation from you that you have given your authority to that person/company for them to make the request. We will ask for this to be provided before we give you (or another person acting on your behalf) a copy of any of your personal information we may be holding. We may not provide you with a copy of your personal information if it includes the personal information of other individuals or we have another lawful reason to withhold that information.

Please see the section below titled, How to Contact Us if you need to make a Data Subject Access Request.

The accuracy of your information is important to us and we are working on ways to make it easier for you to review and correct the information that we hold about you.

In the meantime, if you change your name or address/e-mail address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting our customer service team.

Where we rely on your consent as the legal basis for processing your personal information, as set out in section above titled, How do we use your information when providing our services to you, you may withdraw your consent at any time. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, please see the section titled, What you need to do if you don’t want our marketing communications for further details. Please note if you ask us to stop processing this information, it may mean we won’t be able to provide all or parts of the services you have requested. If we have to cancel your booking or other purchase as a result, you may incur a cancellation charge.

If you withdraw your consent, our use of your personal information before you withdraw is still lawful.

Where we rely on our legitimate business interests as the legal basis for processing your personal information for any purpose(s), you may object to us using your personal information for these purposes by e-mailing or writing to us at the address provided at the end of this policy. Except for the purposes for which we are sure we can continue to process your personal information, we will temporarily stop processing your personal information in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection law, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data.

In certain circumstances, you may ask for your personal information to be removed from our systems by e-mailing or writing to us at the address at the end of this policy. Provided we do not have any continuing lawful reason to continue processing or holding your personal information, we will make reasonable efforts to comply with your request.

You may also ask us to restrict processing your personal information where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings. We may only process your personal information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.

Where we rely on your consent as the legal basis for processing your personal information or need to process it in connection with your contract, as set out in section titled, How do we use your information when providing our services to you, you may ask us to provide you with a copy of that information in a structured data file.

You can ask us to send your personal information directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal information if it contains the personal information of other individuals or we have another lawful reason to withhold that information.

We encourage you to contact us if you have a complaint and we will seek to resolve any issues or concerns you may have.

You have the right to lodge a complaint with the data protection regulator where you believe your legal rights have been infringed, or where you have reason to believe your personal information is being or has been used in a way that doesn’t comply with the law. The contact details for the Information Commissioner’s Office (ICO), the data protection regulator in the UK, are available on the ICO website.

If you wish to contact us about this Privacy Policy, you can e-mail or write to the Kosmar Group Data Protection Officer using the contact details above.

How to contact us

To contact us about this Privacy Policy, to make a Data Subject Access Request, or a data protection related complaint.

Any subject access request can be made in the following ways:

By post: Legal & Compliance Department, Kosmar Holidays Limited, 32 Eyre Street, Sheffield S1 4QZ

Once you have made your request and provided us with the information we need to begin a search for the data we hold on you (including proof of identity), we will have 30 days to respond.

Keeping hold of your personal data

Where you’ve made an enquiry, booking or other purchase from us, or agreed to receive marketing communications, your personal information will be retained to ensure we provide the best possible customer service to you. We retain your personal data for as long as is necessary for us to use your data as set out in this Privacy Policy. This will generally be for up to 2 years unless you have made a booking/purchase, in which case your personal data will be retained for 7 years from the date of your most recent booking/purchase, or such other time that may be required for our legal and audit purposes or that is required by law.

What is our approach to data security

The transmission of information via the internet is not completely secure, and although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Sites, therefore any transmission is at your own risk. Once we have received your information, we will take all reasonable steps to keep your personal data secure and to try to prevent any unauthorised access, use or loss of your data, by putting in place appropriate security measures and limiting access to those who have a business need to know. All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using TLS technology. We do not store customer card data on our internal systems. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Sites, you are responsible for keeping that password confidential. We ask you not to share a password with anyone.

We have a process to deal with any suspected personal data breach and will notify you and the ICO of a breach where legally required to do so.

What happens when you follow a link from our website to a third party website

Our Sites contains links to and frames of websites of our principals, suppliers, advertisers and other third parties. You can tell when a third party is involved in supplying a product or service you have requested because their name will appear with ours. If you follow a link or otherwise use any of these other websites, please note that these websites have their own privacy policies and cookie policies and that we do not accept any responsibility or liability for these policies or for these third party websites. Please check these policies before you submit any personal data to these websites.

We reserve the right to update or alter this Privacy Policy from time to time. You can request a copy of a previous version of our Privacy Policy.

July 2020, Version 7