Privacy Policy

Last updated: 30 September 2026

1. Introduction
Willow & Bird Travel (“Willow & Bird”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of personal information entrusted to us.
As an independent luxury travel agency based in Cheltenham, Gloucestershire, we provide personalised travel consultancy, bespoke holiday planning, travel booking and associated concierge services.
This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website, contact us, make an enquiry, request a travel consultation, engage our services, book travel arrangements or otherwise interact with our business.
We process personal data in accordance with applicable United Kingdom data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and relevant amendments, including those introduced by the Data (Use and Access) Act 2025, insofar as applicable.
We are committed to processing personal data lawfully, fairly and transparently and to collecting only the information reasonably necessary for specified and legitimate purposes.

2. Identity of the Data Controller
For the purposes of applicable data protection legislation, the organisation responsible for determining how and why your personal data is processed is:
Trading name: Willow & Bird Travel
Legal entity: Willow & Bird Travel Limited
Company registration number: 16718513
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Business location: Cheltenham, Gloucestershire, United Kingdom
Email: april@willowandbird.travel
Website: https://www.willowandbird.travel
Willow & Bird Travel acts as a data controller in respect of personal data collected and processed for its own business purposes.
Certain third-party travel suppliers and booking partners may act as independent data controllers in relation to the services they provide. Their processing of personal data may also be governed by their own privacy notices.
Questions concerning this Privacy Policy or the exercise of your data protection rights should be directed to the contact details above.

3. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed in connection with:
* Visits to our website and interactions with our online content.
* Enquiries submitted through website forms, email, telephone, messaging services or other communication channels.
* Travel consultations and the preparation of bespoke travel proposals.
* The arrangement, administration and management of travel bookings.
* The provision of travel advice, recommendations and concierge services.
* Client profiles, preferences and travel history.
* Subscriptions to our travel journal, newsletters and marketing communications.
* Advertising, website analytics and conversion measurement.
* Relationships with travel suppliers, professional advisers and business contacts.
This Privacy Policy does not replace the privacy notices of independent third-party service providers, including airlines, accommodation providers, tour operators and other travel suppliers.

4. Categories of Personal Data We Collect
The personal data we collect depends upon the nature of your relationship with us and the services you request.

4.1 Identity and Contact Information
We may collect your full name, title, postal address, email address, telephone number and other contact details reasonably necessary to communicate with you or provide our services.

4.2 Travel and Booking Information
Where relevant to the planning or administration of travel, we may collect:
* Travel dates, destinations and itinerary requirements.
* Names and details of accompanying travellers.
* Dates of birth and ages of travellers.
* Passport information, nationality and other identification details where required by travel suppliers or applicable law.
* Accommodation, transport and activity preferences.
* Booking references, itinerary details and travel history.
* Loyalty programme information, where provided.
* Information necessary to arrange travel insurance, visas or other travel-related services, where applicable.

4.3 Personal Travel Preferences
To provide a personalised service, we may record information you choose to share concerning your preferred destinations, accommodation styles, travel interests, special occasions, previous travel experiences and other relevant preferences.
We seek to use this information to tailor our recommendations and improve the continuity of our client relationships.

4.4 Special Category Personal Data
In certain circumstances, arranging suitable travel services may involve information relating to health, disabilities, accessibility requirements, dietary requirements or other matters that constitute special category personal data under the UK GDPR.
We will only collect and process such information where it is necessary and where a valid legal basis and an additional condition under Article 9 of the UK GDPR apply.
Where required, we will seek your explicit consent before collecting, using or disclosing such information.
We will limit disclosure to those recipients who reasonably require the information for the relevant arrangements and will apply appropriate safeguards.

4.5 Financial and Transaction Information
Where relevant, we may process information concerning payments, deposits, invoices, refunds and booking transactions.
Payments may be administered through third-party payment processors or travel booking partners. The extent to which we receive or retain payment card information will depend upon the payment arrangements used.

4.6 Communications and Correspondence
We may retain records of enquiries, emails, telephone communications, messages, consultation notes, travel requests, complaints and other correspondence where reasonably necessary for the purposes described in this Privacy Policy.

4.7 Website and Technical Information
When you interact with our website, certain technical information may be collected automatically, including:
* Internet Protocol (IP) address.
* Browser type and device information.
* Operating system.
* Website pages visited and interactions with those pages.
* Referring website or advertising source.
* Date, time and duration of website visits.
* Cookie identifiers and other online identifiers, where applicable.
The collection and use of certain information through cookies and similar technologies may be subject to your consent.

4.8 Marketing Preferences
We may record your preferences regarding newsletters, travel inspiration, promotional communications and other marketing, including records of consent, withdrawal of consent and unsubscribe requests.

5. How We Obtain Personal Data
We may obtain personal data:
Directly from you, including when you complete an enquiry form, contact us, attend a consultation, request a proposal, subscribe to communications or make a booking.
From another traveller or booking organiser, where someone arranges travel on your behalf or provides information about members of their travelling party.
From travel suppliers and booking partners, where information is necessary to manage reservations, amendments, cancellations or other travel arrangements.
From website and technology providers, through technical data generated when you interact with our website or online communications.
From other lawful sources, where relevant and appropriate to the provision of our services.
Where information is provided to us about another person, we ask that the person supplying it has appropriate authority to do so and informs the relevant individual about the intended use of their information.
Where we obtain personal data indirectly, we will provide applicable privacy information within the timeframes required by law, unless a lawful exception applies.

6. Purposes and Lawful Bases for Processing
We process personal data only where an appropriate lawful basis exists under Article 6 of the UK GDPR.
The principal purposes and lawful bases are as follows.

6.1 Responding to Enquiries and Preparing Travel Proposals
Purpose: To respond to enquiries, arrange consultations, understand travel requirements and prepare tailored proposals.
Lawful basis: Taking steps at your request before entering into a contract, or our legitimate interests in responding to business enquiries where the contractual basis does not apply.

6.2 Arranging and Administering Travel Services
Purpose: To research, arrange, book, coordinate, amend and administer travel services, including communicating with relevant suppliers.
Lawful basis: Performance of a contract or taking steps before entering into a contract.
Where information concerns another traveller who is not party to our contract, a different appropriate lawful basis may apply.

6.3 Providing Personalised Client Services
Purpose: To maintain relevant travel preferences, provide tailored recommendations and deliver continuity of service.
Lawful basis: Performance of a contract where necessary, or our legitimate interests in providing an efficient, personalised client service, subject to applicable rights and safeguards.
Where the processing requires consent, we will obtain it.

6.4 Financial Administration and Legal Compliance
Purpose: To administer payments, maintain financial records, meet accounting and tax requirements, respond to lawful requests and comply with applicable legal obligations.
Lawful basis: Performance of a contract and compliance with legal obligations.

6.5 Website Operation and Security
Purpose: To operate, maintain, secure and protect our website, prevent misuse, diagnose technical issues and support business continuity.
Lawful basis: Our legitimate interests in maintaining secure and reliable systems, or compliance with legal obligations where applicable.

6.6 Analytics and Advertising Measurement
Purpose: To understand website performance, assess the effectiveness of advertising campaigns and improve our digital services.
Lawful basis: Legitimate interests or consent, as appropriate to the particular processing.
Where non-essential cookies or similar technologies require consent under PECR, we will seek that consent before their use. Any related processing of personal data must also have an appropriate UK GDPR lawful basis.

6.7 Marketing Communications
Purpose: To send travel inspiration, editorial updates, newsletters and information about our services.
Lawful basis: Consent or, where the legal requirements are satisfied, legitimate interests in conjunction with an applicable exemption under PECR.
You may withdraw consent or object to direct marketing at any time.

6.8 Establishing, Exercising or Defending Legal Claims
Purpose: To protect our legal rights, resolve disputes and establish, exercise or defend legal claims.
Lawful basis: Our legitimate interests or compliance with legal obligations, as applicable.
Where special category personal data is involved, an additional lawful condition will be required.

7. Special Category Information and Sensitive Travel Requirements
We recognise that certain travel arrangements may require particularly sensitive information, including information concerning medical conditions, mobility, disabilities or accessibility needs.
Such information will be requested only where reasonably necessary for a specified purpose, such as communicating relevant requirements to a hotel, airline, transport operator or other travel supplier.
Where explicit consent is the applicable condition for processing, we will explain the intended use of the information and obtain that consent before processing it.
You may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing undertaken before withdrawal, but it may affect our ability to arrange certain services where the information is essential.
We will not request sensitive information unrelated to the services being provided.

8. Disclosure of Personal Data to Third Parties
We may share personal data with selected third parties where reasonably necessary to provide our services, operate our business or comply with applicable law.
Recipients may include:
Travel suppliers and service providers: Airlines, hotels, accommodation providers, tour operators, cruise operators, destination management companies, transfer providers, guides and other suppliers involved in delivering travel arrangements.
Travel booking and fulfilment partners: Travel industry partners, including [confirm relevant PTS legal entity and any other booking partners], where they are involved in arranging, administering or fulfilling bookings.
Website and technology providers: Squarespace and other providers supporting website hosting, enquiry forms, communications, business systems and related technology.
Advertising and measurement providers: Google, including Google Ads and associated conversion measurement technologies.
Communications providers: Email hosting services, messaging providers and newsletter platforms used by our business.
Financial and professional service providers: Payment processors, banks, accountants, legal advisers, insurers and other relevant professional advisers.
Public authorities: Regulators, law enforcement agencies, courts and other public bodies where disclosure is required or permitted by law.
We do not disclose personal data indiscriminately.
The amount and nature of information shared will be determined by the purpose of the disclosure and the relevant legal requirements.
Third parties may act as data processors on our behalf or as independent data controllers. Where a provider acts as our processor, we will ensure that appropriate data processing arrangements are in place as required by applicable law.
We do not sell personal data to third parties for their independent direct marketing purposes. 

9. International Transfers of Personal Data
As a travel agency arranging international holidays, we may need to transfer personal data to travel suppliers, booking partners or service providers located outside the United Kingdom.
Such transfers may be necessary to arrange accommodation, transport, activities or other services requested by you.
We may also use technology providers whose systems or support operations involve processing personal data outside the United Kingdom.
Where a transfer is subject to the international transfer restrictions under UK data protection legislation, we will ensure that an appropriate lawful mechanism applies.
Depending on the circumstances, this may include:
* A relevant UK adequacy regulation.
* An approved international data transfer agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required assessment.
* Another lawful transfer mechanism or applicable exception, including where a restricted transfer is necessary for the performance or conclusion of a contract in circumstances permitted by law.
Where appropriate, additional technical, contractual or organisational safeguards may be applied.
You may contact us using the details in Section 2 to request further information about relevant international transfers and applicable safeguards.

10. Website Hosting, Analytics and Advertising
Our website is operated using Squarespace.
Squarespace and associated service providers may process personal data in connection with website hosting, form submissions, technical functionality, security and related services.
We also use Google Ads to advertise our services and measure the effectiveness of advertising campaigns.
Depending on the technologies enabled and the permissions provided by visitors, this may involve processing online identifiers, technical information, website interactions and information relating to completed enquiry actions.
We aim to configure non-essential tracking technologies in accordance with applicable consent requirements.
Additional information concerning cookies and similar technologies is provided in our separate Cookie Policy.
Links to third-party websites may be provided for convenience. We are not responsible for the privacy practices of websites operated independently of Willow & Bird Travel.

11. Marketing Communications
We may invite you to receive travel inspiration, destination insights, editorial content, service announcements and other communications from Willow & Bird Travel.
Where consent is required, we will obtain it before sending electronic marketing communications.
In circumstances where the applicable legal requirements for the existing-customer or prospective-customer “soft opt-in” are satisfied, we may send marketing relating to our similar services without separate consent, provided that the required opportunity to opt out is offered when contact details are collected and in every subsequent marketing message.
We will not treat the submission of a general travel enquiry as automatic consent to receive newsletters or unrelated promotional communications.
You may unsubscribe from marketing emails using the unsubscribe mechanism provided or by contacting us directly.
Requests to stop direct marketing will be respected, and we may retain limited information where necessary to ensure that your preferences continue to be honoured.

12. Data Retention
We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including applicable legal, accounting, regulatory and contractual requirements.
Retention periods depend on the nature of the information and the purpose for which it is processed.
In determining the appropriate period, we consider:
* The nature, sensitivity and volume of the personal data.
* The purposes for which the information was collected.
* Whether those purposes can be achieved through less extensive retention.
* Relevant statutory retention requirements.
* The possibility of complaints, disputes or legal claims.
* Our continuing relationship with the individual.
Travel enquiry information that does not result in a booking will be retained for 12 months after the last meaningful interaction, unless there is a lawful reason for longer retention.
Client booking records will generally be retained for 6 years after the end of the relevant financial year, taking account of relevant financial, contractual and legal obligations.
Marketing information will be retained while there is an appropriate lawful basis to use it, subject to applicable review and deletion procedures. Limited suppression records may be retained to respect unsubscribe requests.
Special category personal data will not be retained longer than necessary for the relevant purpose, unless a further lawful basis and condition apply.
At the end of the applicable retention period, information will be securely deleted, anonymised or otherwise disposed of in accordance with our data management procedures.

13. Information Security
We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.
These measures may include access controls, password protection, appropriate authentication, secure communications, supplier due diligence and restrictions on access to sensitive client information.
Access to personal data is limited to those who reasonably require it for legitimate business purposes.
Although we take reasonable precautions, no method of electronic transmission or storage can be guaranteed to be entirely secure.
Where a personal data breach occurs, we will assess it and make any notifications required by applicable data protection legislation.

14. Your Data Protection Rights
Subject to applicable conditions and exemptions, you may have the following rights under UK data protection legislation:
Right of access: To request confirmation of whether we process your personal data and obtain a copy of relevant information.
Right to rectification: To request correction of inaccurate personal data or completion of incomplete information.
Right to erasure: To request deletion of personal data in circumstances where the law provides that right.
Right to restriction: To request that processing be restricted in certain circumstances.
Right to data portability: To receive certain personal data in a structured, commonly used and machine-readable format, and to request its transmission to another controller where applicable.
Right to object: To object to certain processing carried out on the basis of legitimate interests.
Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of earlier processing.
Rights relating to solely automated decisions: To benefit from applicable protections concerning qualifying decisions based solely on automated processing.
Your right to object to direct marketing
You have the right to object at any time to the processing of your personal data for direct marketing purposes, including related profiling. If you exercise this right, we will stop processing your personal data for those purposes.
To exercise your rights, please contact us using the details provided in Section 2.
We may request reasonable information to verify your identity before responding to a request.
We will respond within the timeframes required by applicable law, subject to any lawful extensions or exemptions.

15. Automated Decision-Making and Profiling
We may use client preferences, travel history and information voluntarily provided to us to personalise travel recommendations and communications.
Such personalisation may involve the organisation or assessment of information for the purpose of providing a more relevant service.
16. Children’s Personal Data
Our services may involve arranging travel for children and families.
Where necessary for travel bookings, we may process children’s personal data, including names, dates of birth, passport details and relevant travel requirements.
Such information will ordinarily be provided by a parent, guardian or another person with appropriate authority.
We take particular care when handling children’s personal data and limit its use to legitimate purposes associated with providing the requested services or meeting legal obligations.
Our website and general marketing services are not specifically directed towards children.

17. Information You Provide About Other Travellers
Where you provide personal data relating to another traveller, including family members, children or other members of your travelling party, you should ensure that you are authorised to provide the information and that the relevant individual is appropriately informed about its use.
We may process this information where necessary to arrange or administer travel services and where an appropriate lawful basis exists.
We may also need to communicate directly with an individual traveller where required by law, by a supplier or by the circumstances of the booking.

18. Complaints and Supervisory Authority
If you have concerns about how Willow & Bird Travel processes your personal data, we encourage you to contact us so that we can investigate and respond.
You also have the right to raise a complaint with the Information Commissioner’s Office (“ICO”), the United Kingdom’s independent data protection supervisory authority.
Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
You may contact the ICO independently, although we would welcome the opportunity to address your concerns directly.

19. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our services, business practices, technology, legal obligations or applicable regulatory guidance.
The latest version will be published on our website and will identify the date of its most recent update.
Where changes materially affect how we process personal data, we will provide additional notice where required by law.

20. Contact Us
For questions about this Privacy Policy, requests concerning your personal data or concerns regarding our privacy practices, please contact:
Willow & Bird Travel
Cheltenham, Gloucestershire, United Kingdom
Email: april@willowandbird.travel
Website: https://www.willowandbird.travel
We are committed to handling personal information with care, discretion and respect, consistent with the trust placed in us by our clients.