Privacy Policy

This Privacy Policy explains how Cartout LTD (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you visit cartoutltd.co.uk, submit an enquiry, or otherwise interact with us. It also sets out your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Please read this policy carefully. By submitting an enquiry or using our website, you confirm that you have read and understood how we handle your information as described here.

1. Who we are

Cartout LTD is an independent holiday-planning consultancy registered in England & Wales under company number 00000000, with its registered office at Office 000, 00 Example Street, London, EC1A 0AA, United Kingdom. For the purposes of data protection law, we are the “data controller” of the personal data you provide to us.

If you have any questions about this policy or how we handle your data, you can contact us at info@cartoutltd.co.uk or by telephone on 0203 45454 0000.

2. The personal data we collect

Information you give us

• Identity and contact details — your name, email address and telephone number.
• Trip preferences — your departure airport, chosen destination, travel dates, number and type of travellers (adults, children, infants), number of rooms, length of stay and your stated travel interests.
• Correspondence — any information you choose to share when you contact us by phone, email, WhatsApp or our contact form.

Information we collect automatically

• Technical data — your IP address, browser type and version, device information, and the pages you view on our site.
• Cookie data — information collected through cookies and similar technologies, as described in our Cookie Policy.

We do not intentionally collect any “special category” data (such as health, religion or ethnicity). Please do not send us such information unless it is strictly necessary for your trip, in which case you consent to us using it to assist you.

3. How and why we use your data

We use your personal data only where the law allows. The table below summarises our purposes and the corresponding lawful basis:

• To respond to your enquiry and prepare your holiday plan — based on your consent and our legitimate interest in providing the service you requested.
• To contact you by phone, email or WhatsApp about your enquiry — based on your consent.
• To improve our website, services and customer experience — based on our legitimate interests.
• To maintain business records and comply with legal or regulatory obligations — based on our legal obligations and legitimate interests.

We will only use your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for a related and compatible purpose.

4. Marketing

We will only send you marketing communications if you have asked us to or agreed to receive them. You can ask us to stop sending marketing messages at any time by contacting us or using the unsubscribe link in any email. Opting out of marketing will not stop us from contacting you about an active enquiry.

5. Who we share your data with

We do not sell your personal data. We may share it with trusted third parties who help us operate our business, including:

• Technology and hosting providers who store our website and enquiry data securely.
• Productivity and lead-management tools (for example, Google Workspace and Google Sheets) used to record and manage enquiries.
• Professional advisers, regulators or law enforcement where we are required to do so by law.

Because we are a planning consultancy and you book directly with your chosen suppliers, we do not pass your booking or payment details to airlines, hotels or tour operators. Any information you share with a supplier when you book is governed by that supplier’s own privacy policy.

We require all third parties to respect the security of your data and to treat it in accordance with the law. They may only process your data for specified purposes and in accordance with our instructions.

6. International transfers

Some of our service providers may store or process data outside the United Kingdom. Where they do, we take steps to ensure an adequate level of protection, such as relying on an adequacy decision or appropriate safeguards (for example, the International Data Transfer Agreement or Standard Contractual Clauses).

7. How long we keep your data

We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. Enquiry data is typically retained for up to 24 months from your last contact with us, after which it is securely deleted or anonymised, unless we are required to keep it longer.

8. How we protect your data

We use appropriate technical and organisational measures to keep your personal data secure, to prevent it from being accidentally lost, used or accessed in an unauthorised way. Access is limited to those who have a genuine business need. While we take reasonable steps to protect your information, no transmission over the internet can be guaranteed to be completely secure.

9. Your rights

Under UK data protection law you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data (the “right to be forgotten”);
• object to, or request that we restrict, our processing of your data;
• request the transfer of your data to you or another provider (data portability);
• withdraw consent at any time where we rely on consent.

To exercise any of these rights, please email info@cartoutltd.co.uk. We will respond within one month. You will not usually have to pay a fee, and we may need to verify your identity before acting on your request.

10. Cookies

Our website uses cookies and similar technologies. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

11. Third-party websites

Our site may contain links to third-party websites, plug-ins and applications, including those of travel suppliers. Clicking on those links may allow third parties to collect or share data about you. We do not control these websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every site you visit.

12. Children’s privacy

Our service is intended for adults aged 18 and over. We do not knowingly collect personal data directly from children. Where a trip involves children, we expect the booking adult to provide their details on their behalf.

13. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “last updated” date. We encourage you to review it periodically.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.