GDPR Compliance

Our Commitment to Data Protection

nimble-maple is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing is necessary to fulfill our travel planning and booking services
• Legitimate Interest: We process data to improve our services and communicate relevant information
• Consent: For marketing communications, we obtain explicit consent which you may withdraw at any time
• Legal Obligation: We retain certain records to comply with financial and regulatory requirements

Data Controller

nimble-maple acts as the data controller for personal information collected through our services. We determine how and why your data is processed.

Your GDPR Rights

Under GDPR, you have the following rights:

Right to Access

You may request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.

Right to Restrict Processing

You may request that we limit how we use your personal data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format and transfer it to another service provider.

Right to Object

You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with your request. We will respond within one month of receiving your request.

We may request additional information to verify your identity before processing requests.

Data Transfers

When arranging international travel, we may transfer your data to service providers located outside the UK or European Economic Area. We ensure appropriate safeguards are in place through:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions confirming the destination country provides adequate data protection
• Your explicit consent for specific transfers

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Children's Privacy

Our services are not directed to individuals under 16. When booking family travel that includes minors, the adult making the booking is responsible for providing necessary consent for processing children's data.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Contact Our Data Protection Officer

For questions about data protection or to exercise your rights, contact us at:

Email: [email protected]