Privacy Policy

Last Updated: October 2026

1. Who we are

1.1 This Privacy Policy explains how Travantae Limited, trading as VervTrip (company number 17205331, registered office 29 Lowfield Road, London, England, NW6 2PP) (“VervTrip”, “we”, “us”, “our”), collects, uses, shares, and protects personal data when you use vervtrip.com, our mobile or web applications, our partner API, or any other service we operate (together, the “Platform”).

1.2 VervTrip is the data controller for the personal data described in this Policy, save where Section 10 (Reseller and Partner API data) says otherwise. Our contact details, and those of our data protection contact, are at Section 14.

1.3 This Policy applies to: people booking as individuals (“Retail Customers”); individuals travelling on a booking made by a business (“Corporate Travellers”); contacts at businesses that hold a VervTrip corporate account (“Corporate Contacts”); travel agents, tour operators, and other businesses reselling our inventory, and their staff (“Reseller Contacts”); and visitors to the Platform generally (“Visitors”). Where this Policy refers to “you”, it means whichever of these applies to you.

2. Information we collect

2.1 Information you give us directly

Identity data: full name, title, date of birth (where required for a booking, e.g. for age-restricted properties, flights, or insurance-relevant fields).
Contact data: email address, phone number, postal address.
Booking data: travel dates, destination, room/fare preferences, number and names of travellers, special requests (e.g. accessibility needs, dietary requirements — see Section 2.4 on special category data), loyalty or cashback account references.
Payment data: card details are collected and processed by our payment service provider; VervTrip does not store full card numbers on its own systems. We retain only the data needed to process refunds, chargebacks, and fraud checks (e.g. a payment reference, the card’s last four digits, and transaction status).
Account data: login credentials, where you register an account.
Communications: anything you send us by email, chat, WhatsApp, or phone, including call recordings where we tell you a call may be recorded.
Corporate account data: for Corporate Contacts, your name, job title, business contact details, and invoicing/billing information.
Reseller/partner data: for Reseller Contacts, your business details, API credentials, and the booking data your systems submit through our API on behalf of your End Customers (see Section 10).

2.2 Information we collect automatically

Technical data: IP address, browser type and version, device identifiers, operating system.
Usage data: pages viewed, search queries, booking funnel progress, referral source, approximate location derived from IP.
Cookies and similar technologies, as described in our Cookie Policy at vervtrip.com/cookie-policy, which is incorporated into this Policy by reference.

2.3 Information we receive from third parties

From our Hotel, Airline, and Transfer Suppliers: booking confirmations, reference numbers, and any change to your reservation.
From our payment service provider: payment status, fraud-risk signals, and chargeback notifications.
From identity-verification and fraud-prevention services: risk scoring used to protect against card testing and fraudulent bookings (see Section 3(e)).
From a Corporate Customer or Reseller, where they submit your details to make or manage a booking on your behalf.

2.4 Special category data. Where you tell us about a disability, medical condition, dietary requirement linked to religion or health, or similar information so that we or a Supplier can accommodate it, this may be “special category data” under UK GDPR. We only collect this where you choose to provide it, we use it solely to pass your request to the relevant Supplier and arrange your travel, and we rely on Article 9(2)(a) UK GDPR (your explicit consent, given by providing the information for that purpose) as our lawful basis for processing it. You do not have to provide this information, and choosing not to will not affect your ability to book, though a Supplier may not be able to accommodate an unstated need.

2.5 We do not knowingly collect personal data from children. The Platform is not directed at, and must not be used by, anyone under 18 to make a booking in their own name (see Booking Policy Section 5.4). Children’s data may appear as traveller names on a booking made by an adult, and is processed only for the purpose of that booking.

3. How we use your information, and our lawful basis

We use your personal data for the following purposes, on the lawful basis shown against each:

Purpose	What we do	Lawful basis (UK GDPR Art. 6)
(a) Processing your booking	Pass your details to the relevant Supplier, issue confirmations, process payment, handle amendments/cancellations	Performance of a contract (Art. 6(1)(b))
(b) Customer service	Respond to enquiries, complaints, and support requests	Performance of a contract; legitimate interests
(c) Account management	Create and maintain your account, authenticate logins	Performance of a contract
(d) Invoicing Corporate Customers and Resellers	Issue invoices, manage payment terms, reconcile accounts	Performance of a contract; legal obligation (accounting)
(e) Fraud prevention and security	Risk-score transactions, detect card testing and suspicious account activity, protect the Platform	Legitimate interests; legal obligation
(f) Marketing	Send you offers, cashback updates, and travel content, where you have opted in (or, for past Customers, where permitted under the “soft opt-in” rule for similar products, with an opt-out on every message)	Consent, or legitimate interests (soft opt-in)
(g) Analytics and service improvement	Understand how the Platform is used, test and improve features	Legitimate interests
(h) Legal and regulatory compliance	Respond to law enforcement, tax, and regulatory requests; keep records required by law	Legal obligation
(i) Special category data (accessibility/dietary)	Accommodate a stated need via the relevant Supplier	Explicit consent (Art. 9(2)(a))

3.1 Where we rely on legitimate interests, we have considered that interest against your rights and have concluded our processing is proportionate; you can ask us for more detail, or object, using the contact details in Section 14.

4. Who we share your information with

4.1 Hotel, Airline, and Transfer Suppliers. To fulfil your booking, we must share the booking data in Section 2.1 (name, contact details, travel dates, special requests, and, where the Supplier is merchant of record, payment data) with the specific Supplier providing your accommodation, flight, or transfer. This is essential to the service and cannot be opted out of for a given booking.

4.2 Payment service providers. We use a third-party payment processor to handle card payments securely; we do not see or store your full card number.

4.3 Identity verification and fraud prevention providers, to screen transactions for fraud risk.

4.4 IT, hosting, and analytics providers who process data on our behalf under contract (our processors), strictly for the purposes we instruct, including cloud hosting, email delivery, and website analytics.

4.5 Corporate Customers, where you are a Corporate Traveller: your booking data is visible to the Corporate Contact(s) administering your organisation’s account, for travel management and expense purposes, as agreed between you and your employer — this relationship (what your employer can see) is governed by your employer’s own policies, not by VervTrip.

4.6 Resellers, where your booking was made through a Reseller: we share the data necessary to fulfil and service that booking with the Reseller whose platform or agent you booked through, as that Reseller is the party with the direct relationship with you (see Booking Policy Section 12.1).

4.7 Professional advisers, regulators, and law enforcement, where required by law, to establish or defend legal claims, or to investigate suspected fraud or other crime.

4.8 A buyer in a corporate transaction. If VervTrip is involved in a merger, acquisition, financing, or sale of all or part of its business, personal data may be disclosed to the parties involved, subject to confidentiality protections, and this Policy will continue to apply to how that data is used.

4.9 We do not sell your personal data to third parties for their own marketing purposes.

5. Cookies

5.1 The Platform uses cookies and similar technologies for essential site functions, analytics, and (where you consent) personalisation and marketing. Full detail, including how to manage your preferences, is in our Cookie Policy at vervtrip.com/cookie-policy.

6. International transfers

6.1 Travel bookings are inherently international, and fulfilling your booking will often require sending your personal data to a Supplier located outside the United Kingdom — for example, a hotel in a country where no UK adequacy regulations or standard contractual clauses are in place. Where this is necessary to perform your specific booking (i.e. the hotel you have chosen needs your name and stay dates to check you in), this transfer is made in reliance on the Article 49(1)(b) UK GDPR derogation (transfer necessary for the performance of a contract between you and us, made at your request), which is the standard and legally correct basis for this kind of transfer in the travel industry.

6.2 Where we transfer data to a processor (e.g. a hosting or analytics provider) outside the UK other than under Section 6.1, we only do so where the destination has UK adequacy regulations in place, or where we have put in place the UK International Data Transfer Agreement / Addendum or equivalent Standard Contractual Clauses, together with any additional safeguards required.

7. How long we keep your data

7.1 We retain booking and payment-related data for as long as necessary to fulfil the booking, handle any post-stay query, complaint, or chargeback, and meet our legal obligations (including UK tax and accounting record-keeping, generally 6 years from the end of the relevant financial year).

7.2 Account data is retained for as long as your account is active, plus a reasonable period after closure to deal with any outstanding issue, after which it is deleted or anonymised unless we are required to keep it longer by law.

7.3 Marketing consent and preference records are kept until you withdraw consent or opt out, and for a short period afterwards to evidence that we honoured your request.

7.4 Fraud-risk and security logs are retained for the period necessary to detect patterns of abuse, typically [CONFIRM RETENTION PERIOD].

7.5 Where you ask us to delete your data under Section 9, we will do so unless we are legally required or permitted to retain specific records (for example, financial records needed for tax compliance, or data needed to defend a legal claim), in which case we will tell you what we are retaining and why.

8. Security

8.1 We use appropriate technical and organisational measures to protect your personal data, including encryption of data in transit, restricted access controls, and contractual security obligations on our processors. No system is 100% secure, and we cannot guarantee absolute security, but we take the risk of unauthorised access or loss seriously and will notify you and the Information Commissioner’s Office where we are required to do so following a personal data breach.

9. Your rights

9.1 Under UK GDPR, you have the right to:

(a) Access the personal data we hold about you;
(b) Rectify inaccurate or incomplete data;
(c) Erasure of your data in certain circumstances (“the right to be forgotten”);
(d) Restrict our processing of your data in certain circumstances;
(e) Data portability — receive a copy of data you provided to us, in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
(f) Object to processing based on our legitimate interests or carried out for direct marketing, at any time;
(g) Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
(h) Not be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect on you — see Section 11.

9.2 To exercise any of these rights, contact us using the details in Section 14. We will respond within one month, extendable by a further two months for complex requests, in which case we will tell you why.

9.3 You have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113, or to the supervisory authority in your own EU member state if you are based there, at any time. We would, however, appreciate the chance to address your concern directly first — contact us using Section 14.

10. Reseller and Partner API data — a different legal relationship

10.1 Where you book through a Reseller (a travel agent, corporate travel platform, or other business using our partner API or portal to sell our inventory), and that Reseller submits your personal data to us to create or manage a booking:

(a) the Reseller is the data controller for your personal data — they decide to collect it and for what purpose, and their own privacy policy, not this one, primarily governs their relationship with you;
(b) VervTrip acts as a data processor in respect of that data, processing it only on the Reseller’s documented instructions, strictly to create, service, and fulfil the specific booking, under a data processing agreement with the Reseller; and
(c) you should direct any privacy query about that booking to the Reseller in the first instance; VervTrip will assist the Reseller in responding to it as part of our processor obligations.

10.2 Where VervTrip separately also becomes a controller in its own right in respect of the same data — for example, because we use booking data for our own fraud-prevention or regulatory-compliance purposes, or because the Supplier relationship requires us to hold the data as controller to fulfil the underlying travel service — this Policy applies to that specific use, alongside the Reseller’s own policy for everything else.

11. Automated decision-making

11.1 We use automated fraud-risk scoring to flag transactions that may be fraudulent (see Section 3(e)). This may result in a booking being held for manual review, declined, or a payment being rejected. This is not a fully automated decision with a solely automated legal effect — a human reviews any decision to decline or cancel a booking on fraud grounds before it is finalised, and you can contact us using Section 14 to query or challenge such a decision.

12. Links to other websites

12.1 The Platform may contain links to Supplier websites, review platforms, or other third-party sites. We are not responsible for the privacy practices of any third-party site, and this Policy does not apply to them. Check their own privacy policy before submitting personal data to them.

13. Changes to this Policy

13.1 We may update this Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top shows when it was last revised. Material changes will be flagged on the Platform or, where appropriate, notified to you directly.

14. Contact us

Travantae Limited, trading as VervTrip
Registered in England and Wales, company number 17205331
Registered office: 29 Lowfield Road, London, England, NW6 2PP
Privacy enquiries: [CONFIRM — e.g. [email protected]]
General support: [CONFIRM — e.g. [email protected]]

You can also complain to the UK Information Commissioner’s Office at ico.org.uk.