1. Data Controller

The data controller responsible for the processing of personal data is:
ISV LTD
Company Number: 16887195
Registered Office: 86—90 Paul Street, London, EC2A 4NE, United Kingdom
E-Mail: support@islandspiritvibes.com
ISV processes personal data in accordance with:

• the UK General Data Protection Regulation (UK GDPR),
• the Data Protection Act 2018,
• the EU GDPR where applicable,
• international privacy requirements relevant to the user's jurisdiction.
  

2. Categories of Personal Data Collected

ISV may collect and process the following categories of personal data:
2.1. Identification Data

• Full name
• Date of birth (when required for travel services)
• Nationality

‍‍
2.2. Contact Information

• Full name
• Telephone number
• Postal address (if required for documentation)

‍
2.3. Booking-Related Data

• Travel preferences
• ‍‍Booking history
• Passport information (when required by suppliers)
• Flight, hotel, transfer, and activity details

2.4. Payment Information

• Travel preferences
• ‍‍Booking history
• Passport information (when required by suppliers)
• Flight, hotel, transfer, and activity details

Payment method details (processed via secure third-party processors; ISV does not store full card numbers)

2.5. Technical and Usage Data

• IP address
• Device Information
• Browser type
• Cookies and tracking data
• Website interaction logs

2.6. Communication Data

• Emails, messages, and correspondence with ISV
• Customer service interactions

3. Permitted Use

3.1. The User may access and use the Website solely for lawful purposes and in accordance with these Terms.
3.2. The User Agrees not to:
(a) use the Website in any manner that violates applicable laws or regulations;
(b) interfere with or disrupt website functionality;
(c) attempt to gain unauthorised access to ISV systems;
(d) extract, copy, or collect website data for commercial use without written consent;
(e) use automated tools (bots, crawlers, scrapers) without express permission from ISV.
3.3. Any breach of this Section entitles ISV to restrict or terminate access to the Website, without prejudice to further legal action.

4. Purposes of Processing

ISV processes personal data for the following purposes:
(a) booking and managing travel services;
(b) issuing invoices, confirmations, and travel documents;
(c) facilitating communication between the User and suppliers;
(d) processing payments;
(e) providing customer support;
(f) managing cancellations, amendments, or refund requests;
(g) compliance with legal obligations;
(h) improving website functionality and user experience;
(i) sending marketing communications (only with consent);
(j) detecting and preventing fraud or security incidents.

5. Data Sharing and Disclosure

Personal data may be shared with the following categories of recipients:
5.1. Travel Service Suppliers
Such as accommodation providers, activity organizers, transfer companies, or other suppliers necessary for the execution of the Client's itinerary.
5.2. Payment Processors
Stripe, Apple Pay, Google Pay, Google Pay, banks, or other authorized financial institutions.
5.3. IT and Hosting Providers
Including website hosting, email systems, and technical service providers.
5.4. Professional Advisors
Lawyers, auditors, or accountants, when necessary for compliance.
5.5. Regulatory Authorities
Where legally required or for safety/security-related procedures.
ISV does not sell personal data to third parties.

6. International Data Transfers

6.1. ISV operates globally and may transfer personal data to countries outside the UK or the European Economic Area (EEA).
6.2. Transfers are performed in compliance with:

• UK GDPR adequacy regulations,
• Standard Contractual Clauses (SCCs)
• supplementary safeguards where required.

6.3. Users acknowledge that some suppliers located outside the UK/EEA may not offer the same level of data protection.

7. Data Retention

ISV retains personal data only for the period necessary to fulfill the purposes defined in this policy, and in accordance with UK legal requirements:

• Booking and contractual data: 7 years (for accounting and compliance purposes)
  
• Communication data: duration of the relationship + 24 months
• Cookie data: as defined in the Cookie Policy (typically 13 months maximum)

After expiration of the applicable retention period, data is securely deleted or anonymised.

8. User Rights

Under the UK GDPR, Users have the following rights:
8.1. Right of Access
Users may request confirmation of data processing and obtain a copy of their personal data.
8.2. Right to Rectification
Users may request correction of inaccurate or incomplete data.
8.3. Right to Erasure (“Right to be Forgotten”)
Subject to legal exceptions, Users may request deletion of their data.
8.4. Right to Restriction of Processing
Users may request limited processing under certain conditions.
8.5. Right to Data Portability
Users may obtain their data in a structured, commonly used format.
8.6. Right to Object
Users may object to processing based on legitimate interests or marketing.
8.7. Right to Withdraw Consent
Applicable where consent is the legal basis for processing.
Requests must be submitted to:
📩 support@islandspiritvibes.com
ISV can verify identity before processing a request.

9. Marketing Communications

9.1. ISV sends marketing content only when the user has provided explicit consent (opt-in).
9.2. Users may withdraw consent at any time via unsubscribe links or by contacting ISV.
9.3. Marketing data is not shared with third parties unless otherwise required for service provision (e.g., email delivery platforms).

10. Cookies and Tracking Technologies

10.1. The Website uses cookies for functionality, analytics, performance, and marketing.
10.2. Details of all cookies, their purpose, and retention periods are provided in the Cookie Policy.
10.3. Users may refuse non-essential cookies via the cookie banner.

11. Automated Decision-Making

ISV does not use personal data for automated decision-making that produces legal or significantly significant effects.

12. Security Measures

12.1. ISV implements appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• accidental loss,
• alteration,
• destruction,
• disclosure.

12.2. ISV shall not be liable for security breaches arising from factors beyond reasonable control, such as cyberattacks, malicious third-party actions, or inherent risks of online transmission.

‍

13. Children's Data

13.1. ISV does not knowingly collect data from individuals under 18 years of age without parental or guardian authorization.
13.2. If such data is uncollected, ISV will delete it uncollected upon notification.

14. California Consumer Privacy Act (CCPA/CPRA) Notice

(Applicable only to Users who live in California)
14.1. ISV does not sell personal data as defined by the CCPA.
14.2. California residents have specific rights, including:

• Right to know what information is being collected;
• right to request deletion;
• right to access;
• right to non-discrimination.
  
  
  Requests may be submitted to:
  📩 support@islandspiritvibes.com

15. Updates to this Privacy Policy

ISV reserves the right to modify this Privacy Policy at any time without prior notice.
The updated version becomes effective upon publication on the Website.
Users are advised to review the Policy regularly.

16. Contact Information

For any questions related to these Terms:
📩 E-Mail: support@islandspiritvibes.com
📞 Phone/WhatsApp: +44 7488 813582