1. Data Controller

The data controller responsible for the processing of personal data is:
ISV LTD
 Company Number: 16887195
 Registered Office: 86–90 Paul Street, London, EC2A 4NE, United Kingdom
 Email: support@islandspiritvibes.com
ISV processes personal data in accordance with:

• the UK General Data Protection Regulation (UK GDPR),
• the Data Protection Act 2018,
• the EU GDPR where applicable,
• international privacy requirements relevant to the User’s jurisdiction.
  

2. Categories of Personal Data Collected

ISV may collect and process the following categories of personal data:
2.1. Identification Data

• Full name
• Date of birth (when required for travel services)
• Nationality

‍‍
2.2. Contact Information

• Full name
• Telephone number
• Postal address (if required for documentation)

‍
2.3. Booking-Related Data

• Travel preferences
• ‍‍Booking history
• Passport information (when required by suppliers)
• Flight, hotel, transfer, and activity details

2.4. Payment Information

• Travel preferences
• ‍‍Booking history
• Passport information (when required by suppliers)
• Flight, hotel, transfer, and activity details

Payment method details (processed via secure third-party processors; ISV does not store full card numbers)

2.5. Technical and Usage Data

• IP address
• Device information
• Browser type
• Cookies and tracking data
• Website interaction logs

2.6. Communication Data

• Emails, messages, and correspondence with ISV
• Customer service interactions

3. Permitted Use

3.1. The User may access and use the Website solely for lawful purposes and in accordance with these Terms.
3.2. The User agrees not to:
 (a) use the Website in any manner that violates applicable laws or regulations;
 (b) interfere with or disrupt Website functionality;
 (c) attempt to gain unauthorised access to ISV systems;
 (d) extract, copy, or collect Website data for commercial use without written consent;
 (e) use automated tools (bots, crawlers, scrapers) without express permission from ISV.
3.3. Any breach of this Section entitles ISV to restrict or terminate access to the Website, without prejudice to further legal action.

4. Purposes of Processing

ISV processes personal data for the following purposes:
(a) booking and managing travel services;
 (b) issuing invoices, confirmations, and travel documents;
 (c) facilitating communication between the User and suppliers;
 (d) processing payments;
 (e) providing customer support;
 (f) managing cancellations, amendments, or refund requests;
 (g) compliance with legal obligations;
 (h) improving website functionality and user experience;
 (i) sending marketing communications (only with consent);
 (j) detecting and preventing fraud or security incidents.

5. Data Sharing and Disclosure

Personal data may be shared with the following categories of recipients:
5.1. Travel Service Suppliers
 Such as accommodation providers, activity organisers, transfer companies, or other suppliers necessary for the execution of the Client’s itinerary.
5.2. Payment Processors
 Stripe, Apple Pay, Google Pay, banks, or other authorised financial institutions.
5.3. IT and Hosting Providers
 Including website hosting, email systems, and technical service providers.
5.4. Professional Advisors
 Lawyers, auditors, or accountants, when necessary for compliance.
5.5. Regulatory Authorities
 Where legally required or for safety/security-related procedures.
ISV does not sell personal data to third parties.

6. International Data Transfers

6.1. ISV operates globally and may transfer personal data to countries outside the UK or the European Economic Area (EEA).
6.2. Transfers are performed in compliance with:

• UK GDPR adequacy regulations,
• Standard Contractual Clauses (SCCs)
• supplementary safeguards where required.

6.3. Users acknowledge that certain suppliers located outside the UK/EEA may not offer the same level of data protection.

7. Data Retention

ISV retains personal data only for the period necessary to fulfil the purposes defined in this policy, and in accordance with UK legal requirements:

• Booking and contractual data: 7 years (for accounting and compliance purposes)
  
• Communication data: duration of the relationship + 24 months
• Cookie data: as defined in the Cookie Policy (typically 13 months maximum)

After expiration of the applicable retention period, data is securely deleted or anonymised.

8. User Rights

Under the UK GDPR, Users have the following rights:
8.1. Right of Access
 Users may request confirmation of data processing and obtain a copy of their personal data.
8.2. Right to Rectification
 Users may request correction of inaccurate or incomplete data.
8.3. Right to Erasure (“Right to be Forgotten”)
 Subject to legal exceptions, Users may request deletion of their data.
8.4. Right to Restriction of Processing
 Users may request limited processing under certain conditions.
8.5. Right to Data Portability
 Users may obtain their data in a structured, commonly used format.
8.6. Right to Object
 Users may object to processing based on legitimate interests or marketing.
8.7. Right to Withdraw Consent
 Applicable where consent is the legal basis for processing.
Requests must be submitted to:
 📩 support@islandspiritvibes.com
ISV may verify identity before processing a request.

9. Marketing Communications

9.1. ISV sends marketing content only when the User has provided explicit consent (opt-in).
9.2. Users may withdraw consent at any time via unsubscribe links or by contacting ISV.
9.3. Marketing data is not shared with third parties unless explicitly required for service provision (e.g., email delivery platforms).

10. Cookies and Tracking Technologies

10.1. The Website uses cookies for functionality, analytics, performance, and marketing.
10.2. Details of all cookies, their purpose, and retention periods are provided in the Cookie Policy.
10.3. Users may refuse non-essential cookies via the cookie banner.

11. Automated Decision-Making

ISV does not use personal data for automated decision-making that produces legal or similarly significant effects.

12. Security Measures

12.1. ISV implements appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• accidental loss,
• alteration,
• destruction,
• disclosure.

12.2. ISV shall not be liable for security breaches arising from factors beyond reasonable control, such as cyberattacks, malicious third-party actions, or inherent risks of online transmission.

‍

13. Children’s Data

13.1. ISV does not knowingly collect data from individuals under 18 years of age without parental or guardian authorisation.
13.2. If such data is unintentionally collected, ISV will delete it promptly upon notification.

14. California Consumer Privacy Act (CCPA/CPRA) Notice

(Applicable only to Users residing in California)
14.1. ISV does not sell personal data as defined by the CCPA.
14.2. California residents have specific rights, including:

• right to know what information is collected;
• right to request deletion;
• right to access;
• right to non-discrimination.
  
  
  Requests may be submitted to:
  📩 support@islandspiritvibes.com

15. Updates to this Privacy Policy

ISV reserves the right to modify this Privacy Policy at any time without prior notice.
 The updated version becomes effective upon publication on the Website.
Users are advised to review the Policy regularly.

16. Contact Information

For any questions related to these Terms:
 📩 Email: support@islandspiritvibes.com
 📞 Phone / WhatsApp: +44 7488 813582