Privacy Policy

Sky Luxury Travel Limited ("SLT", "we", "us") is the data controller for personal data processed through the Agent Portal. We are registered in England and Wales (company number 12345678) with our registered office at 1 Travel House, London, W1K 1AA.

Our Data Protection Officer can be reached at dpo@skyluxurytravel.com.

We collect and process the following categories of personal data through the Portal:

• Contract — processing necessary to perform the Agency Agreement and provide Portal services.
• Legitimate interests — security monitoring, fraud prevention, product analytics, and improving our services.
• Legal obligation — retaining financial records as required by HMRC and applicable law.
• Consent — where you have provided specific consent (e.g. marketing communications).

• Authenticating and authorising your Portal access.
• Processing bookings, generating invoices, and managing your credit account.
• Communicating service updates, confirmations, and support responses.
• Monitoring Portal usage for security, fraud detection, and compliance.
• Improving the Portal through aggregated, anonymised analytics.
• Meeting our legal and regulatory obligations.

We share your data only where necessary:

• Suppliers — airlines, hotels, and ground operators require booking data to fulfil your reservations.
• Payment processors — for processing credit card or bank transfer payments.
• Cloud infrastructure — our hosting and database providers (Supabase, Vercel) process data under data processing agreements.
• Analytics — anonymised usage data may be shared with PostHog and Sentry for error tracking and product improvement.
• Legal authorities — where required by law or court order.

We do not sell your personal data to any third party.

• Account data — retained for the duration of your Agency Agreement plus 7 years for legal compliance.
• Financial records — retained for 7 years as required by HMRC.
• Usage logs — retained for 12 months then permanently deleted.
• Marketing consent — until you withdraw consent.

Under UK GDPR you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of data where we have no lawful basis to retain it.
• Restriction — request we limit processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.

To exercise any right, email dpo@skyluxurytravel.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures to protect your personal data, including TLS encryption in transit, AES-256 encryption at rest, role-based access controls, multi-factor authentication support, and regular security assessments. No internet transmission is 100% secure; you use the Portal at your own risk.

The Portal uses strictly necessary session cookies to maintain your login state. We do not use advertising or tracking cookies. Usage analytics (PostHog) operate server-side and do not require browser cookies.

We may update this Privacy Policy periodically. Material changes will be communicated via email or an in-portal notice at least 14 days before taking effect. Your continued use of the Portal after the effective date constitutes acceptance.