Privacy Policy

This notice sets out how we use and protect your personal information. We also have a Cookie policy which explains how we use cookies and other similar technologies. This notice and the cookie policy cover the UK website and all the platforms through which you choose to interact with us, including our mobile-enabled and social media sites.

Where you are providing information on behalf of another individual, such as a fellow traveller, it is your obligation to tell them about this privacy notice and the information in it about how we may process their personal information.

From time to time, we may make changes to our privacy notice and cookie policy, so please re-visit these pages regularly if you want to keep up to date with any changes we’ve made.

By making a booking or providing us with any personal information through our channels, you understand that we will handle your personal information as set out below, including to provide that information (where relevant) to service providers (the third parties that you have selected as part of your booking to provide the travel services you have chosen, such as hotels, airlines, insurers and transfer providers). If you object to us using your personal information in these ways, we will not be able to process your booking or other requests and you shouldn’t use our websites, products or services.

We are surma travels, an online travel agency. surma travels is a trading name of Surma Travels. Our contact details are in the section ‘Contact us’.

When you book through us, you need to provide certain information such as your name, address, e-mail, phone number and payment and voucher information. If you happen to fill in the booking pages but for some reason don’t actually complete the booking, you will still have provided us with your information.

We use your personal information and financial and other information you provide to make the booking, including flights, hotels, transport, insurance and other extras. For more information on extras, please see the section below ‘Other third parties’ under the heading ‘When do we share your data with third parties?’.

Where necessary, we will use your personal information to access your bookings so that we can view, manage and make any changes to your booking, and give you notice of any cancellations or changes. Where there have been cancellations, we use your information to process and manage refund requests.

We will also need to monitor the status of (and handle correspondence in connection with) your bookings, for example, to deal with and monitor and send on to you communications from your airline, hotel or other relevant third party relating to any rescheduling or other changes.

We also need to use certain information about you and your party to pay for your booking, including, where relevant, redeeming vouchers.

To effectively manage your booking with some of the service providers (such as certain airlines), it may be necessary for us to create an additional user account on your behalf with those service providers.

If you contact us, by livechat, voice, SMS, e-mail, through the app or by another method, we’ll e ask you to provide certain information. This is likely to include your name, address, e-mail address and phone number so we can respond to you appropriately.

We’ll contact you using the e-mail or phone number you provided or if you choose, through our app, to give you information relevant to your booking. For example, to confirm your booking, tell you about any changes, security alerts or to send administrative messages about your arrangements and reminders.

The information that you provide when you set up an account allows us to provide you with other services including the ability to manage your bookings, personal settings, save search results and access to special offers. It also makes sure only you can access your account in a secure manner.

If you contact our Customer Services team we will use your personal information to respond to and deal with any complaint, query or request you make. As part of our customer care procedures, we may also follow up by letter, phone, SMS, email, or through social media with customers who have travelled with us, for example, to solve a complaint or to ask for a review.

You can contact us at any time, whether this is a general query, a question about your booking or to report an issue. You can do this through Manage My Booking on our website, using the app, by live chat, phone or through social media. We’ll use the information you’ve given us, and information we already have about your current or previous booking, to answer any questions and respond to your query or other queries you might have in the future. Our chat function requires you to provide certain information to verify your identity to make sure it provides accurate responses before we put you through to a member of our customer services team.

We record all phone calls and monitor them for the following reasons.

As a record of the holiday contract and what was agreed or included.

Quality control: to make sure customer service staff are responding appropriately and following our processes.

Analytics: to understand the nature and volume of calls to better manage Customer Services, and to be alerted to any serious or repeated issues.

Staff training.

To protect us if there is a legal dispute and / or in connection with our third-party supplier processing (see below).

We keep the call recordings only for a limited period and then automatically delete them, unless we’ve got a legitimate interest in keeping them for a longer period and that is not overridden by your rights.

We also use your personal information, including previous purchases and preferences, to provide you with a more streamlined and improved service, such as to help suggest alternative hotel and flight selections if your original selection is cancelled.

We use some automated processes and these may involve profiling (including making a decision based on the profile generated). In such situations you will always still be able to liaise with our customer service staff to find alternative suggestions or deal with your queries. For example, we may use an automated decision-making process to assess your cancellation and refund rights by combining certain personal information relating to your booking (such as travel destination and information on travellers in your party) with non-personal data (such as destination border status, flight status, hotel status and FCDO travel advice). Please contact sales@surmatravels.com if you have any queries and / or want to contest any such decisions.

If you agree to certain cookies on our website, we use your data and information relating to your interaction with our website to develop a single profile of you as our customer so we can show you the most relevant products and services we think you’ll be interested in on our websites and in our app and to communicate these with you. For example, the best deals and special offers for destinations you like or have been to previously. If you register for a price alert service or a deal alert service, we will use your information to provide you with price alerts for the holiday you have selected or alerts for search results within the parameters you have selected.

You can opt into marketing communications, price and deal alerts on our websites and in the app. When you make a booking you can opt out of marketing communications. If you have agreed to marketing we will contact you with information about our products and services that are similar to those that you have already purchased or enquired about and we think may interest you based on your personal information or profile. Don’t worry, you can opt out of marketing emails or SMSs at any time. You can turn off price alerts and deal alerts you have requested using the online subscription management tool.

Opting out of marketing or turning off alerts won’t affect the service-related communications you get from us, for example, to confirm your booking, tell you about any changes, security alerts, administrative messages about your arrangements and reminders.

You can also opt into push notifications from your browser or mobile device. This uses your information to generate targeted messages or marketing directly from applications on your browser or mobile device. If you do not want to receive these push notifications from us, you can change your permissions in your browser as detailed here (or unsubscribe using the 1-click unsubscribe link on our site) or through your mobile device settings.

We may use your personal information to generate targeted marketing on various social media sites, including, but not limited to, Facebook. The relevant social media provider will be responsible for your personal information in respect of any targeted marketing it carries out on our behalf and will be able to tell you more about how they use and process your personal information. We recommend you routinely review the privacy notices, terms and conditions and preference settings that are available to you on social media platforms. If you do not want to receive such targeted marketing generally, you can switch this off on the social media site. If you do not want to receive such targeted marketing from us, please contact us on sales@surmatravels.com or using the contact details below.

If you take part in any of our promotions (such as surveys or competitions or gift card promotions) we will need to use the information you provide to run these promotions.

Sometimes we might use your personal data, and information about the way you use and access our websites and app, to help us improve the design and functionality of our website or app or for training and quality control purposes. This could include eliminating bugs in our system, data analysis, testing, customer service quality review and for statistical and survey purposes, all of which helps us improve the service we offer.

In some circumstances we may send data about our website and app users in aggregate, anonymised or pseudonymised form to third parties for them to provide these services to us.

We also provide our customer communications data to our third party partner Twilio as controller to improve their services. The sharing of personal data with third parties is explained in more detail under "When do we share your data with third parties?" below.

Our web system collects information about each visitor, see ‘Information collected automatically’ below.

We also use technologies to understand how you engage with communication material that we send to you, such as emails, including the action you take such as any links in them that you click on, and the duration and frequency of your engagement with the email.

We may use your data as part of the efforts to keep our websites (and the information you provide to us) safe and secure, and to prevent fraud or unauthorised access / use of our websites and / or your user account on our websites.

We may use your personal information provided along with other publicly available information (including on social media) and information provided to us by third parties to prevent or detect any suspected fraud, or to prevent, detect or defend any claims / actions we believe to be potentially fraudulent or detrimental to our legitimate business interests.

We might need to use your information in relation to any legal disputes, insurance claims, regulatory, compliance or criminal investigations, or if necessary to enforce our rights. This may include reviewing information which you have made publicly available and which may be relevant to any claim (including information available on social media sites).

We may use your information to meet our regulatory obligations, including liaising with regulatory authorities and for our own internal audit purposes, to comply with applicable laws and regulations and to comply with lawful requests by public authorities, health authorities, discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities.

We will use your personal data to comply with your requests to exercise your rights under data protection legislation.

We might need to use your information in relation to managing your booking with us or to comply with our legal and regulatory obligations.

We might need to use your information for planning, due diligence and implementation in relation to a commercial transaction or service transfer that affects customers, for example, mergers and acquisitions or a sale of all or part of our business.

If you’re booking with others or for someone else, you will have to give us their information as well, for example, their name and date of birth. It’s your responsibility to make sure that they are aware that you have done so, and that they understand how we use and process their information as well as yours.

Where you provide information on behalf of another traveller regarding their health with respect to Covid-19, you will need to confirm you have their consent to do so. This will include our processing of the information, providing it to service providers (such as airlines or hotels you have booked) and / or relevant health and / or Government bodies if they require it.

You may provide us with (or another person on your behalf provides us with) sensitive personal information about:

- your health (including with respect to any mental or physical health condition that may be relevant for your booking or query);

- your sexual orientation (such as to ask us about our couples' holidays).

By providing us with this information you are agreeing to our use of it to provide what you have requested. This includes providing information to service providers where needed, such as to arrange assistance at the airport, or to relevant health and Government bodies if needed, such as in relation to Covid-19.

Where another person has provided that information to us on your behalf, it is their responsibility to get your consent to do so.

When you visit our websites we automatically collect certain information such as the device IP address, the date and time you visited, the length of time spent on the website and the order in which pages are visited, the hardware, software or particular browser used and information about your visit, including any pages you viewed and interacted with. We do this automatically, even when you don’t actually make a booking.

If you’re using a mobile device to reach us, we keep data that identifies your device, location details and any specific settings. We make use of something known as cross-device tracking, which allows us to track user behaviour across different devices. We use this to optimise the service that we provide you and for marketing activities, so advertisements shown to you on other websites may be offered based on your activities on linked devices. For more information on this, please see our Cookie policy.

Our website uses technologies to help analyse how users navigate our web pages, links and forms and helps us provide you with a good experience when you browse our websites and improve the content of our marketing. You can change cookie preferences using the cookie management tool on the website, and you can also change the way your browser manages cookies, which may be used to deliver online advertising, by following the settings on your browser. For more information on our use of cookies, please see our Cookie policy.

We might also get information about you from other sources, such as service providers, affiliates and other third parties like credit reference agencies, payment processors, search engines or social media sites. We may use this information with other information you provide to complete or process your booking.

If you use social media sites such as Facebook, Twitter and Instagram, booking search engines or personal banking sites, these sites are operated by third parties and they may share your personal data with us. We recommend you routinely review the privacy notices and preference settings of such information sharing platforms. We will respect any permissions you have set on those platforms regarding our use of your personal information collected from those sites.

You are only allowed to use this website or the app if you are over 18 years of age. We only process information about children with the consent of the parents or legal guardians.

We store information on secure servers and all payment transactions on our websites are encrypted. Only authorised staff are allowed to access your information.

We’ll only keep your information for as long as we need it, to provide you with the products and services you have requested or booked, for our business accounts and records, to meet our legal and regulatory obligations, or for other legitimate business purposes. When we have no ongoing legitimate business need to process your personal data we will either delete or anonymise it. If this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

When you pay for your holiday on our website, or otherwise make a payment on our websites, we don’t store your full card details – instead we store the last 4 digits of the card and use an encrypted authorisation ‘token’ issued by your payment provider to collect the payment, or remaining payments if you chose to pay by instalments. We need to keep these details after you have paid as we are obliged to make any refunds or other payments that may be due back to the original payment card.

In certain circumstances we may share the information you provide to us with organisations outside surma as well as sharing internally with other members of the surma group.

If you make a booking, we’ll have to share your booking data with the relevant service providers to complete your booking contract, such as the hotel you're booking to stay at or the flights you've selected. We may need to share your financial information with certain third parties to buy the relevant services from them in your name. The data shared may include your name and the names and ages of any guests travelling with you, any preferences or special requests you told us about when you made your booking and your contact details. If you contact us with a query about your booking, we may pass this on to the relevant service providers if their assistance is needed to answer you. Where we have your consent (or another legal basis under data protection legislation) to do so, we may provide information about your health or the health of members of your party with respect to Covid-19 . We will take all reasonable steps to make sure your data is passed on securely but once it is with the service providers, it is their responsibility.

These include anyone who provides support services or functions on our behalf, including:

payment card providers;

business analytics;

review agencies (such as Trustpilot);

customer support platform providers;

insurers;

legal and other advisers;

auditors and accountants;

business strategy and development advisers;

carrying out advertising, administering competitions and surveys and / or, gift card administration;

collating customer feedback and customer support services, including analysis to improve our services.

Our suppliers only handle the personal information they need to carry out their agreed functions and they are not allowed to share or use information for any other purpose.

They provide us with communications services, including communications connectivity (sending you SMS magic links to log on; facilitating secure card updates and so on), transcription, and analytics services. As an independent controller they use communications content and metadata to train its algorithms (for example, to improve automated voice transcription services or natural language understanding programmes) to improve its services, and so that we can improve your customer service experience. They first take appropriate measures to remove any directly identifying information from the communications data (such as details of the sender and recipient, and date and time of communication). If you want to opt out of this processing, please let us know and we will communicate your objection to Twilio. If you are communicating with us on behalf of or regarding other people, you are responsible for notifying them of this processing. For more information on Twilio's processing as a controller, please see Twilio's Privacy Statement.

Some third parties act independently rather than on our behalf and so when we provide your personal information to them, they are responsible for their handling of it.

Payment processors and other financial institutions: When you make a payment on your booking, we use a range of third-party payment processors to take your payment. They will act as a data controller in respect of the personal data you provide to them for such purposes. If you request a chargeback or a refund is due on your booking, it may be necessary for us to share certain details with the payment processor and the relevant financial institution, so they can manage the chargeback or refund accordingly. This may include a copy of your booking confirmation, financial details and the IP address that was used to make your booking.

Insurance provider: If you choose to buy travel insurance through our insurance partner (currently Rush Insurance), we pass on the number of adults and children on the booking, the destination, duration of holiday and departure date to get your quote. If you buy the insurance we pass on your name, address, date of birth and an identifier that links the quote to your booking. If you don’t buy the insurance both surma and the insurer discard your information.

Airport parking: If you buy airport parking through our provider (currently Holiday Extras) we pass on information on the entry and exit dates and the airport to get your quote. If you buy the parking we pass on your name, the number of passengers, phone number, the lead passenger’s address, dates and times of flights / holiday and car details (make, model, registration and colour). If you don’t buy the parking, we discard your information.

Car hire: If you buy car hire through our provider (currently Flexible Autos), we pass on the pick up and drop-off location, dates and times to get your quote. If you buy the car hire we pass on your outbound flight number, lead passenger name and age. If you don’t buy the parking, we discard your information.

Sometimes we provide a 'frame' of a third-party website on our website, such as for payment processors or third parties that provide information about travel restrictions or entry requirements, or e-visa services. This frame embeds their website into ours. If you access that frame, you are accessing that third-party website and we may need to provide them with certain limited information, such as your IP address, so you can interact with that website. Where this is the case, we will make it clear that you are accessing a third-party website.We have no control over that website and we encourage you to read the terms of use and privacy notices of these framed sites, because they will differ from ours. Please see section 5 of our Website Terms of Use for more details.

If you were referred to our website(s) from another webpage, we may share some information about you with that referring website so they can contact you about their products and services. This is done throughGoogle Analytics. With some partners, where they refer you to our website we process information on that click-through so we can pay them the correct commission.

We may share your data with our business affiliates with whom we offer relevant joint services or offers. This may include other agencies and advertising networks. We do this to increase the services we provide you. Where you have provided your consent, they may contact you directly about their relevant products and services that may interest you. You can withdraw your consent to this sharing and / or unsubscribe from these emails at any time.

We will disclose personal information where it is required by law or where we believe it is necessary for the prevention, detection or prosecution of potentially criminal acts, including for fraud, immigration, customs, security or anti-terrorism purposes.

Where we have your consent (or another legal basis under data protection legislation) to do so, we may provide information about your health or the health of members of your party with respect to Covid-19 to relevant health and / or Government bodies.

If we become insolvent we, or any appointed insolvency practitioner, may disclose your personal information to the CAA (or other relevant regulator) so they can assess the status of your booking and advise you on the appropriate course of action under any applicable scheme of financial protection. The CAA’s privacy notice is at: https://www.caa.co.uk/Our-work/About-us/General-privacy-notice/.

Due to the nature of our business and the arrangements you have chosen, it may be necessary to transfer your personal information to, and store it in, a country outside the UK, including but not limited to other members of the Surma group and third parties. We will only transfer personal information outside the UK where we have the appropriate measures in place under data protection legislation.

You can request a copy of the personal information we hold about you by making a Data Subject Access Request to us at the below address. Some of the information we hold about you is in your booking which you can access through ‘Manage My Booking’.

You can ask us to correct any inaccuracies in the personal information we hold about you. We will ask you for evidence of the correct data. You can correct or update some information in ‘Manage my Booking’.

You can request that we delete all personal information that we hold about you. However, we have legal, regulatory and legitimate business reasons for most if not all of the personal information we hold about you. We will only be able to delete your data if there is no other reason besides you providing your consent for the data or we have no legal basis to hold it.

You can object to us processing your personal information. However, this right only applies in certain circumstances.

You can object to receiving marketing from us at any time by:

clicking ‘unsubscribe’ on any of the emails that we send to you;

managing your subscriptions here; or

sending a request to the below address..

Where you have signed up for price alerts or deal alerts, you can use the online subscription management tool to turn off the relevant alert.

You have the right to request that we restrict our processing of your personal information. However, this right only applies in certain circumstances.

You may ask us to transfer certain personal information you provided to us to another party or provide it to you so you can transfer it to another party yourself. However, we can only provide it directly to a third party if this is technically feasible.

If you would like to make any rights request, please contact us at: sales@surmatravels.com.

If you feel we haven’t handled your personal data correctly, you have the right to complain to your local data protection authority. In the United Kingdom the Information Commissioner’s Office is the relevant data protection authority:https://ico.org.uk/global/contact-us/

We need to use your personal information to carry out the booking contract that you have with us and the relevant service providers and where necessary to take any steps requested by you before entering into that contract.

You may give us consent for marketing and promotional material or to us using a testimonial and photos you have provided. You can always withdraw your consent to marketing at any time as set out above in the section ‘What rights do you have?’. You can withdraw your consent to the use of a testimonial and photos you have provided by emailing sales@surmatravels.com

Some uses of your personal information are for our own legitimate business interests, for example, customer feedback, call recordings, to compile aggregate and anonymous statistics on aspects of our business and performance and for certain administrative and legal purposes such as in connection with the sale of part or all of our business. If you do not complete a purchase and did not opt out of such communications at the time, we may send you follow-up communications by phone call, SMS or email to try and help you, get your feedback or offer you alternative products related to your selection.

In some cases we will have a legal obligation to collect personal information from you. For example, to comply with tax laws which require us to collect and retain records of products and services that we sell.

It may be necessary for us to process your personal information to protect your vital interests or those of another person. For example, if you are involved in an emergency and we need to provide the details which we hold about you to the emergency services.

Where our processing involves your sensitive personal information ( information relating to your health, racial or ethnic origin, religious beliefs or sexual orientation, or information relating to criminal offences or proceedings), we may also rely on the following bases for processing.

You may give us your consent to our processing of your personal information such as information about your health with respect to Covid-19 or the other scenarios listed at ‘Sensitive personal information’ under the heading "What personal information do we collect and what do we do with it?".

It may be necessary for us to process your sensitive personal information to protect your vital interests or those of another person where you are physically or legally incapable of providing your consent. For example, if you are involved in an emergency and we need to provide your health information, such as allergies, to the emergency services.

For example, if you have an accident while on holiday with us, or request a refund because you can no longer holiday with us as a result of your Covid-19 health status, and we need to process your health information to establish your claim. We may also rely on this ground where we process your personal information relating to criminal convictions or offences, for example, where we may need to investigate to assess whether you have committed a crime.

It may be necessary for us to process your personal information to prevent and / or detect unlawful acts or fraud.