Privacy Policy

1. Who We Are

Groupla Premium Travel Ltd (“Groupla”, “we”, “us”) is a company registered in England and Wales (Company No. 14029871), with registered offices at 12 Canary Wharf, London E14 5AB. We operate the website groupla.travel and the associated planning platform.

2. Data We Collect

We collect the following categories of personal data:

• Account Data: name, email address, password (hashed), role preference.
• Trip Data: destination preferences, travel dates, group composition, special requirements.
• Payment Data: billing address and last-four card digits (full card details handled by our PCI-DSS certified processor).
• Communications: messages between you and your travel planner within the platform.
• Usage Data: pages visited, features used, device/browser information, IP address.

3. How We Use Your Data

• To provide and improve our travel planning service.
• To match you with an appropriate travel planner.
• To process payments and send booking confirmations.
• To send service-related emails (version updates, booking reminders).
• To send marketing emails, if you have opted in.
• To comply with legal obligations.

4. Legal Bases (UK GDPR)

We process your data under the following legal bases: Contract (to deliver our services), Legitimate Interests (analytics, platform safety), Consent (marketing communications), and Legal Obligation (tax and regulatory requirements).

5. Cookies

We use essential cookies to keep you signed in and remember your preferences. We use analytics cookies (with your consent) to understand how the platform is used. You can manage cookie preferences from your browser settings or our cookie banner.

6. Data Sharing

We do not sell your data. We share data only with: payment processors (Stripe), transactional email providers (Resend), cloud infrastructure (Vercel, AWS), and fraud prevention services. All third parties are contractually bound to protect your data.

7. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure (“right to be forgotten”)
• Object to or restrict processing
• Data portability
• Withdraw consent at any time

To exercise any right, email privacy@groupla.travel. We will respond within 30 days.

8. Data Retention

Account data is retained for as long as your account is active. Trip and payment records are retained for 7 years to comply with UK tax law. Usage data is anonymised after 18 months.

9. Contact

For privacy queries, contact our Data Protection Officer at privacy@groupla.travel or write to us at 12 Canary Wharf, London E14 5AB. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.