1. Introduction

My Epanoui Limited ("we") is committed to protecting your privacy. This policy details how we collect, process, and share your data when you use epanouitravel.com. For the purposes of the UK GDPR, we are the Data Controller.

2. Information We Collect

• Identity Data: Name, date of birth (where required).
• Contact Data: Email address, phone number.
• Transaction Data: Details of products purchased via Stripe (we do not store card numbers).
• Technical Data: IP address, browser type, device info (via Google Analytics).
• Special Category Data: You may voluntarily provide health/dietary data (e.g., "vegan," "mobility issues") during booking. By providing this, you explicitly consent to us processing it to fulfil your booking.

3. How We Use Your Data

We use your data to:

1. Facilitate your booking with the Provider via Bokun.
2. Process payments via Stripe.
3. Manage customer relationships via HubSpot.
4. Send transactional emails (confirmations, updates).
5. Comply with legal obligations (tax, accounting).

4. Sharing Your Data (Sub-Processors)

We share data strictly with the partners necessary to operate our service:

• Providers/Hosts: Your details are transferred to the specific Host of your experience.
• Bokun (Tripadvisor): Used for inventory management and booking connectivity.
• Stripe: Payment processing and fraud prevention.
• HubSpot: CRM and marketing automation (only if you opt-in to marketing).

We do not sell or rent user data under any circumstances.

5. International Data Transfers

Many of our Providers are located outside the UK and EEA. By making a booking, you acknowledge and agree that your personal data (Name, Contact, Special Requests) must be transferred to the Provider in the destination country to fulfil the contract. We rely on Article 49(1)(b) of the UK GDPR (transfer necessary for the performance of a contract) for these transfers.

6. Data Retention

We retain booking data for 6 years to comply with UK tax and accounting laws. Marketing data is retained until you unsubscribe.

7. Your Rights

Under the UK GDPR, you have the right to:

• Access, correct, erase, or restrict the processing of your data.
• Object to processing.
• Withdraw consent at any time.
• Request data portability.

To exercise these rights, email hello@myepanoui.com.