VIAUTENTICA TRAVEL DESIGN — PRIVACY POLICY
Viautentica Travel Design (“Viautentica”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you engage our luxury travel design and consultancy services, visit our website (www.viautentica.com), or otherwise interact with us.
This policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It should be read in conjunction with our Terms and Conditions of Business.
1. Important Information and Who We Are
1.1 Data Controller
Viautentica Travel Design is a boutique travel design and consultancy business owned and operated by Cristina Loiaconi. For the purposes of applicable data protection law, Viautentica is the “Data Controller” of your personal data.
1.2 Commercial Affiliation Notice
Cristina Loiaconi operates as an Independent Travel Agent Contractor in commercial partnership with Simplexity Travel Management Limited (“Simplexity”). Where you request or book travel arrangements through us, your booking is processed via Simplexity’s platforms. In these instances, your data will be shared with Simplexity, who will act either as a joint data controller or an independent data controller alongside us. You are advised to review Simplexity’s own privacy policies alongside this document.
1.3 Contact Details
If you have any questions about this Privacy Policy or our data protection practices, please contact us:
- Full Name: Cristina Loiaconi (Viautentica Travel Design)
- Email Address: [[email protected]]
- Website: www.viautentica.com
2. The Data We Collect About You
Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:
- Identity Data: First name, maiden name, last name, title, date of birth, gender, and passport details (including passport number, place of issue, expiration date, and copy images where required for international bookings).
- Contact Data: Billing address, delivery address, email address, and telephone numbers.
- Financial Data: Bank account and payment card details (processed securely via encrypted third-party payment providers for consultancy fees, or handled directly by our commercial bank via secure bank transfers).
- Transaction Data: Details about payments to and from you, and details of the specific consultancy packages or travel designs you have purchased from us.
- Travel & Itinerary Data: Flight details, hotel bookings, villa preferences, car rentals, travel insurance details, and specific requirements matching your selected Service Package (e.g., operational criteria requested for a Digital Villa Suitability Assessment).
- Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types, operating system and platform, and other technology on the devices you use to access our website.
- Special Categories of Personal Data: To safely design your travel experiences, we may collect information regarding your dietary requirements (which may reveal religious beliefs), health conditions, accessibility/mobility needs, or medical requirements. We only collect this data with your explicit consent and will use it strictly to ensure your safety and comfort during travel.
3. How We Collect Your Personal Data
We use different methods to collect data from and about you, including:
- Direct Interactions: You give us your Identity, Contact, and Financial Data by filling in forms, countersigning proposals, or communicating with us by email, phone, or otherwise. This includes data provided when you inquire about or purchase our Service Packages (Full-Service Travel Design, Journey Design Only, Villa & Retreat Consultancy, or Digital Villa Suitability Assessments).
- Third Parties or Publicly Available Sources: We may receive personal data about you from third parties, such as Simplexity Travel Management, property owners, villa managers, or agents providing information for a property assessment you commissioned.
- Automated Technologies: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns via cookies and similar technologies.
4. How We Use Your Personal Data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Performance of a Contract: Where we need to perform the contract we are about to enter into or have entered into with you (e.g., creating a tailored itinerary or facilitating travel bookings).
- Legitimate Interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g., managing our business relationship, ensuring web security).
- Compliance with Legal Obligations: Where we need to comply with a legal or regulatory obligation (e.g., financial reporting, anti-money laundering regulations).
Purposes for Which We Will Use Your Personal Data
| Purpose / Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| To register you as a new client and determine suitability for our travel design packages. | Identity, Contact | Performance of a contract with you |
| To provide and deliver our services, including Package 1 (Full-Service), Package 2 (Journey Design), Package 3 (Villa Consultancy), and Package 4 (Digital Villa Suitability Assessment). | Identity, Contact, Financial, Transaction, Travel & Itinerary | Performance of a contract with you |
| To process and pass booking requests to Simplexity Travel Management and coordinate with global luxury suppliers. | Identity, Contact, Transaction, Travel & Itinerary, Special Categories (e.g., medical/dietary details) | Performance of a contract with you + Explicit Consent for Special Category Data |
| To manage payments, fees, and collections. | Identity, Contact, Financial, Transaction | Performance of a contract with you; Legitimate interests (to recover debts due) |
| To manage our relationship with you (notifying you about updates to our Terms or Privacy Policy). | Identity, Contact, Profile | Performance of a contract with you; Compliance with a legal obligation |
| To administer and protect our business operations and website (including troubleshooting, data analysis, testing, system maintenance). | Technical, Identity, Contact | Legitimate interests (running our business, provision of administration and IT services, network security) |
5. Disclosures of Your Personal Data
To deliver our bespoke travel design and consultancy packages, we must share your personal data with trusted third parties. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
We may share your data with the following entities:
- Simplexity Travel Management Limited: Our host agency platform, through whom all travel bookings, ATOL licensing details, and supplier transactions are officially executed.
- Third-Party Travel Suppliers: Including but not limited to airlines, hotels, resort operators, Virtuoso preferred partner networks, local destination management companies (DMCs), private villa owners, property managers, and transport providers.
- Professional Advisors: Service providers acting as processors or joint controllers including lawyers, bankers, auditors, and insurers (in relation to Viautentica’s Professional Indemnity policy).
- Regulators and Government Authorities: HM Revenue & Customs, border control, immigration authorities, aviation safety bodies, and other authorities based in the UK or destinations on your itinerary who require reporting of processing activities under specific conditions.
6. International Transfers
Because travel is an international endeavour, fulfilling your contract will frequently require transferring your personal data outside the United Kingdom (UK) and the European Economic Area (EEA). For instance, your Identity and Travel Data must be disclosed to destination properties or transport authorities in the countries you intend to visit.
Where your data is transferred outside the UK, we endeavour to ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.
- Where we use certain service providers, we may use specific contractual clauses approved for use in the UK (the International Data Transfer Agreement or Addendum) which give personal data the same protection it has in the UK.
- Necessary for Performance of Contract: Where a transfer cannot be governed by the standard protections above, the transfer is legally permitted because it is strictly necessary for the performance of our contract with you (e.g., booking a villa or hotel in a country outside the UK/EEA).
7. Data Security
We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed.
Your financial and transaction data is handled based on the service selected:
- Direct Consultancy Fees: Payments made directly to Viautentica for planning or consultancy packages are processed via secure, PCI-DSS compliant third-party payment gateways or direct bank-to-bank transfers. We never store or retain your full credit card details on our local systems.
- Travel Bookings: All transactions for flights, hotels, and travel packages are executed directly through the encrypted corporate platforms of Simplexity Travel Management Limited, protected by their dedicated security protocols and corporate Cyber and Data Crime Insurance.
In addition, we limit access to your personal data to those providers and suppliers who have a strict business need to know to fulfill your itinerary.
8. Data Retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and applicable statutory limitation periods under English law.
9. Your Legal Rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:
- Request access to your personal data (commonly known as a “data subject access request”).
- Request correction of the personal data that we hold about you.
- Request erasure of your personal data where there is no good reason for us continuing to process it.
- Object to processing of your personal data where we are relying on a legitimate interest.
- Request restriction of processing of your personal data.
- Request the transfer of your personal data to you or to a third party.
- Withdraw consent at any time where we are relying on consent to process your personal data (such as details regarding health conditions or special dietary codes).
If you wish to exercise any of the rights set out above, please contact us in writing at our designated email address.
Right to Complain
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
10. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy from time to time. Any changes we make will be posted on this page and, where appropriate, communicated to you in writing or via electronic correspondence. Continued engagement with our services following publication of an updated version constitutes acceptance of the revised terms.