Privacy Policy

1. Who We Are (Data Controller)

KennyTravel.ie is the data controller for the personal information you provide to us. Our registered details are as follows:

2. What Personal Data We Collect

We collect personal data that you provide directly to us, or that is generated through your use of our website and services. This may include:

• Name, email address, phone number, and postal address
• Passport or travel document details (where required for bookings)
• Payment information (processed securely via Stripe — we do not store card details)
• Travel preferences, dietary requirements, and accessibility needs
• Enquiry and booking history
• Website usage data via cookies and analytics tools
• Communications you send us (email, contact forms, chat)

3. Why We Collect Your Data (Legal Basis)

We process your personal data on the following legal bases under GDPR Article 6:

• Contract performance — to process bookings, manage your travel arrangements, and provide the services you have requested
• Legal obligation — to comply with Irish and EU law, including financial record-keeping and anti-money laundering requirements
• Legitimate interests — to improve our services, prevent fraud, and communicate with you about your bookings
• Consent — for marketing emails and newsletters (you may withdraw consent at any time)

4. How We Use Your Data

Your personal data is used for the following purposes:

• Processing and managing your travel bookings and enquiries
• Communicating with you about your trips, including confirmations, updates, and changes
• Sending you marketing communications where you have given consent
• Improving our website and services through analytics
• Complying with legal and regulatory obligations
• Preventing fraud and ensuring the security of our systems

5. Who We Share Your Data With

We do not sell your personal data. We may share it with trusted third parties only where necessary:

• Airlines, hotels, tour operators, and other travel suppliers — to fulfil your booking
• Stripe — for secure payment processing (subject to Stripe's own privacy policy)
• Email service providers — to send booking confirmations and communications
• Analytics providers — to understand how our website is used (data is anonymised where possible)
• Legal and regulatory authorities — where required by law

6. International Data Transfers

Some of our third-party suppliers (such as airlines and international hotel chains) may be based outside the European Economic Area (EEA). Where we transfer your data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with GDPR.

7. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law. In general:

• Booking and transaction records — 7 years (Irish Revenue requirements)
• Enquiry and contact records — 2 years from last contact
• Marketing consent records — until you withdraw consent
• Website analytics data — 26 months (standard Google Analytics retention)

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ('right to be forgotten'), subject to legal obligations
• Right to restriction — ask us to limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

9. Cookies

Our website uses cookies to improve your experience and to analyse site traffic. Cookies are small text files stored on your device. We use the following types of cookies:

• Strictly necessary cookies — essential for the website to function (cannot be disabled)
• Analytics cookies — help us understand how visitors use our site (e.g. Google Analytics)
• Preference cookies — remember your settings and choices

10. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. All payment data is processed by Stripe using industry-standard TLS encryption. Our systems are regularly reviewed for security vulnerabilities.

11. How to Exercise Your Rights or Make a Complaint

To exercise any of your rights, or if you have a concern about how we handle your data, please contact us at [email protected] or in writing to our registered address. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC) of Ireland:

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last updated. We encourage you to review this policy periodically.