Last updated: August 19, 2026
Branch-roam operates in full compliance with the General Data Protection Regulation. As a UK-based travel service provider, we recognize the importance of protecting personal information and respecting individual privacy rights.
This document outlines how we meet GDPR requirements and explains the specific rights you hold regarding your personal data.
We process personal data under specific lawful bases as defined by GDPR:
Contractual necessity: Information required to fulfill travel booking agreements and deliver requested services forms the primary basis for data processing.
Legitimate interests: We process certain data to operate our business effectively, prevent fraud, and maintain service quality. These interests are balanced against individual privacy rights.
Legal obligations: Some data processing occurs to comply with legal requirements including financial record-keeping and consumer protection regulations.
Right to Access: You can request confirmation of what personal data we hold about you and receive a copy of that information in a commonly used electronic format.
Right to Rectification: If personal data we hold is inaccurate or incomplete, you can request corrections. We will update records promptly upon verification.
Right to Erasure: Under certain circumstances, you can request deletion of personal data. This applies when data is no longer necessary for its original purpose or when consent is withdrawn.
Right to Restrict Processing: You can request temporary limitation of how we process your data while we verify accuracy or assess legitimate grounds for processing.
Right to Data Portability: You can request transfer of personal data to another service provider in a structured, machine-readable format where technically feasible.
Right to Object: You can object to processing based on legitimate interests. We will cease processing unless compelling legitimate grounds override individual interests.
We retain personal information only for as long as necessary to fulfill the purposes outlined in our Privacy Policy or as required by law.
Booking records and related correspondence are maintained for seven years following trip completion to meet financial record-keeping obligations. Marketing communications are retained until consent is withdrawn or the email address becomes inactive.
Technical logs and analytics data are aggregated and anonymized after 90 days, removing personal identifiers while retaining useful operational insights.
When organizing travel to destinations outside the UK and European Economic Area, we may need to share personal information with service providers in those regions. Such transfers occur only when necessary to deliver booked services.
We ensure appropriate safeguards are in place through contractual clauses requiring recipient organizations to maintain data protection standards equivalent to GDPR requirements.
Given the scale and nature of our operations, we have not appointed a dedicated Data Protection Officer. However, data protection inquiries are handled directly by senior management with responsibility for ensuring GDPR compliance.
Direct all data protection questions to inquiries@branch-roam.com with the subject line "Data Protection Inquiry" for priority handling.
To exercise any GDPR rights, submit a written request via email to inquiries@branch-roam.com. Include sufficient information to verify your identity and specify which right you wish to exercise.
We will respond to verified requests within one month. Complex requests may require additional time, and we will inform you if an extension is necessary.
You also have the right to lodge a complaint with the Information Commissioner's Office if you believe we have not handled your data appropriately. Contact details for the ICO are available at ico.org.uk.
We regularly review data protection practices to maintain compliance with evolving regulations and guidance. Material changes to how we process personal data will be communicated through updated policy documents and direct notification where appropriate.