UK GDPR · DPA 2018 · Data (Use and Access) Act 2025

Privacy Policy

Version 2026-08-28-v4 · Last updated 28 August 2026

Who this applies to. Travel Desk is primarily a business-to-business service for independent travel professionals. This notice also covers visitors, trial users, account holders, support contacts, Agent Club users and people whose information is supplied to Travel Desk through an agent's authorised use of the service.

1. Who is responsible for your information?

Operator: Travel Desk is operated by Matthew King trading as Travel Desk, a UK sole trader.
Business/service address: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom.
Privacy and support contact: support@traveldeskshop.com.

Travel Desk is a controller for information used to operate accounts, subscriptions, security, support, website measurement, supplier/partner administration and Travel Desk's own commercial operations. Where an agent supplies personal information about their clients for Travel Desk to process only on that agent's instructions, Travel Desk may act as that agent's processor; the Data Processing Terms apply to that processing.

Business service address verified. Travel Desk publishes the owner-verified business/service address above. Any conflicting private configuration value fails closed and blocks commercial activation until reconciled.

ICO fee position before launch. On 18 August 2026 the operator completed the ICO data-protection-fee self-assessment on the basis that Travel Desk had not started trading. The result was that no fee was due yet and no exemption notification was required. This is not treated as a permanent exemption: the assessment must be repeated when trading starts.

2. Information we may process

Data minimisation and special-category data. Travel Desk is not designed as a medical-record or booking-health repository. Do not enter health, disability, medication, allergy or other special-category information unless an enabled feature genuinely requires it and you have identified both an Article 6 lawful basis and an applicable Article 9 condition. Travel Desk policy is to avoid this data by default.

Account and identity data: name, email, account identifiers, plan, role, tenant/agency information, preferences and authentication records.
Billing and transaction data: subscription and payment status, Stripe identifiers, invoices and limited accounting metadata. Travel Desk does not need to collect your full card number when payment is completed on Stripe's hosted checkout.
Connected-platform data: identifiers, permissions, OAuth tokens and publishing status needed to operate authorised Facebook, Instagram or TikTok connections.
Content and client-work data: prompts, captions, itineraries, quotes, client details or other material you choose to enter into enabled tools.
Support and rights data: support tickets, complaint text, data-rights requests, correspondence and evidence needed to investigate them.
Technical and security data: session information, security events and limited device/network information where needed for authentication, abuse prevention or security.
Optional measurement and attribution data: campaign/referral identifiers, page or CTA events and related first-party identifiers only where the applicable consent/permission mechanism allows optional measurement.
Agent Club and merchandise data: smart-QR destination, artwork, delivery details, order status and supplier fulfilment information when those features are used.

3. Why we use information and our lawful bases

Purpose	Typical lawful basis
Provide the account, trial, subscription and requested tools	Contract or steps requested before entering a contract
Billing, accounting and legal record keeping	Contract and legal obligation
Security, fraud/abuse prevention, service reliability and audit	Legitimate interests and, where applicable, legal obligation
Customer support, complaints and data-rights handling	Contract, legal obligation and legitimate interests
Optional cookies, partner attribution and non-essential measurement	Consent where required
Direct marketing	For electronic marketing to individual subscribers, including sole traders and some partnerships, consent or a valid PECR soft opt-in is required. Corporate-subscriber rules differ, but UK GDPR still applies where personal information is used. Every marketing message must identify Travel Desk and provide an effective opt-out. Registration is not bundled with marketing consent.

Where Travel Desk relies on legitimate interests, the interest must be identified and balanced against the individual's rights. Optional tracking is not treated as necessary merely because it is commercially useful.

4. AI and generated content

Some enabled features send user-provided content to an AI provider to generate text, images, audio or video. Only enter personal information that you are authorised to use for that purpose. Avoid special-category or highly sensitive client information unless it is genuinely necessary, lawful and appropriate for the feature being used.

Travel Desk's content tooling is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects.

5. Who we share information with

We use service providers and connected platforms where needed to deliver the service. The current operational and conditional provider categories are published in the Subprocessor and Third-Party Provider Register. Depending on the feature used, these may include hosting, encrypted backup, payment, email, AI, social-platform and fulfilment providers.

Provider roles differ. Some suppliers process data for Travel Desk, while connected platforms may act as separate controllers under their own platform/product terms. In particular, ordinary Facebook/Instagram Platform API publishing is governed by the Meta Platform Terms; Meta is not presented as a generic Article 28 Travel Desk subprocessor for that connected-platform relationship.

We may also disclose information where required by law, to establish or defend legal rights, or to protect the security of users and the service.

6. International transfers

Some providers may process information outside the United Kingdom. Where a transfer is a restricted transfer under UK data-protection law, Travel Desk must identify an available lawful transfer mechanism and complete any required transfer risk assessment / data protection test before treating that transfer route as approved. Listing a provider does not by itself represent that every transfer mechanism or contract has been completed.

7. Retention

We keep information only for as long as it is needed for the purpose for which it was collected, to provide the service, meet legal/accounting requirements, resolve disputes, prevent abuse and maintain proportionate audit evidence. Different categories have different periods. The owner retention schedule documents the current policy periods, purpose and disposal/review rule for each category; it is a governance record rather than a claim that UK GDPR sets one universal statutory retention period. Backups may retain encrypted copies until the normal backup-retention cycle removes them.

8. Your rights

Depending on the processing and applicable law, you may have rights including access, correction, erasure, restriction, objection, portability and withdrawal of consent. Withdrawal does not affect processing that was lawful before withdrawal.

Make a data rights request Rights and deletion guidance Make a data protection complaint

We may need proportionate identity or authority checks before disclosing or deleting personal information.

9. Data protection complaints

You can raise a complaint directly with Travel Desk using the dedicated electronic form. In accordance with the UK complaints duties now in force under the Data (Use and Access) Act 2025, Travel Desk provides a clear electronic route, acknowledges receipt within 30 days, investigates appropriately without undue delay, keeps the complainant informed where appropriate and communicates the outcome. You may also complain to the Information Commissioner's Office.

10. Cookies and optional measurement

See the Cookies Policy. Optional first-party attribution and measurement are disabled unless the consent authority records permission. You can change or withdraw that choice through the persistent Cookie settings control.

11. Security

Travel Desk uses technical and organisational safeguards including authenticated access, restricted administrative actions, encrypted transport, protected private configuration and encrypted verified backups. No online service can promise absolute security. Security incidents and suspected personal-data breaches must be assessed under the incident-response process. Travel Desk maintains an incident/breach record for assessment and learning; a notifiable personal-data breach must be reported to the ICO without undue delay and, where required, within 72 hours of awareness.

12. UK launch scope and governance

Travel Desk applies the UK GDPR, Data Protection Act 2018 as amended and the Data (Use and Access) Act 2025 for the UK launch. Commercial launch is currently restricted to the United Kingdom. Non-UK commercial activation requires a separate jurisdiction review. Travel Desk maintains an owner ROPA/data map, retention schedule, consolidated DPIA, incident/breach procedure, international-transfer register, PECR marketing policy, provider due-diligence record and PCI-scope review as living governance records. These records support accountability; they are not external certifications.

13. Changes

Material changes will be reflected by a new version/date. Where a change materially affects the contract or a consent-based purpose, Travel Desk will use the appropriate notice or fresh-consent mechanism rather than silently treating old consent as covering a new purpose.