GDPR Compliance

Last Updated: August 2026

Our Commitment to Data Protection

beige-lagoon is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document explains how we comply with these regulations.

Data Controller

beige-lagoon acts as the data controller for personal information collected through our services and website:

beige-lagoon
47 Colmore Row
Birmingham B3 2BS
United Kingdom
Email: privacy at beige-lagoon.com

Lawful Basis for Processing

We process your personal data under the following lawful bases:

Performance of Contract

When you book travel services, we process your data to:

• Arrange flights, accommodation, and activities
• Provide travel documentation and itineraries
• Manage bookings and handle amendments
• Provide customer support during your travels

Legitimate Interests

We may process data based on our legitimate business interests to:

• Improve service quality through feedback analysis
• Prevent fraud and maintain security
• Conduct internal business administration
• Maintain business records and archives

We balance these interests against your rights and will not process data in ways you would not reasonably expect.

Consent

We rely on your consent for:

• Sending marketing emails about travel offers and news
• Using non-essential cookies on our website
• Processing special category data where necessary (medical conditions, dietary requirements)

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Legal Obligation

We process certain data to comply with legal requirements, including:

• Financial record-keeping and tax obligations
• Anti-money laundering regulations
• Travel industry regulatory requirements

Your GDPR Rights

Right to Access

You can request confirmation of what personal data we hold about you and receive a copy. We will respond within one month of receiving a valid request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update our records and notify relevant third parties where appropriate.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including:

• Data no longer necessary for the original purpose
• You withdraw consent and we have no other lawful basis
• You object to processing based on legitimate interests
• Data was unlawfully processed

This right does not apply where we must retain data for legal compliance or to establish, exercise, or defend legal claims.

Right to Restriction

You can request we restrict processing of your data in specific situations:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, commonly used format and have it transmitted to another controller.

Right to Object

You can object to:

• Processing based on legitimate interests
• Direct marketing at any time
• Processing for research or statistical purposes

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any GDPR rights, contact us at:

Email: privacy at beige-lagoon.com
Post: Data Protection Officer, beige-lagoon, 47 Colmore Row, Birmingham B3 2BS

We will respond to valid requests within one month. For complex requests, we may extend this by two months and will inform you of any delay.

Data Transfers

When arranging international travel, we may transfer your data to countries outside the UK. We ensure appropriate safeguards through:

• UK adequacy decisions recognising equivalent data protection standards
• Standard contractual clauses approved by the ICO
• Binding corporate rules for international organisations

Data Breach Notification

If a data breach occurs that poses a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the ICO within 72 hours of becoming aware of a breach where required by law.

Data Protection Officer

Our Data Protection Officer oversees GDPR compliance and can be contacted at:

Email: dpo at beige-lagoon.com
Post: Data Protection Officer, beige-lagoon, 47 Colmore Row, Birmingham B3 2BS

Complaints

If you believe we have not handled your data properly, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Children's Data

When children travel with their families, we process their data based on parental consent. We take extra care with children's personal information and only collect what is necessary for travel arrangements.

Data Minimisation

We only collect personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. We regularly review data holdings to ensure compliance with this principle.

Record Keeping

We maintain records of our processing activities, including:

• Purposes of processing
• Categories of data subjects and personal data
• Recipients of personal data
• Data retention periods
• Security measures implemented

Updates to This Document

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated appropriately.