Time Travel — Privacy Policy

1.Who we are

The controller of personal data processed in connection with the Time Travel Website, Booking Platform, My Trip, package travel services and related customer service is TIME TRAVEL Sp. z o.o., with its registered office at Al. Jerozolimskie 89/43, 02-001 Warsaw, Poland, entered in the National Court Register under KRS No. 0000735053, NIP 7010826828, REGON 380534431 (“Time Travel”, “we”, “us” or the “Controller”).

Time Travel is entered in the Register of Tour Operators and Traders Facilitating Linked Travel Arrangements maintained for the Mazowieckie Voivodeship under registration number 24128.

Current privacy contact details are made available on the Website and may also be provided in Booking documentation or My Trip. Until a dedicated privacy address is published, correspondence may be sent to the general Time Travel contact address made available on the Website.

2.Scope of this Privacy Policy

This Privacy Policy explains how Time Travel collects, uses, stores, shares and protects personal data when a person:

visits or uses the Time Travel Website;

uses Tour search or discovery functions;

creates, manages or pays for a Booking;

acts as a Contracting Person or Traveler;

uses My Trip;

contacts Time Travel or submits a complaint, request or inquiry;

selects insurance, seats or Optional Services;

receives operational or contractual communications;

uses other electronic services provided by Time Travel.

This Privacy Policy is separate from the General Terms and Conditions of Participation (OWU), the Electronic Services Regulations and the Cookie Policy. Each document has its own legal function.

3.Applicable data protection framework

Personal data is processed in accordance with applicable data protection law, including Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and applicable Polish data protection legislation.

4.Categories of personal data

Depending on the relevant service, Tour, Booking and User role, Time Travel may process the following categories of personal data:

Identification data — first name, last name, date of birth and, where required, nationality.

Contact data — email address, telephone number and other communication details provided for a Booking.

Contracting Person data — name, email, telephone number, relationship to the Booking, capacity to act for other Travelers and Booking-management data.

Traveler data — names, dates of birth and other information required for the selected Tour.

Travel-document data — passport or identity document data, document numbers, validity dates, issuing country or similar information where necessary.

Travel and Booking data — Tour, departure, boarding city, itinerary, dates, passenger category, selected services, room/seat preferences and Booking reference.

Payment and financial data — payment status, amount, currency, payment reference, outstanding balance, cancellation-related settlement information and transaction metadata. Time Travel does not need to receive full payment-card credentials where payment is processed by a regulated payment provider.

Insurance data — selected insurance option, coverage-related information and information necessary to arrange or evidence insurance where applicable.

Operational data — assigned seat, boarding details, service selections, booking status, cancellation status and travel updates.

Communication data — messages, emails, complaint content, customer-service correspondence and records of requests.

Legal evidence — accepted Legal Revision, acknowledgement records, presentation identifiers, timestamps, document hashes and other evidence necessary to demonstrate the contractual process.

Technical data — IP address where required for security or technical operation, session identifiers, browser/device information, security logs, request timestamps and similar service-operation data.

Marketing preferences — whether a person has agreed to or withdrawn optional marketing communications.

Cookie and tracking preferences — consent choices and identifiers managed through the applicable consent-management mechanism.

Advertising and measurement data — campaign identifiers, advertising click identifiers, browser identifiers, conversion-event information, pseudonymous event identifiers and related analytics or advertising metadata where such technologies are lawfully used.

Special requirements — accessibility, dietary, medical or other special-request information where the User chooses to provide it and where processing is necessary and lawful.

5.Data concerning other Travelers

A Contracting Person may provide personal data concerning other Travelers included in the same Booking. The Contracting Person should provide only information reasonably necessary for the Booking and should ensure that the other Travelers receive the relevant information concerning Time Travel’s processing of their personal data.

Where the law requires a declaration or consent to be made personally by a Traveler, the Contracting Person’s action does not replace that Traveler’s own declaration or consent.

6.Data collected after Booking

Certain information may be collected after the Booking where it is not required at the initial reservation stage. This may include document details, nationality, emergency contacts, insurance-related information or other information reasonably necessary for ticketing, accommodation, border formalities, passenger lists, insurance or performance of the Package.

7.Booking and performance of the Agreement

We process personal data where necessary to take steps at the request of a person before entering into an agreement and to perform an agreement, including to:

create and manage a Booking;

verify the Booking contact email;

calculate and present the applicable Booking configuration;

provide Tour, accommodation, transport, seat and service arrangements;

manage payments, balances and cancellation-related financial settlement;

provide My Trip and Booking-specific functions;

communicate contractual and operational information;

arrange selected insurance or Optional Services;

respond to Booking-related requests.

The principal legal basis for these activities is Article 6(1)(b) GDPR where processing is necessary for the relevant contract or pre-contractual steps.

8.Legal and regulatory obligations

We may process and retain data where necessary to comply with legal obligations, including obligations relating to tourism, accounting, taxation, insurance, financial protection, complaints, consumer protection, security, record keeping and cooperation with competent authorities.

The legal basis is Article 6(1)(c) GDPR where the processing is required by law.

9.Legitimate interests

Where appropriate, Time Travel may process personal data on the basis of legitimate interests, provided those interests are not overridden by the rights and freedoms of the individual. Such interests may include:

preventing fraud, abuse and unauthorized access;

protecting the Website, Booking Platform and My Trip;

maintaining evidence of communications and service operation;

defending, establishing or exercising legal claims;

improving internal service quality and operational processes;

maintaining necessary business records and service continuity;

handling security incidents and technical diagnostics.

The legal basis is Article 6(1)(f) GDPR where applicable.

10.Marketing

Optional marketing communications are processed separately from contractual communications.

Where consent is the applicable legal basis, marketing is carried out on the basis of Article 6(1)(a) GDPR and any other consent required by applicable electronic-communications law.

A refusal or withdrawal of marketing consent does not prevent creation or performance of a Booking.

11.Special category data

Time Travel does not seek to collect special category data unless it is reasonably required for a specific purpose, for example an accessibility or health-related request.

Where information concerning health or another special category of personal data is processed, Time Travel relies on an applicable legal basis under Article 9 GDPR and limits processing to what is necessary for the relevant purpose. Where explicit consent is legally required, it will be obtained separately.

12.Booking Platform

The Booking Platform processes information required to configure and submit a Booking. This may include Traveler categories, dates, services, seats, insurance choices, Contracting Person information, contact details and legally required declarations.

The Platform may perform server-side validation to ensure that the data, pricing and legally relevant information submitted remain consistent with the information presented to the User.

13.Contracting Person

The Contracting Person is processed as the person who submits and manages the Booking and, where applicable, concludes the Agreement with Time Travel.

The Contracting Person may be different from every Traveler included in the Booking. Time Travel therefore stores the Contracting Person’s data separately from Traveler records where the service architecture requires this distinction.

14.Legal-document acceptance and acknowledgement

Time Travel may record the exact published version of contractual or privacy information presented during the Booking process.

Such evidence may include the Legal Document type, revision number, locale, content hash, presentation identifier, timestamp, acceptance or acknowledgement method and other limited technical evidence reasonably necessary to demonstrate which information was presented and accepted or acknowledged.

This evidence is retained so that Time Travel and the Contracting Person can later reproduce which legal information applied to the Booking.

Marketing consent and cookie consent are separate from contractual acceptance and privacy acknowledgement.

15.My Trip

My Trip is the Booking-specific digital area through which information such as Booking status, Travelers, payments, seats, Tour details, boarding information and documents may be accessed.

Access may use the Booking reference, the email address associated with the Booking, email verification, secure access links, a customer account or another authentication method introduced by Time Travel. Time Travel processes the information necessary to authenticate access, maintain the session and prevent unauthorized access.

My Trip may display historical Booking documents, insurance documents and Legal Revisions applicable to that Booking. Where documents are provided on a Durable Medium, the applicable version is preserved in a form allowing later access and reproduction. Historical records are not replaced merely because a new version is later published.

16.Payments

Electronic payments may be processed through external regulated payment providers. Such providers may process card or payment-account information directly under their own legal responsibilities and privacy notices.

Time Travel generally receives information necessary to identify and reconcile a payment, such as payment reference, status, amount, currency, timestamps and refund information.

Time Travel does not require access to full card credentials where those credentials are handled directly by the payment provider.

17.Insurance

Where insurance is included or selected, Time Travel may process personal data necessary to arrange, evidence or administer the relevant insurance under the applicable arrangement with SIGNAL IDUNA Polska Towarzystwo Ubezpieczeń S.A., including data necessary for Bezpieczne Podróże, additional insurance variants and Bezpieczne Rezerwacje where selected.

Depending on the selected insurance, Time Travel may provide to the insurer information reasonably necessary for insurance registration, confirmation, claims documentation or verification, including identification data, Traveler data, Booking details, Tour price, payments made, cancellation information and the applicable cancellation fee or deductions.

Before insurance is purchased or coverage is arranged, the applicable IPID, OWU and information on the selected insurance variant are made available in accordance with applicable law. The applicable insurance documentation may also be retained or made available in My Trip.

SIGNAL IDUNA and other insurance entities may process personal data as independent controllers in accordance with their own legal obligations and privacy information. Time Travel does not decide whether an insurance claim is covered or what amount is payable by the insurer.

18.Travel and service providers

To perform a Booking, Time Travel may share relevant personal data with providers such as:

coach, minibus, transfer and other transport providers;

hotels, apartments and other accommodation providers;

airlines or ticket intermediaries where Time Travel lawfully provides separate flight-ticket intermediation within the scope permitted by the applicable OWU;

guides, Tour Leaders, local partners and activity providers;

insurers and assistance providers;

payment service providers;

IT, hosting, database, email-delivery, tag-management, server-side measurement, analytics, advertising and security service providers;

professional advisers, accountants, auditors and legal advisers;

public authorities where disclosure is required by law.

Only data reasonably necessary for the relevant purpose is disclosed, subject to applicable law and the role of the relevant recipient.

19.Service providers and processors

Time Travel may use specialized service providers to support the Booking Platform, My Trip, hosting, databases, email delivery, payment integration, analytics, security and other technical functions.

Where a service provider processes personal data on behalf of Time Travel, appropriate data-processing terms are used as required by Article 28 GDPR.

20.Transfers outside the European Economic Area

Some service providers or recipients may process data outside the European Economic Area.

Where GDPR transfer restrictions apply, Time Travel uses an appropriate transfer mechanism, such as:

an adequacy decision adopted by the European Commission;

Standard Contractual Clauses;

another transfer mechanism permitted by Chapter V GDPR;

a legally applicable derogation in exceptional circumstances.

Additional safeguards may be used where required by applicable law.

21.Security

Time Travel uses technical and organizational measures appropriate to the nature of the data and the risks associated with processing. Depending on the service, measures may include access controls, authentication, session security, encryption in transit, restricted administrative permissions, audit logging, integrity checks, immutable historical records, database constraints, backups and security monitoring.

No Internet-based system can be guaranteed to be completely secure. Users should protect their email accounts, Booking references, verification codes and devices against unauthorized access.

22.General retention principles

Personal data is not retained for longer than reasonably necessary for the purpose for which it is processed, subject to legal obligations, limitation periods and the need to establish, exercise or defend legal claims.

Different categories of data may therefore have different retention periods.

23.Booking and contractual records

Booking, payment, Contracting Person, Traveler, insurance, Legal Revision and contractual evidence may be retained for the period necessary to perform the Agreement and for the period required by accounting, tax, tourism, insurance, consumer-protection and limitation rules.

Historical Legal Revision evidence may be retained where necessary to demonstrate which terms applied to a Booking.

24.Uncompleted Booking processes

Information entered into an incomplete Booking process may be retained for a limited period where necessary for security, technical recovery, fraud prevention or continuation of a user-requested process. It is then deleted or anonymized unless another legal basis or legal obligation justifies further retention.

25.Marketing data

Marketing preferences and consent evidence may be retained for the duration of the marketing relationship and for a reasonable period afterward where necessary to demonstrate compliance with consent and objection requirements.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

26.Security logs

Security and technical logs may be retained for a limited period appropriate to security, fraud prevention, incident investigation and service integrity, unless longer retention is necessary in connection with a specific incident or legal claim.

27.GDPR rights

Subject to the conditions and limitations provided by applicable law, a person may have the right to:

obtain confirmation whether personal data is processed and obtain access to it;

request rectification of inaccurate or incomplete data;

request erasure of personal data;

request restriction of processing;

object to processing based on legitimate interests;

receive certain data in a structured, commonly used and machine-readable format and request portability;

withdraw consent at any time where processing is based on consent;

request information concerning applicable safeguards for international transfers;

lodge a complaint with a supervisory authority.

28.Exercising rights

Requests concerning personal data may be submitted using the privacy contact details published by Time Travel.

Time Travel may need to verify the identity of the requester before acting on a request, particularly where the request concerns Booking or Traveler data.

Where a Contracting Person requests access to information concerning other Travelers, Time Travel will take into account the rights and confidentiality of those other persons.

29.Right to complain

A person has the right to lodge a complaint with the competent supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO).

30.Automated processing

The Booking Platform may automatically apply rules necessary to calculate or validate a Booking, such as passenger categories, pricing rules, availability, eligibility or technical security conditions.

Routine automated technical, pricing, eligibility and validation rules do not by themselves necessarily constitute solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.

If Time Travel introduces processing that falls within Article 22 GDPR, additional information and safeguards will be provided as required by law.

31.Minors

Bookings may include minors. Data concerning minors is processed only to the extent reasonably necessary for the Booking, Tour, insurance, safety or legal requirements.

Where a declaration or consent must legally be given by a parent, guardian or the minor personally, Time Travel will apply the relevant legal requirements.

32.Accuracy of data

Users should ensure that personal data provided for a Booking is accurate and current.

Time Travel may allow correction or completion of information through My Trip or another secure channel where appropriate.

Certain Booking snapshots may be retained unchanged where necessary to preserve historical contractual evidence.

33.Contractual and operational communications

Time Travel may use email, My Trip, SMS, telephone, messaging services or another reasonable channel to communicate information necessary for a Booking or Tour.

Such communications are not marketing merely because they are sent electronically.

34.Marketing communications

Marketing communications are optional and are managed separately from Booking communications.

A person may withdraw marketing consent or object to direct marketing at any time using the mechanism made available by Time Travel or by contacting Time Travel.

35.Advertising, Analytics and Conversion Measurement

Time Travel may use advertising, analytics and conversion-measurement technologies in connection with the Website and Booking Platform, including, where configured:

• Meta Pixel;

• Meta Conversions API (CAPI) or other server-side Meta event transmission;

• Google Analytics;

• Google Ads conversion measurement and remarketing technologies;

• Google Tag Manager or comparable tag-management infrastructure; and

• server-side tagging or gateway infrastructure used to transmit permitted analytics or advertising events.

These technologies may process or receive information such as:

• page or screen viewed;

• Tour or content viewed;

• Booking-stage or conversion events;

• timestamp and technical event data;

• browser and device information;

• IP address where required for transmission, security or measurement;

• referring page and campaign information;

• advertising click identifiers such as fbclid or gclid;

• Meta browser or click identifiers such as _fbp and _fbc, where available;

• pseudonymous event identifiers used for measurement or event deduplication; and

• other identifiers or event parameters lawfully configured for the relevant advertising or analytics service.

Where server-side advertising measurement is used, certain permitted event data may be transmitted from Time Travel systems or server-side tagging infrastructure to the relevant advertising provider. Server-side transmission does not remove the requirement to apply the User's consent choices where consent is required by applicable law.

Where required by applicable law, analytics or marketing technologies are activated only after the User has provided the relevant consent through the consent-management interface. Refusal or withdrawal of analytics or marketing consent does not prevent the User from browsing the Website, creating a Booking or using My Trip, except for strictly necessary technologies required for security, session management or essential service operation.

Advertising and analytics providers may act as independent controllers for certain processing carried out within their own services. Depending on the technology used, recipients may include entities within the Meta Platforms group and the Google group, subject to their own privacy information and applicable data-transfer mechanisms.

Time Travel may use conversion measurement to understand whether advertising resulted in Website visits, Tour interest, Booking activity or other defined events, to measure advertising effectiveness, prevent duplicate event reporting and improve campaign allocation. Such processing does not change the contractual status of a Booking.

36.Cookies and similar technologies

Information concerning cookies and similar technologies, including strictly necessary, analytics and marketing technologies, is provided in the separate Cookie Policy and the applicable consent-management interface.

The Cookie Policy and consent-management interface identify the categories of technologies used and allow the User to manage optional analytics and marketing choices where required by law.

Cookie preferences do not replace contractual Booking decisions or marketing-consent records.

37.Changes to this Privacy Policy

Time Travel may amend this Privacy Policy where necessary because of legal, organizational, technical or service changes.

A new version applies from the effective date stated for that Legal Revision.

Where a particular Privacy Policy revision is recorded in connection with a Booking, later publication of another revision does not rewrite the historical evidence relating to that Booking.

38.Language versions

This Privacy Policy may be published in several languages.

Each language version may have its own identifiable Legal Revision.

Where a particular locale is recorded for a Booking or acknowledgement, that locale remains part of the historical evidence for that Booking.

A translation does not expand the purposes of processing beyond those actually applicable to the relevant service.

39.Privacy contact

Questions, requests or complaints concerning personal data may be submitted using the current privacy contact details published by Time Travel on the Website or in the relevant Legal Document publication.

Where a Data Protection Officer is formally appointed, the appropriate contact details will be published and this Policy will be updated accordingly.

40.Entry into force

This Privacy Policy enters into force on the effective date stated in its published Legal Revision.

*— End of document —*