Privacy policy

1. Who we are

reTrippr operates a classifieds marketplace and payment intermediary for transferable package holidays. We are the data controller for the personal data described in this policy.

• Legal entity: reTrippr Ltd
• Registered in: England & Wales, company number 17305186
• Registered office: 66 Paul Street, London, EC2A 4NA
• ICO registration number: ZC184479
• Data-protection contact: [email protected]

This policy explains what personal data we collect, why, how long we keep it, who we share it with, and your rights. Our processing is governed by the UK GDPR and the Data Protection Act 2018.

2. The data we collect

• Account & contact data — your email address (your login identifier), an optional phone number, and your password (stored only as a secure, one-way hash — never in readable form).
• Security data — where you enable multi-factor authentication, the device secret used to generate your codes (held encrypted at rest).
• Identity (KYC) data — buyers and sellers — your legal first and last name, date of birth, identity-document type and number, and the verification result. We store the verified details above and the result — we do not store identity-document or selfie images. Buyers must be verified before they can pay; sellers before any funds can be released to them.
• Booking & traveller data — booking references, holiday details, and the booking confirmations you upload, plus the lead passenger's name. These documents may contain the names of other travellers on the same booking (see section 4).
• Communications — the content of buyer–seller messages and pre-purchase enquiry messages you send through the platform.
• Reviews — ratings and written reviews you leave after a completed transaction. Once revealed, reviews are public and shown on the reviewee's profile.
• Payment data — payment and payout references and the amounts involved. Card payments are processed by Stripe; we never see or store your full card details.
• Technical, security & audit data — IP addresses, browser user-agent strings, timestamps, a tamper-evident audit log of key actions on your account, and a record of your acceptance of our terms (including the IP address used at acceptance).

3. Other travellers' data

A booking confirmation often lists more than one traveller. Where a seller's booking includes other travellers, we process those people's names solely to arrange and verify the name-change with the holiday operator. We did not obtain this data directly from those travellers, so — in line with Article 14 of the UK GDPR — we make this notice available to them. If you are named on a booking listed with us and have questions or wish to exercise your rights, contact [email protected].

4. Why we use it, and our lawful basis

We rely on the following lawful bases for each purpose:

5. How long we keep it

We keep personal data only as long as we need it for the purposes above and to meet our legal obligations. Indicative periods:

• Account data — kept while your account is open. When you close your account we immediately anonymise your email address and phone number and disable sign-in; the anonymised, deactivated record is retained only where a legally-required or tamper-evident record below still depends on it.
• Identity (KYC) and financial/transaction records — 6 years from the end of our relationship with you (anti-money-laundering and accounting law).
• Booking documents — once a sale's transfer completes, deleted 7 days after departure; for a listing that ends without a sale, deleted 90 days after it closes.
• Messages and enquiries — 24 months after the related order completes (or, for a pre-purchase enquiry, after your last message), then deleted — kept longer only while a dispute is open.
• Audit and security logs — 6 years, for security, accountability and our legal limitation periods. These are tamper-evident and append-only (see below).

Some records — our audit log and your terms-acceptance record — are tamper-evident and append-only by design and cannot be altered. Where we are unable to delete data (because the law requires us to keep it, or because a record is tamper-evident), we instead restrict its use and pseudonymise it where we can, keeping access tightly limited.

6. How we protect it

Sensitive fields — identity details, the lead passenger name, and message content — are encrypted at rest, access is restricted, and personal data is never shown on public listings. Booking documents are held in private storage and shared only as needed to complete a transfer. Some fields we extract automatically from your documents (for example by OCR) are derived data held alongside the original; our engineering team continues to reconcile exactly how each field is stored, and we describe our protections honestly rather than over-claiming.

7. Who we share it with

We share data only as needed, with processors acting on our behalf:

• The holiday operator (such as TUI or loveholidays) — to carry out the name-change.
• Stripe — to process payments and operate seller payout accounts.
• Render — to host the platform.
• Cloudflare — private object storage (Cloudflare R2) for booking documents.
• Resend — to send transactional email notifications.
• Anthropic — AI-assisted checking of the booking document you upload when listing (it is compared against your listing details and verified name to confirm the booking is genuinely yours). The document is sent for that check only and is not used to train AI models.
• Sentry — for error monitoring, if enabled.

Some of these providers process data outside the UK. Where they do, we rely on an appropriate safeguard — UK “adequacy” regulations where the destination is covered (for example the EEA), or otherwise the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. We do not sell your personal data.

8. Your rights

Under UK data protection law you have the right to access your data, rectify inaccuracies, request erasure, restrict or object to processing, and data portability.

To exercise any right, email [email protected]; we respond within one month. You can also delete your account from your account settings.

Erasure caveat: we cannot delete everything. We must retain your KYC/AML and financial records for the legal period, and our tamper-evident audit log and terms-acceptance record cannot be altered (we keep them for security and accountability). Where we retain such data, we keep it to the minimum and restrict access to it.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies, changes and contact

We use cookies as described in our cookie notice. We may update this policy; material changes will be notified. For any privacy request, email [email protected] or see our contact page.