Privacy Policy

1. Who We Are

1.1 At Ildiko Varga Travel (“IVT”) we are committed to protecting and respecting your privacy while delivering the best possible experience when you enquire, book, and travel with us. We maintain systems and processes to ensure that the personal data we process is accurate, kept to a minimum, and only accessible by those who need it. We also want you to understand how and why we use your personal information.

1.2 This privacy policy (and any documents referred to herein) explains how we collect, process, and use personal data about:

• Our clients and prospective clients

• Visitors to our website or users of our mobile/tablet apps

• Any other individuals whose personal data we process in the course of our business

Please read it carefully to understand our practices and your rights.

1.3 We have a legal duty to protect personal data under U.S. and international privacy laws, including the California Consumer Privacy Act of 2018 (“CCPA”) and, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”). For the purposes of these regulations, IVT is the data controller.

2. Personal Information We Collect, How We Use It, and Our Lawful Basis for Processing

2.1 Categories of Personal Data and Why We Use It

a. Enquiries and Bookings

• Data Collected: name; email; phone; travel interests; requested brochures; geolocation; any details you volunteer when enquiring (e.g., best contact times, appointment requests, comments)

• Purpose: to respond to your requests, send brochures, recommend destinations, and follow up as needed

• Lawful Basis: legitimate interests in tailoring our service and performance of contract when you book a trip

b. Trip Arrangement Details

• Data Collected: passport information; emergency contacts; travel insurance details; preferences and special requirements (dietary, medical, mobility); frequent–flyer numbers; visa needs; carbon–offset contributions

• Purpose: to organize and deliver your itinerary, make third-party bookings on your behalf, and address any issues that arise while you travel

• Lawful Basis: performance of contract and compliance with our legal obligations

c. Marketing Communications

• Data Collected: mailing address; email address; marketing preferences

• Purpose: to send our travel magazine, newsletters, and personalized offers based on your interests

• Lawful Basis: legitimate interests in direct marketing and, where required, your consent. You may opt out at any time via the “unsubscribe” link or by emailing contact@ildikovargatravel.com

d. Website and App Usage

• Data Collected: technical and device data (IP address; browser type and version; operating system; screen resolution; page URLs; session timestamps); app usage (journal entries; photos); location data (with your consent)

• Purpose: to improve functionality, enhance user experience, troubleshoot issues, and maintain security

• Lawful Basis: legitimate interests in operating and securing our digital platforms; explicit consent for location-based features

e. Advertising and Analytics

• Data Collected: hashed identifiers (e.g., email address in a non-identifiable form) shared with partners like Google and Meta

• Purpose: to deliver relevant ads, measure campaign effectiveness, and understand user preferences

• Lawful Basis: legitimate interests in promoting our services; consent when required by law

f. Administrative and Operational

• Data Collected: call and chat logs; correspondence details; information supplied when reporting website issues

• Purpose: to train our team, improve service quality, resolve disputes, and defend legal claims

• Lawful Basis: legitimate interests in ensuring operational excellence and legal compliance

g. Social Media Interactions

• Data Collected: social media handles; posts or tags that mention @ildikovargatravel

• Purpose: to engage with you, answer questions, and build community

• Lawful Basis: legitimate interests in client engagement

• 2.2 Third-Party Sources

  We may augment our records with data from trusted partners—such as CRM providers, travel affiliates, and marketing platforms—to keep your information accurate and up to date.

  2.3 Sensitive Information

  When you provide health-related details (e.g., medical conditions, disabilities, dietary allergies) or identification numbers (driver’s license, passport), we use them solely to plan and deliver a safe, accessible trip.

  • Lawful Basis: performance of contract and your explicit consent.

  • Emergency Processing: when necessary to protect your vital interests if you cannot consent.

  • Retention for Legal Claims: we may retain this data to establish, exercise, or defend legal claims.

  2.4 Third-Party Data

  If you supply information about other travelers, you must confirm you have their consent before sharing. Please:

  • Share this privacy policy with them.

  • Direct any of their questions to contact@ildikovargatravel.com.

   

  2.5 Websites, Apps, Marketing, and Advertising

  2.5.1 Website Usage Data

  When you visit ildikovargatravel.com, we automatically collect technical and browsing details, including:

  • IP address or device identifier

  • Browser type and version

  • Operating system and platform

  • Screen resolution

  • Dates, times, and duration of visits

  • Full URLs of pages viewed and referring links

  • Login attempts and pages where credentials are entered

  • Products or services viewed

  We use cookies and similar technologies—see our Cookie Policy for details—to gather this data.

  • Purpose: site management, security (troubleshooting/testing), and continual improvement.

  • Lawful Basis: our legitimate interests in operating and securing the site; consent where required for non-essential cookies.

  2.5.2 Mobile App Data

  When you use our mobile app, we collect:

  • Identity and contact data

  • Transaction history (e.g., bookings, payments)

  • Device and usage data (e.g., app version, session length)

  • Optional location data (only with your consent; you can disable it anytime)

  • Anything you write in your in-app journal and photos you upload

  • Purpose: to deliver app features, fulfill our contract, and enhance your travel experience.

  • Lawful Basis: performance of contract; legitimate interests in improving IVT’s services.

  2.5.3 Marketing and Advertising

  We may contact you via email, SMS, postal mail, or phone with travel news, inspiration, and tailored offers. We also share hashed identifiers (e.g., non-identifiable email hashes) with advertising partners (Google, Meta) to:

  • Deliver relevant ads on third-party platforms

  • Measure campaign effectiveness

  • Understand general user interests

  We never sell or share your mobile number for third-party marketing.

  • Lawful Basis: our legitimate interests in promoting IVT’s services; your consent when required.

  • Opt-Out Options:

    • Click “unsubscribe” in any marketing email

    • Reply “STOP” to any SMS

    • Email contact@ildikovargatravel.com

  3. How We Share Your Personal Information

  To ensure smooth operations and deliver the service you expect, Ildiko Varga Travel (“IVT”) may share your personal data with the following parties, as needed:

  • Affiliates of IVT, including our parent company and subsidiaries, to coordinate services across our organization.

  • Trusted third-party partners, such as local tour operators, gift and amenity providers, and technology vendors, to fulfill contracts with you.

  • Advertising partners (e.g., Google and Meta) to serve relevant ads; we transmit only securely hashed identifiers (like email addresses) so you remain anonymous.

  • Prospective buyers of all or part of IVT’s business or assets, should a sale or merger occur.

  • Third parties when required to comply with legal obligations or enforce agreements—for example, airlines under IATA Resolution 830d that need your mobile number and email to notify you of flight disruptions.

  • Third parties when necessary to protect IVT’s or your rights, property, or safety, or those of others.

  • Referring partners, affiliates, or agents who introduced you to IVT, so they can manage any bookings or enquiries they facilitated.

   

  4. Automated Decisions and Profiling

  IVT uses automated systems to make instant decisions—such as recommending destinations or prioritizing enquiries—based on criteria we set and the information you provide when requesting brochures or quotes. We regularly test these systems to enhance accuracy and prevent unintended bias.

  We may also share pseudonymized or aggregated data with third-party analytics and marketing services to segment our audience and tailor our communications to your interests.

   

  5. Where We Transfer and Store Your Personal Information

  Ildiko Varga Travel may transfer or allow trusted third parties to process your personal data outside the United States, for example when booking accommodations, tours, or experiences with our overseas partners. In every case, we implement appropriate safeguards—such as contractual data-processing agreements or industry-standard security measures—to ensure your information receives protections equivalent to U.S. legal requirements.

  For more details about these cross-border safeguards, please contact us at contact@ildikovargatravel.com.

   

  6. Security of Your Personal Information

  We take the security of your personal data very seriously. We employ a combination of physical, technical, administrative, and operational controls to protect against unauthorized access, disclosure, alteration, or destruction. These measures include:

  • Encryption of data in transit and at rest

  • Role-based access controls and multi-factor authentication

  • Regular security assessments and vulnerability scans

  • Employee training on data-protection best practices

  • Rigorous vetting of all third-party service providers

  We continuously review these controls to keep pace with evolving threats and industry standards.

   

  7. Retention of Your Personal Information

  We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy—including providing travel services, complying with legal obligations (such as tax and accounting requirements), and resolving any disputes. Retention periods vary by data type; for example, transactional records may be kept for up to seven years to satisfy financial record-keeping laws.

  If you have questions about specific retention periods or wish to request deletion once retention requirements have been met, please email contact@ildikovargatravel.com.

   

  8. Your Rights in Your Personal Information

  You have the following rights regarding the personal data we hold about you:

  • Access: Request confirmation of whether we process your data and, if so, obtain a copy of it.

  • Rectification: Ask us to correct inaccurate or incomplete information we hold.

  • Erasure: Request deletion of your personal data where there is no valid reason for IVT to continue processing it.

  • Restriction: Ask us to suspend processing of your data in certain circumstances (e.g., while we verify accuracy).

  • Portability: Obtain a machine-readable copy of data you provided to us, or request direct transfer to another controller.

  • Objection: Object to our processing of your data, including for direct marketing or profiling based on legitimate interests.

  • Automated Decisions & Profiling: Request that we stop decisions made solely by automated processing that produce legal or significant effects on you.

  • Targeted Advertising Opt-Out: Opt out of targeted ads and the sale or sharing of data under applicable laws such as the CCPA.

  • Prevention of Harmful Processing: Request we cease processing likely to cause you or others unwarranted damage or distress.

  To exercise any of these rights, please email contact@ildikovargatravel.com. We may need to verify your identity by asking for information you’ve previously provided. If you appoint an authorized agent, we’ll require written proof of their authority.

  We won’t discriminate against you for exercising your rights—even if it limits our ability to provide certain services. However, if deletion of data prevents us from fulfilling a contract, we may be unable to continue providing those services.

9. Changes to This Policy

9.1 We may update this privacy policy at any time to reflect changes in our practices or legal requirements. Material changes will be published here with a revised “Last Updated” date and, where appropriate, notified to you by email. Your continued use of our website or services constitutes acceptance of the updated policy.

 

10. Contact and Complaints

10.1 For questions, comments, or requests about this policy or your personal data, contact us at: contact@ildikovargatravel.com

 

Last Updated: 15 September 2025