Privacy Policy: Last updated September 2026

SUMA Travel Ltd respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, make an enquiry, communicate with us, or use our travel services.

Who we are

SUMA Travel Ltd is a UK travel company providing holidays, cruises, tailor-made travel, group travel, corporate and incentive travel, gifting and related travel services.

For the purposes of UK data protection law, SUMA Travel Ltd is the data controller for personal information that we collect and determine how to use in connection with our website, enquiries, customer relationships, marketing and operation of our business.

Travel arrangements booked through SUMA are made using the systems, infrastructure and supplier relationships of EFR Travel Ltd. Where information is required to arrange or administer a booking, it may therefore also be processed by or through EFR Travel Ltd and relevant travel suppliers and service providers.

Company: SUMA Travel Ltd
Website: www.suma-travel.com
Email: info@suma-travel.com
Correspondence address: 2nd Floor, One Hobbs House, Harrovian Business Village, Bessborough Road, Harrow, HA1 3EX, United Kingdom

SUMA Travel Ltd is registered with the Information Commissioner’s Office (ICO).

How we collect personal data

We may collect personal information when you:

• visit or use our website;
• submit an enquiry or contact form;
• contact us by email, telephone, messaging service, social media or another method;
• ask us to research or arrange travel;
• request or receive a quotation;
• make or manage a booking;
• travel as part of a booking made by another person;
• participate in a group, corporate or incentive travel arrangement;
• purchase, receive or redeem a gift voucher or other gifting product;
• subscribe or consent to receive marketing communications;
• enter a promotion, competition or event;
• provide feedback or a testimonial; or
• otherwise communicate or interact with SUMA Travel.

We may also receive personal information from another person involved in your travel arrangements, such as a lead passenger, family member, parent or guardian, group organiser, employer or corporate contact.

Where appropriate, we may receive information from EFR Travel Ltd, travel suppliers or other service providers in connection with an enquiry, booking or travel arrangement.

What personal data we may collect

Depending on your enquiry, booking or relationship with us, this may include:

• your name, title, postal address, email address and telephone number;
• date of birth, age, nationality and gender where required for travel arrangements;
• names and details of other passengers travelling with you;
• passport information and other identification or travel-document information where required;
• travel dates, destinations, preferences, interests and previous or planned travel;
• accommodation, cabin, seating, dining and other travel preferences;
• loyalty programme or frequent-traveller information where relevant;
• information about celebrations, special occasions or surprise arrangements;
• details relating to group, corporate or incentive travel;
• employer, organisation or professional contact information where relevant;
• information contained in enquiries, quotations and communications with us;
• booking references, booking history and information relating to amendments or cancellations;
• payment, deposit, refund, gift voucher and transaction information;
• marketing preferences and records of marketing consent;
• feedback, reviews or testimonials you choose to provide;
• information necessary to deal with complaints, queries or customer-service matters; and
• any other information you choose to provide to us.

We will only ask for information that is reasonably relevant to the service, enquiry or travel arrangements concerned.

Information about other travellers

If you make an enquiry or booking on behalf of another person, you may provide us with personal information relating to them.

You should ensure that you have authority to provide that information and, where appropriate, that the other traveller has been made aware of how their information will be used.

Lead passengers and group organisers may be responsible for providing information on behalf of other travellers included within their booking.

Children’s personal data

Family and group travel may require us to process personal information relating to children, including their name, date of birth, passport information and other information necessary to arrange or administer their travel.

This information will normally be provided by a parent, guardian, lead passenger or other person authorised to make the relevant travel arrangements.

We do not knowingly use children’s personal information for direct marketing to the child.

Health, accessibility, dietary and other sensitive information

Some travel arrangements may require information about health conditions, disabilities, accessibility requirements, dietary requirements, allergies or other personal circumstances.

Some of this information may constitute special-category personal data under UK data protection law.

We will only collect or use this information where it is genuinely necessary for the relevant travel arrangements or another legitimate purpose, and where an appropriate legal condition applies.

Where required, we may ask for your explicit consent to process or share this information.

We may need to provide relevant information to EFR Travel Ltd, airlines, cruise lines, hotels, tour operators, transfer companies, venues or other suppliers so that they can provide the requested service or make appropriate arrangements.

Please only provide sensitive information that is relevant and necessary.

How we use your personal data

We may use personal information to:

• respond to enquiries and requests;
• communicate with you about your travel requirements;
• research destinations, travel products and services;
• prepare quotations, proposals and itineraries;
• create, administer and manage bookings;
• communicate with passengers, lead passengers, group organisers and corporate contacts;
• arrange flights, accommodation, cruises, transfers, activities, experiences and other travel services;
• process booking information through EFR Travel Ltd’s systems and infrastructure;
• communicate with travel suppliers and service providers;
• manage deposits, balances, payments, refunds and other booking-related transactions;
• administer gift vouchers and other gifting arrangements;
• manage amendments, cancellations, complaints and customer-service matters;
• maintain our own customer, enquiry and booking-related business records;
• understand customer preferences and provide a more personalised service;
• send marketing communications where permitted;
• manage our website and online services;
• protect our business, customers and systems against fraud, misuse or security threats;
• maintain appropriate financial, accounting and business records; and
• comply with legal, regulatory, tax, accounting or other obligations.

Our relationship with EFR Travel Ltd and travel suppliers

SUMA manages the customer relationship, travel planning and booking process with you.

Travel arrangements booked through SUMA are processed using EFR Travel Ltd’s established travel systems, infrastructure and supplier relationships. Information necessary to arrange and administer your booking may therefore be entered into or processed through systems made available to SUMA through EFR Travel Ltd, including booking systems such as Dolphin.

This does not replace SUMA’s own customer and enquiry records. We maintain our own records relating to our customer relationships, enquiries, preferences, communications, marketing permissions and relevant booking history.

Depending on your travel arrangements, personal information may also need to be provided to relevant travel suppliers and service providers, such as airlines, cruise lines, hotels, tour operators, destination management companies, transfer providers, excursion or activity providers, venues, ticketing providers and other organisations involved in providing your travel arrangements.

We will only share information that is reasonably necessary for the relevant purpose.

Legal bases for processing your data

We will only process personal data where there is a lawful basis for doing so.

Depending on the circumstances, we may process your personal information because:

• it is necessary to take steps at your request before entering into a contract;
• it is necessary to perform a contract or administer travel arrangements;
• we are required to comply with a legal obligation;
• it is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms; or
• you have given us consent.

Our legitimate interests may include responding to and managing enquiries, maintaining customer relationships and appropriate business records, operating and improving our services, preventing fraud and protecting our business.

Where we rely on consent, you may withdraw that consent at any time.

Additional conditions apply where we process special-category personal data, as explained above.

Marketing communications

Where you have asked to hear from us, or where we are otherwise permitted by law, we may send you information about SUMA Travel, destinations, holidays, cruises, travel inspiration, offers, events, products or services that we think may be of interest.

Where our website asks you to consent to marketing, this choice is optional and is not required in order to make an enquiry or book travel with us.

You can unsubscribe or change your marketing preferences at any time by using any unsubscribe facility provided in our communications or by contacting us at info@suma-travel.com.

Withdrawing consent to marketing will not affect your booking or prevent us from sending service communications that are necessary in connection with an enquiry or booking.

Payments and financial information

Where you make a travel booking, payment information may be processed through EFR Travel Ltd’s booking and payment arrangements or by other relevant payment providers.

SUMA may retain records relating to payments, deposits, balances, refunds, commissions or other transactions where necessary for booking administration, accounting and legal purposes.

Where SUMA offers its own products or services, such as gift vouchers, payments may be processed using the payment provider selected for that service.

We do not need to retain full payment-card details where those details are processed securely by an authorised payment provider or another organisation responsible for processing the payment.

Cookies

Our website uses cookies and similar technologies to help it function correctly and, where applicable, improve your experience and understand how the website is used.

Some cookies are strictly necessary for the operation of the website and do not require your consent. Other non-essential cookies will only be used where permitted and, where required, after you have given your consent.

You can accept, reject or manage your cookie preferences using the cookie consent banner on this website and can change your preferences later.

Further information about the cookies used on this website can be found in our Cookie Policy.

Website enquiries and technical information

When you use our website or submit an online form, we may collect the information you enter into the form together with limited technical information required to operate, secure and manage the website.

This may include information such as your IP address, browser or device information and information collected through cookies or similar technologies.

Information submitted through our website may be stored within our website systems and transferred to the appropriate SUMA business systems so that we can respond to and manage your enquiry.

Who we share your data with

We do not sell, rent or trade your personal data.

Where reasonably necessary, we may share personal information with:

• EFR Travel Ltd and systems operated or provided through EFR;
• airlines, cruise lines, hotels, tour operators and other travel suppliers;
• destination management companies, transfer companies, activity providers, venues and other travel-service providers;
• technology, website-hosting, email, cloud-storage and business-system providers;
• payment-processing and banking providers;
• accounting, legal, insurance and professional advisers;
• marketing or communications providers where appropriate and lawful;
• government, border, immigration, customs, regulatory or law-enforcement authorities where required; and
• other organisations where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.

Where service providers process personal information on our behalf, we take reasonable steps to ensure appropriate data-protection and confidentiality arrangements are in place.

International transfers

Travel is international by nature. Arranging your trip may require personal information to be transferred to or accessed by travel suppliers, service providers or authorities outside the United Kingdom.

Some countries may not provide the same level of data protection as the UK.

Where UK data protection law requires safeguards for an international transfer for which SUMA is responsible, we will take reasonable steps to ensure that an appropriate lawful transfer mechanism or safeguard is in place.

In some circumstances, an international transfer may be necessary in order to perform or arrange a contract relating to your travel.

How long we retain your data

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including managing enquiries and bookings, maintaining appropriate customer and business records and meeting legal, accounting, tax, regulatory or reporting requirements.

Different categories of information may therefore be retained for different periods.

An enquiry that does not result in a booking may not need to be retained for the same period as information forming part of a completed booking or financial record.

Where you have agreed to receive marketing, we may retain sufficient information to manage your marketing preferences, including a record where you have opted out so that we can respect that choice.

When personal information is no longer required, it will be securely deleted, anonymised or otherwise disposed of where appropriate.

How we protect your data

We take the security of personal information seriously and use appropriate technical and organisational measures designed to protect it against unauthorised access, accidental loss, misuse, alteration or disclosure.

Access to personal information is limited to people and service providers who have a legitimate reason to access it.

We also take reasonable steps to use appropriate systems and providers for the information we handle.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

Your data protection rights

Under UK data protection law, you may have rights in relation to your personal information, depending on the circumstances.

These may include the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information in certain circumstances;
• request restriction of certain processing;
• object to certain processing;
• request the transfer of certain personal information to you or another organisation; and
• withdraw consent where we rely on consent to process your information.

These rights are not absolute and may depend on the circumstances and the lawful basis on which information is being processed.

If you wish to exercise any of these rights, please contact us at info@suma-travel.com.

We may need to verify your identity before fulfilling a request.

Your right to make a complaint

If you have any questions or concerns about how SUMA Travel Ltd collects, uses or protects your personal information, please contact us in the first instance at info@suma-travel.com.

Please provide sufficient information about your concern to allow us to investigate it properly, together with up-to-date contact details if we need to request further information.

We will aim to acknowledge and investigate privacy complaints promptly and will keep you informed where appropriate.

You also have the right to complain directly to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection. You do not need to wait for us to investigate or respond before contacting the ICO.

Third-party websites and links

Our website may contain links to websites, booking platforms, suppliers, social-media services or other resources operated by third parties.

If you follow a link to another website, that organisation will have its own privacy practices and policies.

SUMA Travel Ltd does not control how independent third-party websites collect or use your personal information. We recommend reviewing the privacy information provided by the relevant organisation before submitting personal information to it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, business practices, suppliers, systems or legal and regulatory requirements.

Any changes will be published on this page and the date of the latest update will be shown at the top of the Privacy Policy.