Privacy Policy

Journey are committed to protecting your personal information and explaining how we collect, process, and share it. This Privacy Policy applies to Journey’s websites, mobile applications, and cloud-based services, collectively referred to as "the Site." It describes how we collect, use, and protect information that can identify you personally ("Personal Information") and provides your rights under data protection laws.

This document outlines:

• Our data collection practices and types of personal information we collect.

• How we protect your information.

• How we use, share, and store your information.

• Your rights and choices regarding your personal information.

• Contact information for questions or complaints.

If you have any questions about this privacy policy or our privacy practices, please contact:

Journey at hello@journey.travel or by mail at Journey HQ, Elmstone Business Park, Stoke Road, Elmstone Hardwicke, Cheltenham, GL51 9SY.

We may update this Privacy Policy to reflect changes in our practices, operational, legal, or regulatory reasons. Notifications of significant changes will be posted prominently on our Site or communicated via email where appropriate.

This Privacy Policy was last reviewed and updated on 5th October 2026.

Types of Personal Information We Collect

We collect the following types of personal information based on interactions with our Site and services:

• Identity Information: Name, title, date of birth, gender, and identification numbers.

• Contact Information: Email, address, phone number, and social media information.

• Financial Information: Payment card details, billing address, and other transactional data.

• Technical Information: IP address, device and browser type, operating system, and cookies.

• Usage Information: Site activity, preferences, and survey responses.

• Marketing and Communications Data: Communication preferences and any responses to marketing communications.

How We Collect Personal Information

We collect your personal information directly through forms, emails, phone interactions, and online surveys, or automatically via cookies and other tracking technologies.

How We Use Your Personal Information

We use the information we collect to:

• Provide products, services, and customer support.

• Communicate updates, marketing offers, and advertisements relevant to your interests.

• Conduct surveys, analyses, and troubleshooting.

• Maintain and improve our Site, ensuring security and compliance.

Where you use Agency by Journey, our hospitality marketing platform (powered by our technology partner Manta AI AS), we process your account, contact, billing and product-usage data to provide the service, and the platform uses artificial intelligence to generate marketing plans and creative. Personal data about your guests and customers that you provide or connect is processed under our Data Processing Agreement, where we act as your processor and you remain the controller.

We process your personal information based on several legal grounds, depending on the purpose of the processing:

• Contractual Necessity: Processing is necessary to fulfil our contractual obligations to you, such as providing services or products, and managing your account.

• Legitimate Interests: Processing is conducted to pursue our legitimate business interests, provided these interests do not override your rights and freedoms. This includes:

  • Customer relationship management and service improvements

  • Fraud prevention and IT security measures

  • Operational efficiency and business development activities

• Legal Obligations: We may be required to process your data to comply with legal and regulatory obligations, including tax and corporate compliance laws.

• Consent: Where legally required, we seek your consent before processing your data, particularly for marketing and optional communications. You may withdraw consent at any time without impacting the lawfulness of processing carried out prior to withdrawal.

Consequences of Not Providing Data

Providing personal information is often necessary to fulfil a contract with you, such as enabling purchases or managing an account. If you choose not to provide certain required information, we may not be able to provide specific services or products to you.

Sub Processors and Sharing with Third Parties

We may share your information with service providers, professional advisors, analytics partners, and affiliates, provided they meet our standards for data security and confidentiality. We do not share your data with third-party advertisers or unrelated parties without consent, except as legally required.

In order to provide our services and maintain our business operations, we may share information with the following trusted third-party providers:

Each of these providers has been carefully selected to ensure they meet our standards for security, privacy, and compliance. Data shared with these providers is limited to the minimum necessary for them to perform specific tasks on our behalf, and they are contractually obligated to handle data in a secure and compliant manner.

Third-party links

This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

International Data Transfers

Data shared with our external third-party partners may involve transfers outside the UK. When this occurs, we employ appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, to protect your information.

Our technology partner processes personal data within the European Economic Area, so no additional transfer mechanism is required for its processing. Where any component processes personal data outside the UK or EEA, we rely on the safeguards described above (the UK IDTA and the UK Addendum).

Where you connect a Google account to Performance Marketing Platform, we request access only to the Google data needed to provide the features you use. Specifically: Name, Email Address.

How we use it. We use this data only to provide and improve the user-facing features of Performance Marketing Platform that you request. We do not use it for advertising, and we do not sell it. People at Journey do not read it unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations.

Limited Use. Performance Marketing Platform's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Artificial intelligence. Some features of Performance Marketing Platform process data with AI models. We do not use, transfer or sell Google user data, whether raw, aggregated, anonymised or derived, to create, train or improve foundational or generalised artificial intelligence or machine learning models. This applies to Journey's own models and to any third party's. We use AI providers only under commercial or enterprise terms that prohibit training on our customers' data. We never send Google user data to consumer or free-tier AI services. Our AI providers are:

Google - Gemini 4 via Google Cloud Vertex AI in Journey's own Google Cloud project - Customer data is not used to train models under Google Cloud's Service Specific Terms

Anthropic - Claude Opus 5.5 via the Anthropic API on commercial terms - Customer data is not used to train models under Anthropic's Commercial Terms of Service

Storage, retention and deletion. Google user data is stored in UK, South Region, encrypted in transit and at rest, and kept for 1 year. You can revoke our access at any time at myaccount.google.com/permissions. You can ask us to delete your data by emailing dpo-jt@journey.travel.

We employ reasonable security measures, including encryption, restricted access, and secure data handling practices, to protect your personal information against unauthorised access and misuse. Despite these measures, data transmission over the internet is not entirely secure, and we cannot guarantee the security of data transmitted to our Site.

We retain personal information for as long as required by law or as necessary to fulfil the purposes for which it was collected. This includes compliance with legal, tax, and accounting requirements. We will delete Personal Information when it is no longer needed, or take steps to properly anonymise it so that you can no longer be identified from it, unless we need to keep your information to comply with legal or regulatory obligations, and in any case upon expiration of the maximum storage term set out by applicable law.

Specifically, we retain the categories of personal information described in this policy for the following periods:

You have certain rights regarding your personal information, including the right to access, correct, delete, restrict processing, and transfer data. For UK users, these rights extend to objections to certain types of data processing and filing a complaint with a supervisory authority.

To exercise these rights, contact us at the above contact details. We will respond to your request within one month (30 days) of receipt, as required under UK GDPR. Where a request is complex, or we have received a number of requests, we may extend this by a further two months, and will explain why if this is necessary.

Marketing Communications

If you no longer wish to receive marketing communications, remain on a mailing list you previously subscribed to, or receive any other communication from us, please follow the unsubscribe link in the relevant communication. Even after you opt out or update your marketing preferences, we may still contact you for transactional or informational purposes; for example, customer service issues, surveys, or questions about a specific reservation.

Please review your browser or device settings to manage cookies. See below to exercise certain choices regarding cookies.

If you have any questions or comments regarding this Privacy Policy or our privacy practices, please contact us as detailed below. You may also have a right to lodge a complaint with a supervisory authority; in the UK, the Information Commissioner's Office (ico.org.uk).

Email: hello@journey.travel
Privacy Contact: dpo-jt@journey.travel
Mailing Address: Journey HQ, Elmstone Business Park, Stoke Road, Elmstone Hardwicke, Cheltenham, GL51 9SY

Our Site uses cookies and similar technologies to enhance user experience, track interactions, and support our analytics efforts. You may control cookies by adjusting your browser settings.

Our services are not directed to individuals under 13, and we do not knowingly collect information from children. If we learn of any collection of children's information, we will take steps to delete it promptly.