Privacy Policy

The controller of your personal data is Xalibur Travel OÜ, registry code 17622510, Vesivärava tn 50-201, 10152 Tallinn, Estonia, VAT EE103041636. For any question about your data, write to welcome@xaliburtravel.com or call +371 28 552 855.

We collect only the data needed to answer your request and arrange your travel:

• —Contact details: name, telephone number, e-mail address and messenger contact.
• —Request details: dates, destinations, number of guests and your preferences.
• —Booking details: names of all travellers, date of birth, nationality, passport or ID details, loyalty programme numbers — when a supplier requires them.
• —Special requirements you choose to share, such as dietary needs, accessibility or medical requirements. We process them only with your explicit consent and only to the extent the supplier needs them.
• —Invoicing and payment details for our accounting.
• —Correspondence with you by e-mail, WhatsApp or telephone.

If you provide data about other travellers, including children, please make sure they or their parents or guardians are aware of this policy.

• —To answer your enquiry and prepare proposals — steps taken at your request before a contract (GDPR Art. 6(1)(b)).
• —To book and manage hotels, flights, yachts and other services — performance of a contract (Art. 6(1)(b)).
• —To process special requirements such as health or accessibility needs — your explicit consent (Art. 9(2)(a)), which you may withdraw at any time.
• —To issue invoices and keep accounting records — legal obligation (Art. 6(1)(c)).
• —To keep in touch about your future travel, preferences and occasional updates — our legitimate interest in serving our clients (Art. 6(1)(f)); you may object at any time.
• —To verify the identity of business clients where suppliers or banks require it — legal obligation or legitimate interest.

We do not sell personal data and do not use it for automated decision-making or profiling.

We share data only when it is needed to deliver your request, and only with:

• —Travel suppliers: hotels, villa and chalet owners, airlines, aircraft and helicopter operators, yacht owners and charter agents, transfer companies and other providers you choose.
• —Our host agency Little Emperors (IATA 96020293), through which hotel bookings and partner privileges are processed.
• —Specialist partners in lifestyle and family office services — only with your agreement for each request.
• —Service providers that support our business: website hosting, e-mail, messaging, IT, banking and payment providers, accountants and legal advisers.
• —Public authorities where the law requires it.

Travel often takes place outside the European Economic Area, so data may need to be transferred to suppliers in the country of your destination. We transfer data outside the EEA only where it is necessary to perform your booking at your request (Art. 49(1)(b) GDPR) or where appropriate safeguards are in place, such as an adequacy decision of the European Commission or Standard Contractual Clauses.

• —Enquiries that did not lead to a booking: up to 24 months after our last contact.
• —Booking and client files: for as long as we work together and up to 3 years after your last trip, to handle claims.
• —Accounting documents: 7 years, as required by the Estonian Accounting Act.
• —Special category data: deleted once the related service has been completed, unless you ask us to keep your preferences.

Access to client data is limited to the people who work on your request. We use secure, password-protected systems, share passport and payment details only through secure channels and require our partners to keep your data confidential.

You have the right to:

• —access your data and receive a copy;
• —have inaccurate data corrected;
• —have your data erased, unless we are required to keep it;
• —restrict processing or object to it, including to keeping in touch;
• —receive the data you provided in a portable format;
• —withdraw your consent at any time, without affecting earlier processing.

Write to welcome@xaliburtravel.com. We will reply within one month.

Our website uses only cookies that are necessary for it to work. If we introduce analytics or marketing cookies, we will ask for your consent first and update this policy.

If you believe we have handled your data incorrectly, please contact us first — we will resolve it personally. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or with the supervisory authority in your country of residence.

We may update this policy from time to time. The current version is always published on this page, with the date of the last update.