Privacy Policy

Who We Are

HighStreet Holidays is a trading name of Rizka Travel Limited, a company registered in England and Wales (Company No. 10763351), with our registered office at 40 Neeld Crescent, London NW4 3RR. We hold ATOL licence No. 12118, issued by the Civil Aviation Authority, and are a registered IATA TIDS member (TIDS No. 96108924).

Rizka Travel Limited is the Data Controller for the personal data collected through HighStreet Holidays. We are registered with the Information Commissioner's Office (ICO) as a Data Controller.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Our Commitment to Your Privacy

At HighStreet Holidays, we understand and respect the importance of your privacy. This Privacy Policy explains how we collect, use, store and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

All holiday packages sold through HighStreet Holidays are flight-inclusive packages fully protected under ATOL licence No. 12118. As such, we are required to collect certain personal data to fulfil our legal and contractual obligations in providing these packages to you.

What Personal Data We Collect

In operating our website and providing our luxury travel services, we may collect and process the following data about you:

• Full name and contact details, including postal address, telephone number and email address
• Passport details, nationality and date of birth (required for international flight-inclusive bookings)
• Payment information (processed securely via our payment provider; we do not store full card details)
• Travel preferences, dietary requirements and accessibility or health needs
• Details of your visits to our website, including traffic data, location data, web logs and communication data
• Information you provide when completing enquiry forms, making bookings, or subscribing to our newsletter
• Records of all correspondence when you contact us by phone, email, WhatsApp or online

Some information we collect may constitute special category (sensitive) personal data under UK GDPR, such as health or accessibility requirements needed to arrange appropriate travel. We will only collect and process such data where we have your explicit consent or where it is strictly necessary to fulfil your travel arrangements.

How We Collect Your Data

We collect personal data directly from you in the following ways:

• When you submit an enquiry through our website or contact us directly
• When you make a booking or purchase a holiday package
• When you subscribe to our newsletter or marketing communications
• When you contact our specialist team by phone, email, WhatsApp or online chat
• When you visit and interact with our website (via cookies and analytics tools)

We may also receive data from third parties, such as airline and hotel reservation systems, in connection with your travel arrangements. All such data is handled in accordance with this Policy.

Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. Depending on the purpose, we rely on the following:

• Contract: To fulfil your holiday booking and provide the flight-inclusive travel packages you have requested
• Legal obligation: To comply with ATOL regulations, financial record-keeping requirements and other applicable laws
• Legitimate interests: To improve our services, manage our business, communicate with clients and prevent fraud
• Consent: For marketing communications and the use of non-essential cookies — you may withdraw consent at any time without affecting the lawfulness of prior processing

How We Use Your Personal Data

We use your personal data for the following purposes:

• To process, manage and deliver your holiday booking and all related travel arrangements
• To communicate with you throughout the booking process, including confirmations, itineraries, updates and important notifications
• To comply with our ATOL obligations and legal requirements
• To process payments securely via our payment provider
• To respond to enquiries and provide customer service
• To send you marketing communications about special offers, new destinations and exclusive packages — only where you have consented or where we have a legitimate interest to do so
• To improve our website, services and client experience through analytics and feedback
• To detect and prevent fraud, money laundering or other unlawful activity

We will never sell your personal data to third parties.

Sharing Your Personal Data

In arranging your flight-inclusive holiday package, we are required to share certain personal data with third parties. We only share what is necessary and ensure appropriate safeguards are in place. Recipients may include:

• Airlines, hotels, cruise lines, transfer companies and other travel suppliers required to fulfil your booking
• Payment processors and financial institutions for secure payment handling
• Technology and IT service providers who support our website, booking and CRM systems
• The Civil Aviation Authority and other regulatory bodies in connection with our ATOL obligations
• Legal authorities where required by law

We do not share your personal data with third-party marketers without your explicit consent. Where we engage third-party data processors, we ensure data processing agreements are in place in line with UK GDPR requirements.

International Data Transfers

As a travel company arranging international holidays, some of your personal data will inevitably be transferred to countries outside the United Kingdom — for example, to airlines, hotels and resort operators worldwide. Where such transfers occur, we take steps to ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on UK adequacy regulations or the use of UK International Data Transfer Agreements (IDTAs) where applicable.

Data Retention

We retain your personal data only for as long as is necessary for the purposes set out in this Policy, and in line with our legal obligations:

• Booking and financial records are retained for a minimum of 7 years to comply with ATOL regulations and financial record-keeping requirements
• Marketing preferences and consent records are retained until you withdraw consent or request erasure
• Enquiry records (where no booking was made) are retained for up to 12 months
• Website usage and analytics data is retained for up to 26 months

After the applicable retention period, your data is securely deleted or anonymised.

Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request)
• Right to rectification: You may ask us to correct any inaccurate or incomplete personal data
• Right to erasure: You may ask us to delete your personal data where there is no compelling reason for us to continue processing it
• Right to restrict processing: You may ask us to limit how we use your data in certain circumstances
• Right to data portability: You may request your data in a structured, commonly used and machine-readable format
• Right to object: You may object to processing carried out on the basis of legitimate interests, or to direct marketing at any time
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at info@highstreetholidays.co.uk or in writing to the address above. We will respond within one calendar month of receiving your request. There is no charge for exercising your rights in most circumstances.

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Website Security & Cookies

We take the security of your personal data seriously and use a range of technical and administrative measures to protect it. All data transmitted via our website is encrypted using SSL/TLS technology. Secure server environments are used to store personal and financial data.

Our website uses cookies to improve your browsing experience and help us understand how visitors use our site. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy, available on our website.

External Links

Our website may contain links to third-party websites, including those of our travel partners and suppliers. This Privacy Policy applies only to the HighStreet Holidays website and our services. We are not responsible for the privacy practices of any third-party websites and encourage you to read their privacy policies before providing personal data.

Monitoring & Call Recording

To ensure accuracy, quality and security, we may monitor and/or record telephone calls and electronic communications. All recordings are stored securely and remain the sole property of Rizka Travel Limited. Recordings are used solely for training, quality assurance and dispute resolution purposes.

ATOL Protection & Your Financial Data

All flight-inclusive packages booked through HighStreet Holidays are ATOL protected under licence No. 12118 held by Rizka Travel Limited. As part of our ATOL obligations, we are required to collect and retain certain booking and financial data and may be required to share this with the Civil Aviation Authority. Full details of ATOL protection are available at www.caa.co.uk.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our data practices or our services. We encourage you to review this Policy periodically. The date of the most recent revision is shown at the top of this document. Continued use of our services following any changes constitutes your acceptance of the updated Policy.

Contact Us

For any questions, concerns or requests relating to this Privacy Policy or your personal data, please contact us: