Privacy Policy
Introduction
Please take time to read this document carefully as it contains details of the basis on which we will process (collect, use, share, transfer) and store your information. You should show this notice to all parties related to your arrangement with Bumi Adventures. If you have given us information about someone else, you are deemed to have their permission to do so.
If you have any questions or need further information you can e-mail us at info@bumiadventures.com.
Use of Information
We, Bumi Adventures, who may curate and execute bespoke travel products either on your behalf, or in conjunction with you, at all times treat all personally identifiable information strictly in accordance with European General Data Protection Regulations (GDPR) and UK GDPR with effect from 25th May 2018.
This privacy policy applies to our services used by customers or travellers where we are subject to UK or EU data protection laws, including in respect of any processing of personal information in the context of our operations in the UK or EU, or of individuals in the UK or EU where the processing relates to our offering of services to those individuals.
About Us
Bumi Adventures is a private luxury travel advisory based in London, United Kingdom. We design and curate bespoke travel experiences for individuals, families, and professional clients globally. We operate as an independent travel advisory affiliated with Fora Travel, Inc. and as its own separate travel business. References to "we", "us" or "Bumi Adventures" in this policy refer to the Bumi Adventures brand and its operators.
Bumi Adventures operates as an independent travel advisory affiliated with Fora Travel, Inc. ("Fora"), a modern host travel agency. Where personal information is collected and processed in connection with bookings made through Fora's platform, such processing is carried out in accordance with Fora's privacy practices and data protection obligations. Fora's privacy policy is available at foratravel.com. Personal information collected directly by Bumi Adventures outside of the Fora platform — such as through our website, direct correspondence, or other channels — is handled in accordance with this privacy policy and applicable data protection law.
Personal Information Collected
We may collect your personal information either directly from you when you provide your information to our services, or via our host agency platform. When you make an enquiry or booking, or otherwise interact with us in connection with our services, we will collect personal information from you in order to facilitate your enquiry or booking, manage your travel arrangements, process payments, provide customer support and comply with our legal and regulatory obligations.
When you interact with us, we may collect personal information about you, including:
ID information (including first name, last name, title, date of birth, gender, passport information and other government identifiers)
Contact details (including email address, phone number and postal address)
Transaction and booking information (including actual or potential travel dates, destinations, special requests, travel preferences, itinerary, arrangements, accommodation and transport details, loyalty and membership details where applicable, and other relevant booking information)
Payment details and history (including payment card details, billing information and transaction records)
Correspondence data (including communications between you and us)
Marketing preferences (regarding receiving marketing from us)
Technical information (including IP address, browser type, device identifier, time zone setting, operating system and geographical location)
Usage data (including pages you viewed, page response times, length of visits to certain pages, and website navigation and search terms used)
Special category data where you choose to provide it (including information about your health, nutritional requirements, medical conditions or disabilities where relevant to your travel arrangements)
Data Controller and Data Processor
We will ensure data is processed lawfully, fairly and in an open and transparent manner and ensure appropriate security measures are in place against unauthorised or unlawful processing or accidental loss, destruction or damage using appropriate technical or organisational measures (such as restricting access to key people within our organisation for certain aspects of your information; and periodically checking the level of security we apply to prevent unauthorised use, accidental loss, or misuse of your information).
The contractual arrangements we have in place with our suppliers (providers of accommodation, transport or ancillary travel services, our client database software provider, and similar providers of services to us, including any third-party companies who use our services), are governed by and shall be deemed to operate strictly in accordance with the terms of such contracts and non-disclosure agreements.
When acting as a controller of your data, we will in certain circumstances determine the purposes and means of processing your data; in particular this will include the data processed by suppliers in tailoring travel services for your specific need.
We manage and store client data across a number of secure platforms including Fora, our host agency platform which provides booking infrastructure and CRM functionality; independent CRM tools for managing client relationships and communications; website tools including forms, cookies and analytics platforms; and payment processors which may include Fora's payment infrastructure, independent third-party processors, or direct payment arrangements depending on the nature of the service.
Lawful basis for:
Collecting information about you
When we collect information about you, we may collect personal data which may include a variety of information about an individual (e.g. their name, address of residence, communication and contact details, and other personal information such as a date of birth). Where relevant to do so we may also collect information relating to an individual, indirectly by reference to an identifier (e.g. an IP address, which is a unique number identifying your computer, laptop or similar portable device).
Where required and appropriate to do so, we will also collect more sensitive personal information (such as health or dietary requirements, passport and travel document details, and other similarly sensitive information). More detail on this is provided below.
In certain circumstances (e.g. in the course of designing a bespoke itinerary to best suit your needs) we will collect information from a variety of different sources (e.g. publicly available sources, such as social media and networking sites; third party databases generally available to the wealth advisory sector; and the wider commerce and industry including other suppliers appointed in the process of handling aspects of a travel product such as ground operators or experience providers). This may include information about you regarding past experience within the travel sector.
Using information about you
We will use information, including sensitive information, about individuals and other parties related to our business activities, because it is principally:
necessary for an individual to utilise a bespoke travel product without the provision of personal data (e.g. preferences)
necessary for compliance with a legal obligation (e.g. passport details)
necessary to protect the vital interests of a data subject or another person
necessary for our own legitimate interests or those of other controllers or third parties (e.g. to search at credit or anti-money laundering agencies, monitor e-mails, calls and other communications or for market research, analysis and developing statistics) except where such interests are overridden by the interests, rights or freedoms of the data subject
These bases include, for the design of bespoke travel opportunities, provision of quotes, implementing and managing the execution of any given trip, hosting clients, follow-ups and the sharing of future opportunities that lie within the scope of a client's appetite for travel.
When processing personal data for profiling purposes, we will ensure appropriate safeguards are in place, ensuring:
processing is fair and transparent, providing meaningful information about the logic involved as well as the significance and envisaged consequences
use of only appropriate procedures for the profiling
appropriate technical and organisational measures are in place to enable inaccuracies to be corrected and minimise the risk of errors
personal data is secured in a way that is proportionate to the risk to your interests and rights and prevents discriminatory effects
We will also use your information when there is a justifiable reason for doing so, such as compliance with a legal obligation (e.g. for the prevention and detection of fraud and financial crime, which may include processes which profile you); and for the recording of all communications by any or all means for auditing reasons.
Data Storage
Our aim is to hold all our data in an electronic format. Our data is stored on secure devices and platforms that are password protected. Data held on these devices is stored on secure cloud based platforms where it is reasonable to do so. These platforms are all ISO/IEC 27001 certified or equivalent, which is recognised as one of the most widely recognised independent international security standards.
Data within our electronic storage platforms is stored in a partitioned format ensuring that only employees or other authorised agents who have appropriate need may view required data. Should for any reason we store your data in hard format (e.g. printed) it will be secured in secure filing.
Anonymous Data
We may anonymise and aggregate any of the personal information we collect about you so that it does not directly identify you. We may use anonymised information for purposes that include testing our services and related systems, research, data analysis, improving our services and developing new products and features. We may also share such anonymised information with others.
Data Retention
We will only keep and maintain information about an individual for as long as is necessary in providing our products and services or for compliance with a legal or regulatory obligation.
This means we will only keep information that is necessary to effectively deal with administrative issues, queries about past trips, enquiries for repeat business, insurance claims and compliance with legal or financial audit reasons. Usually we will keep information for a minimum retention period of 7 years and a maximum period of 40 years after cessation of a product or service we have provided.
However, we will keep information for much shorter periods if that information related merely to a quotation which did not then result in a trip being arranged. In these circumstances we will keep information for a minimum retention period of 12 months and a maximum period of 7 years unless such information becomes manifestly out-of-date.
In any event all information shall be stored in strict compliance with the GDPR legislation at all times. Using appropriate technical or organisational measures we will regularly review the length of time we keep information about you; consider the purpose or purposes why we hold the information in deciding whether and for how long to retain it; securely delete information that is no longer needed; and update, archive or securely delete information if it goes out of date.
Sharing Your Information
We will share information, including sensitive information, about you and other parties related to our products and services because it is necessary for the creation of or to take steps for you to undertake a travel itinerary or other Bumi Adventures service; necessary for compliance with a legal obligation; necessary to protect your vital interests; necessary for our own legitimate interests or those of other controllers or third parties; or necessary for a task carried out in the public interest or for an exercise of an official authority.
This includes sharing your information within Bumi Adventures as necessary and with carefully selected third parties providing a service to us or on our behalf. These include hotels, resorts, cruise lines, airlines, ground operators, experience providers, tour operators, visa and passport service providers, insurance providers, payment processors, and financial institutions with whom we have arrangements. You can write to us at info@bumiadventures.com should you wish to view a list of all insurance companies and financial institutions with whom we have arrangements.
Children
Our services are intended for use by adults aged 18 and over. Children under 18 should not make bookings or provide personal information to us directly.
Where a booking or enquiry includes a child, we may collect personal information about that child as necessary to arrange and manage the travel booking. This may include the child's name, date of birth, passport details, and dietary, medical or accessibility requirements. We usually collect this information from the person making the booking or another authorised adult. By providing this information about a child, you confirm that you have authority to do so.
We do not knowingly use children's personal information other than for the above purposes. If you have any questions about personal information we hold about a child, please contact us at info@bumiadventures.com.
What We Will Not Do With Your Information
Unless required to do so by law, or for other similar reasons, other than those outlined above under Sharing Your Information, we will never otherwise share personal information without good reason and without ensuring the appropriate care and necessary safeguards are in place. We will in any other event ask for your consent to share that information and explain the reasons. We will never sell your personal data to third parties for marketing purposes.
Sensitive Data
In carrying out our duties as Data Controller and Data Processor we may collect sensitive information about you and other parties related to our products and services where necessary for the creation of or to take steps for you to undertake a travel itinerary; necessary for compliance with a legal obligation; or necessary to protect your vital interests.
What we mean by sensitive data includes information such as an individual's health including medical conditions, dietary requirements and accessibility needs; any criminal convictions; racial or ethnic origin or religious beliefs; and passport and travel document details.
Where we process special categories of personal information, this is because you have voluntarily provided this information to us, and the processing is necessary to provide our services including meeting your travel or accessibility requirements. We will always apply additional organisational and technical measures for this category of data, including restrictions to access this data, to prevent misuse and protect personally identifiable information from improper or unjustified use or dissemination.
Use and Storage of Your Information Overseas
Due to the global nature of travel and our worldwide operations, travel undertaken with Bumi Adventures is likely to occur outside the United Kingdom and European Economic Area (EEA). In this circumstance, the transfer, storage, or processing of information about you or an individual will occur beyond the EEA for the reasons stated above under Sharing Your Information.
In any event, if we are compelled to transfer your information outside the EEA it shall be in compliance with the conditions for transfer set out under European GDPR and UK GDPR guidelines and restricted to countries which are considered to have adequate data protection laws. In any circumstance, all reasonable steps shall have been undertaken to ensure the firm to which information is being transferred has suitable standards in place to protect such information. Please note that information may be stored on secure servers within the United States, where our host agency Fora Travel, Inc. is incorporated.
Keeping Your Personal Information Secure
We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration or damage. All personal information we collect will be stored on our secure servers. Where data processing is carried out on our behalf by a third party, we take steps to ensure that appropriate security measures are in place to prevent unauthorised disclosure of personal information.
Despite these precautions, however, we cannot guarantee the security of information transmitted over the internet or that unauthorised persons will not obtain access to personal information.
Using Our Website and Cookies
You will be asked to accept a cookie, which is a small file of letters and numbers that is downloaded on to your computer when you visit our website. This will be clearly explained to you when you visit the website and you will typically have to accept the cookie to benefit from the services the website can offer.
Cookies are operated in strict accordance with European Privacy and Electronic Communications Regulations 2011 (PECR) and are widely used by many websites to primarily enable the website to remember an individual's preferences, recording information the individual may have entered on our web pages. We also use analytics tools including Google Analytics to understand how visitors use our site and to improve your experience.
These same rules also apply if any individual accesses or uses any other type of technology to gain access to information stored electronically by us, including app technology Bumi Adventures may utilise to facilitate or improve client experiences.
Interest Based Advertising
We may participate in interest-based advertising and use third party advertising companies to serve you targeted advertisements based on your browsing history and your interests. To do this, we or our advertising partners may collect information about how you use or connect to our services, or the types of other websites, social media services, content and ads that you visit or view, so that we or our advertising partners may display ads that are more relevant to your interests.
This information is typically collected through cookies and similar tracking technologies. To learn about interest-based advertising and how you may be able to opt-out, you may wish to visit Your Online Choices at www.youronlinechoices.com.
Individual Rights
Individuals have a number of rights relating to the information we hold. These rights include but are not limited to:
a copy of the personal information we hold (once requested, Bumi Adventures have up to one calendar month to provide an individual with such information)
rectify information, if it is inaccurate or incomplete
request the deletion or removal of an individual's personal data in part, or in its entirety, where there is no compelling reason for its continued processing
suppress processing of an individual's personal data; when processing is restricted, we are permitted to store the personal data, but not carry out further processes. We will retain sufficient information about the individual to ensure that the restriction is respected in future (see Marketing)
object to certain uses of an individual's personal information (see Marketing)
in certain circumstances to not be subject to a decision when it is based on automated processing and produces a legal effect or a similarly significant effect on an individual
withdraw any permission you or an individual may have previously provided
complain to the Information Commissioner's Office at any time if you or an individual is not satisfied with our use of such information
Individuals can request a copy of the personally identifiable information we hold by contacting us at info@bumiadventures.com, including the right to have such information in a portable form. We will normally provide the information free of charge (however we may apply a charge where information requests are manifestly unfounded or excessive) and will provide that information in a format that is easily accessible, including electronic formats, should an individual require it in that format.
If you would like further information or wish to make a Subject Access Request (SAR) you can e-mail info@bumiadventures.com. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or if we have received a number of requests. In this case, we will notify you and keep you updated.
Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.
Automated Decision-Making
We may use automated decision-making in limited circumstances, including to detect and prevent fraud. Our systems or those of our third party service providers may flag or restrict a transaction where suspicious patterns are identified. Where a legally or similarly significant decision is based solely on automated processing, you have the right to request human review of that decision by contacting us at info@bumiadventures.com.
Marketing
When marketing to you as an individual, we will either rely on the permission we have or we will ask for your permission (consent) to contact you, including the means to contact you (such as by phone, e-mail, WhatsApp, SMS text, Instagram, Substack, or other digital and direct channels) to tell you about:
new products or services we have or are developing
trialling products and services which we think may improve our service to you or our business processes
exclusive offers and rewards
We will typically ask for permission when you first contact us. You will maintain the right to easily withdraw such consent whenever you wish by contacting us at info@bumiadventures.com or using the unsubscribe option in any communication we send. We will regularly review any such consent to check that your relationship with us and any processing including the purposes have not changed.
We will never sell your personal data to third parties for marketing purposes.
In all situations where we market to a business we will observe both the market standards and those rules and guidelines of the Privacy and Electronic Communication regulations (PECR).
We have in place a process to ensure we refresh your consent at appropriate intervals and act on withdrawals of consent as soon as we can. We will not penalise you if you choose not to give or later decide to withdraw your consent.
Links to Third Party Sites
Our website may from time to time contain links to and from third party websites, including those of our business partners, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to the relevant data controller.
Changes to This Policy
We may update this privacy policy from time to time and so you should review this page periodically. When we change this privacy policy in a material way, we will update the date at the beginning of this privacy policy. Changes to this privacy policy are effective when they are posted on this page.
Research and Analysis
Personal information we hold may be converted into statistical or aggregated data (e.g. this is data which cannot be traced back to an individual) to produce or undertake statistical or analytical research and development work, which shall not be shared beyond Bumi Adventures. This is undertaken to enable us to optimise our marketing approach and client experience.
We may continue using personally identifiable information we may hold, specifically relating to an individual's past experiences travelling with Bumi Adventures, after trips have taken place, for processing research and analysis as above.