Privacy Policy

1. Who We Are

Hamadan International Limited is a company registered in England and Wales (Company No. 11673793), with our registered office at 214 Whitechapel Road, 1st Floor, Suite 4, London, E1 1BJ.

We are the data controller for the personal information you provide to us. If you have any questions about how we handle your data, please contact our Data Protection Officer at info@hamadaninternational.com.

2. Information We Collect

We collect and process the following categories of personal information:

2.1 Information You Provide Directly

• Identity data: Full name, date of birth, passport number, nationality
• Contact data: Email address, telephone number, postal address
• Booking data: Travel preferences, dietary requirements, accessibility needs, travel dates and destinations
• Financial data: Payment card details (processed securely via our payment provider — we do not store full card details), billing address
• Communications: Enquiries, feedback, complaints, and correspondence with our team

2.2 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, device type
• Usage data: Pages visited, time spent on pages, links clicked, referring URLs
• Cookie data: See our Cookie Policy for full details

2.3 Special Category Data

In some cases, we may process special category data to fulfil your travel arrangements — for example, health information relating to accessibility requirements, dietary needs relating to religious beliefs, or other sensitive information you voluntarily provide. We will always seek your explicit consent before processing such data and will only use it to arrange your travel.

3. How We Use Your Information

We use your personal information for the following purposes:

1. To fulfil your booking: Processing and managing your travel reservations, issuing confirmations and tickets, communicating with airlines, hotels, and tour operators on your behalf
2. To provide customer service: Responding to your enquiries, handling complaints, providing pre- and post-travel support
3. To comply with legal obligations: ATOL and ABTA compliance, HMRC reporting, fraud prevention, and anti-money laundering checks
4. To improve our services: Analysing how you use our website and services to enhance your experience
5. Marketing (with your consent): Sending you newsletters, promotional offers, and updates about destinations and services relevant to your interests
6. Safety and security: Protecting our website and systems, detecting and preventing fraud

4. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR to process your personal data:

• Contract performance: Processing necessary to fulfil your booking and travel arrangements
• Legal obligation: Processing required to comply with our legal and regulatory duties (ATOL, ABTA, HMRC)
• Legitimate interests: Fraud prevention, website security, service improvement — where these do not override your rights
• Consent: Marketing communications and special category data — you may withdraw consent at any time

5. Sharing Your Information

We may share your personal information with the following third parties:

• Travel suppliers: Airlines, hotels, car hire companies, cruise lines, and tour operators — as necessary to fulfil your booking
• Payment processors: Our secure payment provider for processing card transactions
• Regulatory bodies: ATOL, ABTA, HMRC, and other authorities when legally required
• Technology providers: Website hosting, email services, CRM systems — who are bound by data processing agreements
• Professional advisers: Solicitors, accountants, insurers — as necessary for legitimate business purposes

We do not sell your personal data to third parties. Any third party we share data with is required to keep it confidential and secure, and to use it only for the purposes for which we have shared it.

6. International Transfers

Some of our travel suppliers are based outside the UK and European Economic Area (EEA). When we transfer your data internationally to fulfil your booking (for example, to a hotel in the Maldives or an airline operating outside the UK), we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions confirming the destination country provides equivalent data protection
• Your explicit consent where required

7. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy:

• Booking records: 7 years from the date of travel (HMRC and ATOL compliance)
• Correspondence: 3 years from the date of last contact
• Marketing preferences: Until you unsubscribe or withdraw consent
• Website analytics data: 26 months (Google Analytics default)
• Financial records: 7 years (statutory requirement)

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you (Subject Access Request)
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where there is no compelling reason for continued processing
• Right to restrict processing: Request we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: We do not make any automated decisions that significantly affect you

To exercise any of these rights, please contact us at info@hamadaninternational.com or write to us at our registered address. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Cookies

We use cookies and similar tracking technologies on our website. For full details of the cookies we use, why we use them, and how to manage your preferences, please see our Cookie Policy.

10. Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or damage. These include:

• SSL/TLS encryption for data transmitted via our website
• Secure, access-controlled systems for storing personal data
• Regular staff training on data protection
• Limited access to personal data on a need-to-know basis
• Regular security assessments and updates

While we do everything we can to protect your data, no method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately.

11. Children's Privacy

Our services are not directed at children under the age of 18 without parental or guardian consent. We do not knowingly collect personal data from children. When booking travel that includes minors, the accompanying adult is responsible for providing consent on their behalf.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. The "Last Updated" date at the top of this policy indicates when it was most recently revised.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: