Privacy Policy - Your Way Holiday | GDPR & CCPA Compliant

Last Updated: [28th July 28, 2026]

Your Way Holiday ("we," "our," or "us"), operated by Hangzhou Grand Voyage Travel Agency Co., Ltd. (License No. L-ZJ32739), is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you visit our website (yourwayholiday.com), use our services, or interact with us. This policy complies with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

1. Information We Collect We collect information in two ways: information you provide directly ("active collection") and information gathered automatically ("passive collection"). 1.1 Active Collection (Information You Provide) •Inquiry and booking forms: Name, email address, phone number, travel dates, destination preferences, group size, and special requirements. •Booking details: Passport information (name, number, expiry date, nationality), date of birth, and emergency contact — collected via secure channels only after booking confirmation. •Payment information: Credit card details processed through third-party payment processors (PayPal, Stripe). We do not store full credit card numbers on our servers. •Account creation: Email address and password if you create an account on our website. •Newsletter subscriptions: Email address, with your explicit opt-in consent. •Reviews and testimonials: Your name, travel details, and any content you submit — published only with your consent. •Correspondence: Any messages, emails, or phone conversations you have with our team. 1.2 Passive Collection (Automatic Data) •Browser and device data: IP address, browser type, operating system, screen resolution, and language preference. •Usage data: Pages visited, time spent on pages, referral source, and click patterns. •Cookies and tracking technologies: See Section 5 below for details. 1.3 Information from Third Parties We may receive information about you from travel partners, referral services, or social media platforms when you interact with us through those channels (e.g., logging in via Facebook or Google).

2. How We Use Your Information We use your personal information for the following purposes: •Trip planning and booking: Designing itineraries, reserving hotels, flights, trains, guides, and entrance tickets. •Customer service: Responding to inquiries, providing travel support before and during your trip, and handling post-trip feedback. •Travel documentation: Processing visas, travel permits (e.g., Tibet permits), and insurance where applicable. •Website improvement: Analyzing usage patterns to improve site functionality, content, and user experience. •Communications: Sending booking confirmations, travel updates, and (with your consent) promotional newsletters. •Legal compliance: Meeting regulatory obligations, responding to legal requests, and enforcing our terms. •Security: Detecting and preventing fraud, unauthorized access, and other security threats. We will never sell your personal information to third parties for marketing purposes.

3. Legal Basis for Processing (GDPR) For users in the European Economic Area (EEA), we process your personal data under the following legal bases: •Contract performance: Processing necessary to fulfill your travel booking (Article 6(1)(b)). •Legitimate interests: Processing for website improvement, fraud prevention, and customer service (Article 6(1)(f)), balanced against your rights. •Consent: Processing based on your explicit consent for newsletters, marketing communications, and cookie placement (Article 6(1)(a)). You may withdraw consent at any time. •Legal obligation: Processing required to comply with applicable laws (Article 6(1)(c)).

4. How We Share Your Information We share your personal information only in these limited circumstances: 4.1 Service Providers We share necessary details with trusted third-party providers who help deliver your trip: •Hotels, airlines, and train operators (name, passport details, travel dates) •Local guides and drivers (name, itinerary, special requirements) •Payment processors (PayPal, Stripe) for transaction processing These providers are contractually obligated to use your data solely for service delivery. 4.2 Legal Requirements We may disclose your information if required by law, regulation, legal process, or government request — including for national security or law enforcement purposes. 4.3 Business Transfers In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your data. 4.4 With Your Consent We may share your information in other ways when you explicitly consent or request it.

5. Cookies and Tracking Technologies Our website uses cookies and similar technologies to enhance your browsing experience. 5.1 Types of Cookies We Use •Essential cookies: Required for website functionality (session management, security, language preferences). •Analytics cookies: Google Analytics — helps us understand how visitors use our site. Data may be transferred to and stored in the United States. •Marketing cookies: Third-party advertising partners may use cookies to show relevant ads based on your browsing history. You can opt out of interest-based advertising. 5.2 Managing Cookies You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, disabling essential cookies may affect website functionality. For more information on managing cookies, visit: •AllAboutCookies.org (https://www.allaboutcookies.org) •Your Online Choices (EU) (https://www.youronlinechoices.eu) •Network Advertising Initiative (US) (https://www.networkadvertising.org)

6. Data Security We protect your personal information using industry-standard security measures: •SSL/TLS encryption: All data transmitted between your browser and our servers is encrypted via HTTPS. •Access controls: Employee access to personal data is restricted to those with a legitimate business need. All staff are bound by confidentiality obligations. •Secure payment processing: Payment data is handled by PCI-DSS compliant processors (PayPal, Stripe). We do not store full credit card numbers. •Data breach notification: In the event of a data breach that affects your personal information, we will notify you and relevant authorities within 72 hours, as required by GDPR Article 33.

7. Data Retention We retain your personal information for as long as necessary to: •Provide our services and fulfill the purposes described in this policy •Comply with legal and regulatory obligations (e.g., tax records, travel permits) •Resolve disputes and enforce our agreements Typical retention periods: •Booking records: 7 years (for tax and legal compliance) •Account data: Until you request account deletion •Newsletter subscriptions: Until you unsubscribe •Analytics data: 26 months (Google Analytics default)

8. Your Rights Depending on your location, you may have the following rights regarding your personal data: 8.1 For All Users •Access: Request a copy of the personal data we hold about you. •Correction: Request correction of inaccurate or incomplete data. •Deletion: Request deletion of your personal data (subject to legal retention obligations). •Portability: Request a portable copy of your data in a machine-readable format. 8.2 For EEA/UK Users (GDPR) •Restrict processing: Request that we limit how we use your data. •Object to processing: Object to processing based on legitimate interests or for direct marketing. •Withdraw consent: Withdraw consent at any time for consent-based processing. •Lodge a complaint: File a complaint with your local data protection authority. 8.3 For California Residents (CCPA) •Know: Request disclosure of the categories and specific pieces of personal information collected, the sources, purposes, and third parties with whom it is shared. •Delete: Request deletion of your personal information, subject to certain exceptions. •Opt out of sale: We do not sell personal information. If this changes, you will have the right to opt out. •Non-discrimination: We will not discriminate against you for exercising your CCPA rights. To exercise any of these rights, contact us at the email address below. We will respond within 30 days (GDPR: one month; CCPA: 45 days).

9. Children's Privacy Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected data from a child under 13 without proper consent, we will delete it promptly. For family bookings, we collect children's passport and date-of-birth information solely for travel documentation purposes (visas, hotel registrations, airline bookings). This data is not used for marketing.

10. International Data Transfers Your personal information may be transferred to and processed in countries outside your country of residence, including China and the United States. These countries may have different data protection standards. For transfers from the EEA, we rely on: •Standard Contractual Clauses (SCCs) approved by the European Commission •The recipient's participation in recognized data protection frameworks We ensure appropriate safeguards are in place for all international transfers.

11. Links to Other Websites Our website may contain links to third-party websites (e.g., hotel partners, attraction sites, travel blogs). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing personal information.

12. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Material changes will be communicated via: •A prominent notice on our website •Email notification to registered users The "Last Updated" date at the top of this page indicates when the most recent revision was made. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

13. Contact Us If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Your Way Holiday Hangzhou Grand Voyage Travel Agency Co., Ltd. License No. L-ZJ32739 Email: [info@yourwayholiday.com] Address: [Company Address, Hangzhou, China] For GDPR-related inquiries, you may also contact your local data protection authority: •EU Data Protection Authorities list (https://edpb.europa.eu/about-edpb/about-edpb/members_en) For CCPA-related inquiries, you may contact the California Attorney General's office.