Privacy Policy

1. Introduction

CoachTravelHub Limited ("we", "us", "our") is committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains:

• what personal data we collect about you
• how and why we use it
• who we share it with
• how long we keep it
• your rights and how to exercise them
• how we use cookies

By using the CoachTravelHub website or services, you confirm you have read and understood this policy.

2. Who We Are (Data Controller)

The data controller for personal data processed through the Platform is:

COACHTRAVELHUB LIMITED
Company Number: 17224303
Registered in England and Wales
Registered office: 33 Tavistock Mews, High Wycombe, HP12 3DG

Contact for privacy matters: support@coachtravelhub.com

We have not appointed a dedicated Data Protection Officer as we are not required to under UK GDPR. Privacy enquiries should be directed to the email address above.

3. Personal Data We Collect

3.1 Data you provide directly

When you request a quote, register, or make a booking, you may provide:

• Identity: name, date of birth (if relevant for age verification)
• Contact: email address, phone number, postal address
• Booking details: journey route, dates and times, passenger numbers, special requirements
• Payment information: card details (processed by Stripe — see clause 5)
• Communication records: messages sent through the Platform, support correspondence

3.2 Data we collect automatically

When you visit the Platform, we automatically collect:

• Technical data (from server logs): IP address, browser type and version, operating system, device identifiers
• Usage data (from server logs): pages visited, referring URL
• Location data: approximate location derived from IP address (we do not use precise GPS unless you explicitly grant permission)
• Cookie data: see clause 9

3.3 Data from third parties

We may receive data about you from:

• Operators: feedback about completed journeys, dispute details
• Stripe: payment verification status (we do not receive full card numbers)
• Our authentication provider: authentication confirmation and security signals

4. Why We Use Your Data (Purposes and Lawful Bases)

Under UK GDPR, every use of your data must have a lawful basis. Here is how we process your data and why we are allowed to:

• Processing your quote requests and bookings — Performance of a contract (UK GDPR Art 6(1)(b))
• Communicating about your bookings — Performance of a contract
• Sharing necessary details with Operators to fulfil your booking — Performance of a contract
• Account registration and authentication — Performance of a contract
• Processing refunds and cancellations — Performance of a contract / legal obligation
• Sending marketing emails (if you opt in) — Consent (UK GDPR Art 6(1)(a)); you can withdraw at any time
• Fraud prevention and platform security — Legitimate interests
• Complying with tax, accounting and legal record-keeping — Legal obligation (UK GDPR Art 6(1)(c))
• Responding to legal requests — Legal obligation

5. Who We Share Your Data With

We share data only with parties necessary to provide our services, comply with the law, or as authorised by you. We use the following categories of processors:

• Payment processor (Stripe Inc.) — processing payments, refunds, and fraud prevention. Typical location: US / UK / EU. Transfer mechanism: UK adequacy regulations / SCCs.
• Cloud database and storage providers — hosting your account data, bookings, and messages. Typical location: UK / EU / US (region-dependent). Transfer mechanism: UK adequacy / SCCs.
• Authentication and identity services — verifying user identity and managing sessions. Typical location: US. Transfer mechanism: SCCs / UK-US Data Bridge.
• Web hosting and application infrastructure — serving the website and running the application. Typical location: US (with edge nodes globally). Transfer mechanism: SCCs / UK-US Data Bridge.
• Transactional email delivery — sending booking confirmations, password resets, and notifications. Typical location: US. Transfer mechanism: SCCs / UK-US Data Bridge.
• Mapping and geocoding services — calculating routes and distances for quotes. Typical location: US / UK. Transfer mechanism: SCCs.

We can provide the specific names of these processors on written request to support@coachtravelhub.com, as part of your right to information under UK GDPR Article 15.

5.1 Coach Operators

We share necessary booking details (your name, contact details, journey information) with the approved Operator assigned to your booking. This is essential to fulfil your contract. Operators act as independent data controllers for the booking data they receive and have their own privacy obligations under UK GDPR.

5.2 Legal disclosures

We may disclose your data if required by law, court order, or to:

• comply with legal obligations
• prevent or investigate fraud
• protect the rights, property, or safety of CoachTravelHub, our users, or others

5.3 What we don't do

We do not sell your personal data to third parties. We do not share your data for unrelated third-party marketing purposes.

6. International Transfers

Some of our processors are located outside the United Kingdom (primarily in the United States). When we transfer your data outside the UK, we ensure appropriate safeguards are in place, including:

• UK adequacy regulations (where applicable, e.g., for transfers to the EEA)
• UK-US Data Bridge (the UK extension to the EU-US Data Privacy Framework, for certified US processors)
• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner

You can request a copy of the safeguards in place for any specific transfer by emailing support@coachtravelhub.com.

7. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting requirements.

• Booking data (including payment records) — 6 years from the date of the booking (UK accounting / tax requirement; statute of limitations for contract claims)
• Account data — while your account is active, plus 30 days after closure (longer if needed for tax records)
• Customer support correspondence — 2 years from last contact
• Marketing data (if you've opted in) — until you withdraw consent, or 3 years of inactivity, whichever is sooner
• Cookies — see clause 9; varies by cookie
• Operator records — 6 years from the end of the operator relationship (tax / contract records)

After these periods, data is either deleted or fully anonymised so it can no longer identify you.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

8.1 Right of access (Art 15)

You can request a copy of the personal data we hold about you.

8.2 Right to rectification (Art 16)

You can ask us to correct inaccurate or incomplete data.

8.3 Right to erasure (right to be forgotten) (Art 17)

You can ask us to delete your data in certain circumstances (e.g., when no longer needed, or you withdraw consent). Note: we may not be able to delete data we are legally required to retain (e.g., booking records for tax purposes).

8.4 Right to restrict processing (Art 18)

You can ask us to limit how we use your data, e.g., if you contest its accuracy.

8.5 Right to data portability (Art 20)

You can request your data in a machine-readable format, or ask us to transmit it to another controller.

8.6 Right to object (Art 21)

You can object to processing based on our legitimate interests, including direct marketing. We will stop unless we have compelling legitimate grounds.

8.7 Right to withdraw consent (Art 7(3))

Where we rely on consent (e.g., marketing emails), you can withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

8.8 Right not to be subject to automated decision-making (Art 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects. We do not currently use automated decision-making in this way.

8.9 Right to lodge a complaint with the ICO

If you believe we have not handled your data correctly, you have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to address your concerns first — please email support@coachtravelhub.com before contacting the ICO if possible.

8.10 How to exercise your rights

To exercise any of these rights, email support@coachtravelhub.com with:

• the right you want to exercise
• enough information to verify your identity (we may ask for additional verification)

We will respond within one month of receiving a valid request, as required by UK GDPR. We may extend this by a further two months for complex requests; we will notify you if so.

There is no charge for exercising your rights unless the request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse.

9. Cookies

9.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. We use cookies only where strictly necessary for the Platform to function.

9.2 Cookies we use

We currently use only strictly necessary cookies — these are essential for the Platform to operate and, under PECR Regulation 6(4), do not require your consent. They include:

• Session cookies set by our authentication provider (to keep you signed in)
• Security tokens (CSRF protection)
• Cookies set by our payment provider during checkout (fraud prevention)

We do not currently use analytics, functional, advertising, or other tracking cookies. If we add any of these in future, we will update this policy and seek your consent through a clear cookie banner.

9.3 Managing cookies

Because we only use strictly necessary cookies, no cookie consent banner is currently shown on the Platform.

You can manage or delete cookies at any time through your browser settings. Note that blocking strictly necessary cookies will prevent you from signing in or completing bookings.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS for all connections)
• Encryption at rest for sensitive data (database-level encryption by our hosting provider)
• Access controls limiting who can access personal data
• Payment data is processed by Stripe — we do not store full card numbers on our servers
• Authentication managed by an industry-standard third-party identity provider
• Regular security reviews of our infrastructure

No system is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee its absolute security. If we become aware of a personal data breach that poses a risk to your rights, we will notify you and the ICO as required by UK GDPR.

11. Children's Privacy

The CoachTravelHub Platform is intended for users aged 18 and over (see our Customer Terms & Conditions). We do not knowingly collect data from children under 18.

If you believe a child has provided us with personal data, please contact support@coachtravelhub.com and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, the law, or for other operational reasons.

• The current version is always available at coachtravelhub.com/privacy
• The "version" and "last updated" date at the top will reflect when changes were made
• For material changes, we will notify you by email (if you have an account) or via a prominent notice on the Platform

We encourage you to review this policy periodically.

13. Contact Us

For any questions about this policy or how we handle your data:

Email: support@coachtravelhub.com
Postal address: COACHTRAVELHUB LIMITED, 33 Tavistock Mews, High Wycombe, HP12 3DG

For complaints, you can also contact the ICO (see clause 8.9).

COACHTRAVELHUB LIMITED · Company No. 17224303 · Registered in England and Wales · Registered office: 33 Tavistock Mews, High Wycombe, HP12 3DG

Version 2.0 — Effective from 15.06.2026