GDPR Compliance

Last Updated: June 2026

brisk-vine is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR). This page explains how we handle your personal data in accordance with GDPR requirements.

Data Controller

brisk-vine acts as the data controller for personal information collected through our services. We determine the purposes and means of processing your personal data.

Contact Details:
brisk-vine
127 Colmore Row
Birmingham, B3 3AG
United Kingdom
Email: [email protected]

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary to fulfill travel service agreements with you
• Legitimate Interests: Operating our business efficiently and improving services while respecting your rights
• Legal Obligations: Complying with financial record-keeping and tax requirements
• Consent: Where you have explicitly agreed to specific processing activities such as marketing communications

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format.

Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction.

Right to Erasure

You can request deletion of your personal data when it is no longer necessary for the purposes collected, subject to legal retention obligations.

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You can request to receive your personal data in a structured, machine-readable format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. We will respond to your request within one month, though this may be extended to two months for complex requests.

We may require proof of identity before fulfilling requests to protect your personal information from unauthorized access.

Data Processing Activities

We process personal data for the following purposes:

• Managing travel bookings and service delivery
• Communicating with customers about reservations and services
• Processing payments through secure third-party processors
• Responding to inquiries and providing customer support
• Improving our services based on customer feedback
• Complying with legal and regulatory requirements

Data Sharing

We share personal data only when necessary:

• Service Partners: Hotels, transportation providers, and tour operators who deliver services you have booked
• Payment Processors: Third-party payment providers who handle transaction security
• Legal Authorities: When required by law or to protect our legal rights

When we share data with third parties, we ensure appropriate safeguards are in place to protect your information.

International Data Transfers

Your personal data is primarily processed within the United Kingdom and European Economic Area. If we transfer data outside these regions, we ensure adequate protection through approved transfer mechanisms such as Standard Contractual Clauses.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined or as required by law. Typical retention periods include:

• Booking records: 7 years (financial and legal requirements)
• Marketing consent records: Until consent is withdrawn plus 1 year
• Customer inquiries: 2 years after final communication

Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments.

Complaints

If you believe we have not complied with GDPR requirements, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO Contact Information:
Website: ico.org.uk
Telephone: 0303 123 1113

Updates to This Notice

We may update this GDPR compliance notice periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.