Last updated: 24th September 2026
This privacy policy explains how wherewegoing? ("we", "our" or "us") collects and uses personal data when you use wherewegoing.co.uk or a wherewegoing? mobile app, contact us, subscribe to updates, use the customer portal, receive an itinerary, message us, make a payment, apply to become a partner or homeworker, use the admin platform, or receive a wherewegoing? email account.
wherewegoing? is the trading name of WhereWeGoing Ltd, Company No. NI737160, of 19 Glendarragh, Belfast, BT4 2WB. WhereWeGoing Ltd is the data controller and is registered with the Information Commissioner's Office under registration reference ZC159227.
For questions about this policy or to exercise your rights, contact us at hello@wherewegoing.co.uk.
The data we collect depends on how you use the website and services. It may include:
Some travel profile data, such as dietary requirements, accessibility needs or special assistance details, may reveal health, disability, religious or other special category information. Only provide what is relevant to arranging or supporting your travel. See section 4 for the additional legal requirements for using this information.
We receive information directly from you and, where relevant, from the lead booker, another authorised traveller, your Travel Engineer, a travel supplier or a payment provider. We may prefill a booking from your profile, saved companions or previous booking records. Check prefilled details each time. If you provide someone else’s information, make sure you are authorised and give them this policy. Booking on their behalf does not allow you to subscribe them to marketing.
Required fields are identified in the relevant form. We need certain identity, contact and payment information to arrange a booking; without it we may be unable to proceed. Passport details may be optional at quote acceptance but required by the supplier before travel. Optional marketing and sharing choices are separate from making a booking.
We use personal data to:
We do not sell personal data. We do not use customer portal or booking data for third-party advertising profiling.
UK data protection law requires us to have a lawful basis for each use of personal data. Depending on the context, we rely on:
Health, disability or religious information needs both a lawful basis and a separate special category condition. Simply providing this information or accepting booking terms is not explicit consent. Where we rely on explicit consent to use or share it for travel assistance, that consent must specifically cover the information and purpose. Contact us to discuss assistance requirements or withdraw consent. Withdrawal does not affect earlier lawful processing, but may mean that an assistance request cannot be arranged. Vital interests applies only in a qualifying emergency, including where the person is physically or legally unable to consent, not to routine travel arrangements.
You can object to processing based on legitimate interests and withdraw consent for consent-based processing by contacting us. We will explain any other legal basis that requires us to retain particular records.
Online card payments are processed through Protected Payment Services. Depending on the payment route, details are submitted through a hosted payment form or securely transmitted for processing. We do not store your full card number or CVV. We use the information needed to process and authenticate the payment, support the booking, reconcile transactions and handle disputes. Your bank or card provider may ask you to complete an additional authentication step.
We record payment attempts, authorisations, collections, failures, releases and refunds, including amounts, dates, references and status. An authorisation or pending payment is not necessarily a completed charge or a confirmed booking. Where applicable, we share and reconcile necessary booking and payment details with Protected Trust Services for client-money administration and supplier payment. Banking connections used for our own business reconciliation do not give us open-banking access to your personal bank account.
We use first-party cookies and browser storage to provide essential features such as sign-in, security, preferences, live chat continuity and navigation state. Online cruise checkout uses a separate essential session cookie to protect access to the booking in progress; that cookie expires after two days. Expiry of a browser cookie does not mean that the related booking or payment records have been deleted.
The mobile app stores essential session and security information on your device. It may also cache your account details and itinerary information, and it lets you choose to download itineraries and travel documents for offline access. Signing out removes the app's downloaded account and trip data from that device.
If you enable device biometrics, such as Face ID, Touch ID or Android biometric unlock, the biometric check is handled by your device. We do not receive or store your face, fingerprint or biometric template.
We do not use customer portal or booking data for third-party advertising profiling.
We collect analytics to understand site usage, traffic sources, device types and approximate locations, including cruise searches and the stages at which an online booking progresses or fails. Relevant activity can be linked to a session, quote, checkout or signed-in account; it is not all anonymous.
For the mobile app, we record authenticated app check-ins, app and build versions, notification permission and notification delivery outcomes so we can operate notifications, support customers and identify outdated or inactive installations. We do not use this information to track you across other companies' apps or websites.
Newsletters we send may include a small tracking image and links that pass through our own server before reaching their destination. When your email app loads the image we record that the newsletter was opened, and when you follow a link we record which link was used. Each record holds the campaign, your subscriber record, the link where relevant, and the time it happened; repeated opens or clicks within a few minutes are combined into one record. We do not record your IP address, device or location from these events. The records are held against your subscriber record for as long as the campaign's delivery records exist, and we report on them in aggregate to understand which newsletters are useful rather than to build a profile of you. Open counts are indicative only, because some email services load images on your behalf. If you would rather we did not measure this, set your email app not to load remote images, or unsubscribe using the link in any newsletter.
When you choose to send private app feedback, we receive your description, selected area, app version, device model, operating system and up to 20 recent screen names or failed actions. A crash confirmation may also be attached. We do not attach message contents, documents, payment details, location, passwords or request contents. These diagnostics are sent only when you choose Send. Public app ratings and reviews are submitted to Apple or Google through their store services and are separate from private feedback.
Where an online booking form uses Cloudflare Turnstile, Cloudflare receives technical information such as your IP address and browser or device signals to check for automated abuse. We receive the verification result. See Cloudflare’s privacy policy. If a security check prevents a genuine booking, contact us for assistance.
We also keep security and audit records to investigate errors, unauthorised activity, disputes and compliance questions.
We share personal data only where needed to operate the website and deliver travel services. Recipients may include:
The booking contact and authorised staff can use the traveller details needed to manage the booking. Adding someone as a traveller or saved companion does not itself grant them access to the trip. If you choose to share it, the holder of the email address you enter may receive access or an invitation. Viewers can see itinerary details, traveller names, prices, payment schedules and customer-facing documents. Check the address and document contents before sharing, especially when a family uses one email address. Unticking a later invitation choice does not remove access already granted; use the sharing controls or contact us to review access.
Travel suppliers and payment providers may act as independent data controllers for their own services and legal obligations. Their privacy notices explain that processing. Passport or other passenger information may also be supplied to immigration, border or other authorities where required for your journey.
Your trip may require information to be sent to suppliers or authorities in destination or transit countries outside the UK; technology providers may also process information abroad. The destination depends on the booking and provider. Where UK transfer rules apply, a valid transfer basis is required, such as UK adequacy regulations, appropriate contractual safeguards or a permitted exception for a necessary travel-contract transfer. Contact us for the recipients, countries and applicable safeguards for your booking, including how to obtain a copy of any relevant safeguards.
We use technical and organisational measures designed to protect personal data. These include access controls, encryption for selected sensitive data, secure authentication, audit records and staff access restrictions.
No online service can guarantee absolute security, but we work to reduce risk and limit access to people and systems with a genuine need to process the data.
We keep personal data only for as long as needed for the purpose it was collected, including service delivery, customer support, legal, accounting, audit, fraud prevention and dispute handling.
Depending on the circumstances, you may have the right to request access to your personal data, correction, deletion, restriction, portability, objection to processing, and withdrawal of consent where processing is based on consent.
You can unsubscribe from marketing emails using the unsubscribe link in those emails. You can manage app notifications through your device settings and, where available, your notification preferences in the app. You can also contact us at hello@wherewegoing.co.uk.
You can ask about your data even if another person made the booking. We may need to verify your identity before disclosing or changing records, and protect other travellers’ information when responding. Contact us about a correction, sharing concern or privacy complaint using the details above. Withdrawal of consent does not affect processing that was lawful before withdrawal.
To make a data protection complaint, email hello@wherewegoing.co.uk or write to the address in section 1, explaining your concern and how we can contact you. We will acknowledge your complaint within 30 days of receiving it, investigate without undue delay, keep you informed and explain the outcome. You do not need to use a particular form or legal wording. A request to exercise your data rights has its own statutory response deadline; the complaint acknowledgement period does not replace it.
You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
We may update this policy when our services, systems or legal obligations change. The latest version will be published on this page with its update date. Where required, we will tell you about significant changes before using your information for a new purpose. Updating this notice does not, by itself, give us consent to a new use of your data.