Last updated: June 18, 2026

WorldVacays (“we”, “us”, “our”) operates worldvacays.com (the “Service”). This policy explains how we collect, use, and protect personal data when you use our Service. It applies globally and complies with India’s Digital Personal Data Protection Act 2023 (DPDP Act), the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA).

1. Information We Collect

1.1 Information you give us

When you submit a form or email us, we collect: name, email address, phone (optional), trip details you share (destinations, dates, group size, budget, preferences), and any other information you voluntarily provide.

1.2 Information collected automatically

When you visit: IP address, approximate location (city level), browser type, pages visited and duration, referrer URL, device type. This is collected via Google Analytics. It is aggregated, not used to personally identify you.

1.3 Cookies

See our Cookie Policy for details.

2. How We Use Your Information

• Respond to enquiries and deliver itineraries you’ve requested
• Send email updates if you’ve subscribed (you can unsubscribe anytime)
• Improve our Service based on aggregate usage patterns
• Comply with legal obligations

We do not sell your data, share your trip details with hotels/airlines, or use your information to advertise to you on other websites.

3. Legal Basis for Processing

• Consent — when you submit a form or subscribe to our newsletter
• Contract — when you hire us for itinerary planning, processing your data is necessary to deliver the service
• Legitimate interest — for aggregated analytics that improve our content and Service
• Legal obligation — where required by law

4. Affiliate Links

We contain affiliate links. When you click them, the destination platform (Booking.com, Amazon, etc.) may set its own cookies and collect data per its own privacy policy. We have no control over their data practices. See our Affiliate Disclosure.

5. Third-Party Services

• Google Analytics & Search Console (anonymized usage)
• WordPress hosted on Hostinger (site operation)
• WPForms (form submissions)
• SureMail / Google Workspace (email)
• Razorpay (payment processing for India)
• Affiliate partners (set their own cookies on click-through)

6. Data Retention

• Enquiry form data: up to 24 months
• Newsletter subscribers: until you unsubscribe
• Analytics: 14 months (Google Analytics default)
• Payment records: 8 years (Indian tax law requirement under section 44AA of the Income Tax Act)

7. Your Rights

Regardless of where you live, you have the right to:

• Access personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for marketing emails
• Object to certain processing
• Lodge a complaint with your local data protection authority

Indian residents (DPDP Act 2023)

You may exercise your rights as a “Data Principal” under the DPDP Act, including the right to nominate another individual to exercise rights on your behalf in the event of incapacity. Complaints can be lodged with the Data Protection Board of India.

EU/UK residents (GDPR)

You have rights under Articles 15–22 of the GDPR including data portability. Complaints to your local supervisory authority (e.g., ICO in the UK).

California residents (CCPA)

We do not sell personal information. You have the right to know, the right to delete, and the right to non-discrimination.

To exercise any right, email info@worldvacays.com. We respond within 30 days.

8. Children’s Privacy

Our Service is not directed at children under 18. We do not knowingly collect data from children. Indian residents: parental consent is required to process data of children under 18 per the DPDP Act. If you believe a child has provided data, contact us so we can delete it.

9. Data Security

We use HTTPS encryption on all pages and access controls on form submissions. However, no internet transmission is 100% secure. In the event of a data breach affecting your personal data, we will notify you and the relevant authority within 72 hours of becoming aware, in compliance with DPDP and GDPR.

10. International Data Transfers

Our site is hosted by Hostinger; some services (Google Analytics, etc.) may transfer data to other countries. Where required, we rely on standard contractual clauses or equivalent safeguards.

11. Changes

We may update this policy. The “Last updated” date reflects the current version. Material changes will be notified on the site.

12. Contact & Grievance Officer

For privacy questions or to lodge a grievance: info@worldvacays.com.

Per the DPDP Act, our Grievance Officer can be contacted at the same email. Indian residents: if not resolved within 30 days, you may escalate to the Data Protection Board of India.

WorldVacays — Operated from India.