Privacy Policy

1. Introduction

This Privacy Policy explains how Ruma Travel Ltd ("Ruma", "we", "us", or "our") collects, uses, stores, and protects personal data in connection with your access to and use of the Ruma Travel website, platform, and associated services (the "Platform").

Ruma is committed to protecting your personal data and respecting your privacy. This Privacy Policy is intended to provide clear and transparent information about how your personal data is handled, in accordance with applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will obtain your consent to the collection and use of your personal data.

This Privacy Policy applies to all users of the Platform, including visitors, registered users, and any individual who interacts with the Platform in any capacity.

2. Company Information and Data Controller

Ruma Travel Ltd is the data controller responsible for your personal data collected through the Platform. This means that Ruma determines the purposes for which, and the manner in which, your personal data is processed.

Ruma Travel Ltd is incorporated in England and Wales under company number 16638082, with its registered office at 167--169 Great Portland Street, 5th Floor, London, England, W1W 5PF.

For the purposes of data protection law, references in this Privacy Policy to "Ruma", "we", "us", or "our" shall be construed as references to Ruma Travel Ltd.

If you have any questions regarding this Privacy Policy or how your personal data is handled, you may contact us at support@rumatravel.co.uk.

3. Personal Data We Collect

Ruma may collect and process personal data about you in connection with your use of the Platform. The categories of personal data we collect include information that you provide directly, information collected automatically, and information obtained from third-party sources.

Personal data you provide directly may include your name, email address, account login details, and any other information you choose to provide when creating an account, contacting us, or interacting with the Platform.

In addition, the Platform allows you to input travel-related preferences and loyalty programme information, including but not limited to airline loyalty balances and travel search criteria. While such information may not always constitute personal data in isolation, it may be treated as personal data where it can be linked to an identifiable individual.

We may also collect certain information automatically when you use the Platform, including your IP address, device type, browser type, operating system, usage data, and interactions with the Platform. This information may be collected through cookies and similar technologies.

We do not intentionally collect special categories of personal data, such as data relating to health, ethnicity, or religious beliefs, and you should not provide such information through the Platform.

4. How We Collect Personal Data

Ruma collects personal data through a variety of methods depending on how you interact with the Platform.

We collect personal data directly from you when you create an account, submit information through the Platform, contact us, or otherwise provide information voluntarily. This includes any data you input into the Platform for the purpose of generating travel comparisons or recommendations.

We collect certain data automatically when you access or use the Platform. This includes technical data such as your IP address, device information, and browsing activity, which may be collected through cookies, server logs, and similar technologies.

We may also receive personal data from third-party providers where you interact with third-party services through the Platform. Such providers may include travel platforms, analytics providers, or authentication services. Any data received from such third parties will be processed in accordance with this Privacy Policy.

In all cases, Ruma seeks to ensure that personal data is collected in a lawful, fair, and transparent manner, and only to the extent necessary for the purposes described in this Privacy Policy.

5. How We Use Personal Data and Legal Basis for Processing

Ruma processes personal data only where it has a lawful basis to do so under applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR"). The legal bases on which we rely depend on the nature of the personal data and the purposes for which it is processed. Different types of personal data may be processed on different legal bases depending on the context in which the data is collected and used.

We may process your personal data where such processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract. This includes, for example, enabling you to create and manage an account, providing access to Platform features, and generating travel comparisons, valuations, and recommendations based on your inputs.

We may also process your personal data where such processing is necessary for the purposes of our legitimate interests, provided that such interests are not overridden by your rights and interests. Our legitimate interests include operating, maintaining, and improving the Platform; ensuring the security and integrity of our systems; analysing usage patterns; preventing fraud or misuse; and developing new features and services.

Where required by law, we will rely on your consent to process your personal data. This may include the use of cookies and similar technologies for analytics or performance purposes, or the sending of marketing communications where you have opted in to receive such communications. Where we rely on consent, you have the right to withdraw your consent at any time, although this will not affect the lawfulness of processing carried out prior to withdrawal.

We may process personal data where necessary to comply with legal obligations to which we are subject. This may include obligations relating to regulatory compliance, law enforcement, or the exercise or defence of legal claims.

Ruma does not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on individuals within the meaning of applicable data protection laws.

We take steps to ensure that personal data is processed only for the purposes for which it was collected and that such processing is limited to what is necessary in relation to those purposes. Where we intend to process personal data for a new purpose, we will update this Privacy Policy and, where required, notify you or obtain your consent.

6. Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies to collect and store information about your use of the Platform. Cookies are small text files that are placed on your device when you visit a website and are widely used to enable website functionality, improve performance, and provide information to website operators.

We use cookies to support the operation of the Platform, including enabling core functionality such as user authentication and session management. These cookies are necessary for the Platform to function properly and cannot be disabled without affecting your ability to use certain features.

We may also use cookies and similar technologies to collect information about how users interact with the Platform, including pages visited, time spent on the Platform, and navigation patterns. This information is used to analyse and improve the performance, usability, and functionality of the Platform.

Where applicable, we may use third-party analytics providers to assist us in understanding how users interact with the Platform. These providers may collect information about your use of the Platform through cookies or similar technologies and may process such data in accordance with their own privacy policies.

Where required by law, we will obtain your consent before placing non-essential cookies on your device. Where required by applicable law, non-essential cookies will only be placed on your device following your consent through a cookie consent mechanism. You can manage your cookie preferences through your browser settings or through any cookie management tools made available on the Platform.

You should be aware that disabling cookies may affect the functionality and performance of the Platform and may limit your ability to access certain features.

Ruma does not use cookies or tracking technologies for the purpose of collecting special categories of personal data or for engaging in intrusive profiling.

7. Sharing of Personal Data

Ruma may share your personal data with third parties where necessary for the operation of the Platform, the provision of its services, or for other legitimate purposes in accordance with this Privacy Policy and applicable data protection laws.

In particular, the Platform relies on integrations with third-party providers, including but not limited to Kayak and Odynn, as well as other travel platforms, airlines, and service providers. Where you interact with the Platform, certain data may be transmitted to such providers in order to retrieve flight information, pricing data, or loyalty programme information.

You acknowledge that such third parties operate independently of Ruma and are responsible for their own handling of personal data. Ruma does not control and is not responsible for the data processing practices of such third parties. Where you are redirected to a third-party website or service, any personal data you provide will be processed in accordance with that third party's own privacy policy and terms.

Ruma may also share personal data with service providers acting on its behalf, including hosting providers, infrastructure providers, analytics providers, and authentication services. Such providers act as data processors and are contractually required to process personal data only in accordance with Ruma's instructions and applicable data protection laws.

In addition, Ruma may disclose personal data where required to do so by law, regulation, or legal process, or where such disclosure is necessary to establish, exercise, or defend legal claims. Ruma may also disclose personal data to protect the rights, property, or safety of Ruma, its users, or others.

Ruma may share personal data in connection with a business transaction, including a merger, acquisition, financing, or sale of assets. In such circumstances, personal data may be transferred to a relevant third party as part of that transaction, subject to appropriate safeguards.

Ruma does not sell your personal data to third parties.

8. International Transfers of Personal Data

Your personal data may be transferred to and processed in countries outside the United Kingdom. This may occur where Ruma's service providers, infrastructure providers, or third-party partners are located outside the UK, or where data is stored on servers located in other jurisdictions.

Where personal data is transferred outside the UK to a country that does not provide an adequate level of data protection as determined by the UK government, Ruma will ensure that appropriate safeguards are in place to protect your personal data. These safeguards may include the use of standard contractual clauses approved under applicable data protection laws, or other legally recognised mechanisms designed to ensure an adequate level of protection.

You acknowledge that, due to the global nature of internet-based services and the reliance on third-party providers, personal data may be processed in multiple jurisdictions. While Ruma takes steps to ensure that appropriate protections are in place, the level of protection may not be identical to that provided under UK law.

Ruma will take reasonable steps to ensure that any international transfers of personal data are carried out in compliance with applicable data protection laws and that your data is treated securely and in accordance with this Privacy Policy.

9. Data Retention

Ruma retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

The period for which personal data is retained will vary depending on the nature of the data and the purposes for which it is processed. Different retention periods apply depending on the category of data and the purpose for which it is processed. In general, personal data relating to user accounts will be retained for the duration of your account and for a reasonable period thereafter to allow for account recovery, audit purposes, and the resolution of any disputes or claims.

Where personal data is no longer required for the purposes for which it was collected, Ruma will take reasonable steps to securely delete or anonymise such data. In certain circumstances, Ruma may retain personal data for longer periods where required to comply with legal obligations, to establish or defend legal claims, or to protect the rights, property, or safety of Ruma, its users, or others.

You acknowledge that, due to the nature of backup systems and technical infrastructure, it may not always be possible to immediately delete all copies of personal data, and residual copies may remain in secure backup systems for a limited period.

10. Your Rights Under Data Protection Law

Under applicable data protection laws, including the UK GDPR, you have certain rights in relation to your personal data. These rights may include the right to request access to your personal data, the right to request correction of inaccurate or incomplete data, and the right to request the deletion of your personal data in certain circumstances.

You may also have the right to request the restriction of processing of your personal data, to object to the processing of your personal data where such processing is based on legitimate interests, and to request the transfer of your personal data to another organisation in a structured, commonly used, and machine-readable format where technically feasible.

Where Ruma relies on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

You also have the right to lodge a complaint with a supervisory authority if you believe that your personal data has been processed in a manner that does not comply with applicable data protection laws. In the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO).

Ruma will respond to requests to exercise your rights in accordance with applicable data protection laws. You may exercise your rights by contacting Ruma using the contact details set out in this Privacy Policy. In certain circumstances, Ruma may be unable to comply with your request, for example where doing so would conflict with legal obligations or where exemptions apply.

11. Data Security

Ruma takes the security of personal data seriously and implements appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Such measures may include access controls, encryption, secure data storage, and procedures designed to limit access to personal data to authorised personnel only. Ruma also seeks to ensure that any third-party service providers handling personal data on its behalf implement appropriate security measures.

However, you acknowledge that no method of transmission over the internet or method of electronic storage is completely secure. While Ruma takes reasonable steps to protect personal data, it cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for taking appropriate steps to protect your own devices and systems from unauthorised access.

12. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or resources. Such third-party services are not controlled by Ruma and are subject to their own terms and privacy policies.

Where you access a third-party service through the Platform, you acknowledge that Ruma is not responsible for the privacy practices, content, or security of such services. Any personal data you provide to third parties will be processed in accordance with their own policies.

Ruma encourages you to review the privacy policies of any third-party services before providing personal data to them.

13. Changes to This Privacy Policy

Ruma reserves the right to amend, update, or modify this Privacy Policy at any time in order to reflect changes in the Platform, applicable laws or regulations, or our data processing practices.

Where such changes are material, Ruma may, at its discretion, provide notice via the Platform or by electronic communication, including email where available. However, it remains your responsibility to review this Privacy Policy periodically to ensure that you are aware of any updates.

The updated Privacy Policy will take effect from the date it is published on the Platform, unless otherwise stated. Your continued access to or use of the Platform following any such changes shall constitute your acknowledgement of the updated Privacy Policy and your acceptance of its terms, to the extent permitted by applicable law.

Where required by law, Ruma will seek your consent to any material changes in the way your personal data is processed.

14. Contact and Data Protection Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which your personal data is processed, you may contact Ruma using the details set out below.

Ruma Travel Ltd
167--169 Great Portland Street
5th Floor
London
W1W 5PF
United Kingdom

Email: support@rumatravel.co.uk

Ruma will respond to enquiries and requests relating to personal data in accordance with applicable data protection laws and within the timeframes required under such laws. Ruma has not appointed a Data Protection Officer, as it is not required to do so under applicable law. However, all data protection enquiries can be directed to the contact details provided above.