PRIVACY POLICY

Effective Date: 22 July 2026

Version: 1.0

1. INTRODUCTION

This Privacy Policy explains how FINDMYHOLIDAYS LTD, trading as BookMyHotels ("BookMyHotels", "we", "our", or "us"), collects, uses, stores, shares, and protects your personal data when you use our website, make a hotel booking, contact our customer support team, or otherwise interact with our services.

We recognise the importance of protecting your privacy and are committed to processing your personal data fairly, lawfully, and transparently.

This Privacy Policy has been prepared in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018

Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended

Guidance issued by the UK Information Commissioner's Office (ICO)

By using our website or booking services, you acknowledge that you have read and understood this Privacy Policy.

2. WHO WE ARE

FINDMYHOLIDAYS LTD is a company incorporated in England and Wales and operates the online hotel booking platform under the trading name BookMyHotels.

• Data Controller

FINDMYHOLIDAYS LTD

Trading Name: BookMyHotels

Telephone: +44 2046100718

Email: support@bookmyhotels.co.uk

Website: https://bookmyhotels.co.uk

As the Data Controller, we determine the purposes and means of processing your personal data.

If you have any questions regarding this Privacy Policy or the processing of your personal information, you may contact us using the details above.

3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data collected through:

• our website
• mobile applications (where applicable)
• telephone bookings
• email correspondence
• online booking forms
• customer support enquiries
• promotional campaigns
• newsletters
• competitions
• surveys
• social media interactions
• business correspondence; and

any other interaction with BookMyHotels.

This Privacy Policy applies regardless of whether you are browsing our website, making a booking, requesting customer support, or communicating with us before or after travel.

4. DEFINITIONS

For the purposes of this Privacy Policy:

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation performed on personal data including collection, recording, storage, organisation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.

"Data Subject" means the individual whose personal data is processed.

"UK GDPR" means the UK General Data Protection Regulation as incorporated into the laws of England and Wales.

"ICO" means the Information Commissioner's Office.

"Supplier" means any hotel, accommodation provider, wholesaler, bedbank, channel manager, technology provider, or other third party supplying travel services through BookMyHotels.

5. PERSONAL DATA WE COLLECT

The personal information we collect depends upon the services you use.

5.1 Identity Information

We may collect:

• Full name
• Title
• Gender (where voluntarily provided)
• Date of birth
• Nationality (where required)

Passport information (only where required by accommodation providers or applicable law)

5.2 Contact Information

We may collect:

• Email address
• Telephone number
• Mobile number
• Postal address
• Billing address
• Country of residence

5.3 Booking Information

Where you make a booking, we may collect:

• Destination
• Hotel name
• Check-in date
• Check-out date
• Number of guests
• Guest names
• Room preferences
• Special requests
• Loyalty programme numbers (where applicable)
• Booking history
• Cancellation requests
• Refund information

5.4 Payment Information

Payments are processed securely by authorised third-party payment service providers.

BookMyHotels does not store complete payment card numbers or CVV security codes.

We may receive limited payment-related information including:

• Transaction reference number
• Payment confirmation
• Payment status
• Card type
• Last four digits of the payment card
• Billing country
• Fraud screening results

5.5 Technical Information

When you use our website, we may automatically collect technical information, including:

• Internet Protocol (IP) address
• Browser type and version
• Device type
• Operating system
• Time zone
• Language settings
• Referral website
• Device identifiers
• Error logs
• Website activity

5.6 Usage Information

We may collect information relating to how you use our website, including:

• Pages visited
• Searches performed
• Hotels viewed
• Time spent on pages
• Click behaviour
• Booking journey
• Navigation patterns
• Session duration

5.7 Marketing Preferences

Where you choose to receive marketing communications, we may collect:

• Newsletter subscription status
• Marketing preferences
• Consent records
• Communication history
• Promotional campaign interactions

5.8 Customer Support Information

When you contact us, we may collect:

• Correspondence
• Complaint details
• Telephone recordings (where applicable)
• Live chat conversations
• Emails
• Documents provided by you
• Evidence submitted for complaints or refunds

6. SPECIAL CATEGORY DATA

We do not intentionally collect special category personal data unless it is necessary to fulfil your booking or comply with legal obligations.

Examples may include:

• Accessibility requirements
• Medical requirements affecting accommodation
• Dietary requirements were provided to accommodation providers
• Religious accommodation requests where voluntarily disclosed

Where special category data is processed, we will do so only where permitted under UK GDPR.

7. HOW WE COLLECT YOUR PERSONAL DATA

We collect personal data from a variety of sources.

• Information You Provide Directly

This includes information provided when you:

• make a booking
• create an account
• complete online forms
• subscribe to newsletters
• contact customer support
• participate in surveys or promotions

communicate with us by telephone, email, or live chat.

• Information Collected Automatically

We automatically collect information through:

• cookies
• analytics technologies
• website logs
• advertising technologies
• device identifiers

server logs.

Further information is available in our Cookie Policy.

• Information Received from Third Parties

We may receive personal information from:

• hotel suppliers
• accommodation providers
• bedbanks
• channel managers
• payment processors
• fraud prevention providers
• identity verification services
• marketing partners

publicly available sources where lawful.

8. LAWFUL BASIS FOR PROCESSING

Under the UK GDPR, we process personal data only where a lawful basis applies.

Depending upon the circumstances, we rely on one or more of the following legal bases.

• Performance of a Contract

We process personal data where necessary to:

• process hotel bookings
• communicate with suppliers
• issue confirmations
• process amendments
• arrange cancellations
• provide customer support

process refunds.

• Compliance with Legal Obligations

We may process personal data to comply with legal obligations, including:

• accounting requirements
• taxation laws
• anti-fraud obligations
• regulatory investigations
• law enforcement requests

court orders.

• Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

These interests include:

• improving our services
• protecting our business
• preventing fraud
• securing our website
• responding to complaints
• analysing website performance

managing customer relationships.

• Consent

Where required by law, we rely on your consent for:

• email marketing
• SMS marketing
• optional cookies

personalised advertising.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

Below is Part 2 of the Privacy Policy. It continues directly from Part 1 and is drafted for FINDMYHOLIDAYS LTD t/a BookMyHotels in line with the UK GDPR, Data Protection Act 2018, and ICO guidance.

PRIVACY POLICY

PART 2

9. HOW WE USE YOUR PERSONAL DATA

We use your personal data only where we have a lawful basis to do so and only for purposes that are compatible with those for which the information was originally collected.

Depending on the nature of your interaction with BookMyHotels, we may use your personal data to:

• Booking Administration

Process hotel reservations.

Confirm bookings with accommodation providers.

Issue booking confirmations and vouchers.

Process amendments, cancellations and refunds.

Communicate important information relating to your booking.

Respond to special accommodation requests where applicable.

• Customer Service

We use your information to:

Respond to enquiries.

Resolve complaints.

Provide post-booking support.

Investigate booking issues.

Verify customer identity before discussing bookings.

Maintain records of customer communications.

• Account Management

Where you create an account, we may use your information to:

Manage your account.

Authenticate your identity.

Maintain booking history.

Save preferences.

Enable secure login.

• Payment Administration

Your information is used to:

Process payments.

Verify transactions.

Detect fraudulent activity.

Prevent unauthorised transactions.

Process refunds.

Maintain accounting records.

• Business Operations

We may process information to:

Improve our website.

Improve customer experience.

Analyse booking trends.

Monitor service quality.

Train customer service representatives.

Maintain internal business records.

• Marketing

Where legally permitted or where you have provided your consent, we may send you:

Promotional offers.

Hotel deals.

Discount campaigns.

Travel-related newsletters.

Customer satisfaction surveys.

Information about new services.

You may unsubscribe from marketing communications at any time by using the unsubscribe link in our emails or by contacting us at support@bookmyhotels.co.uk.

10. WHO WE SHARE YOUR PERSONAL DATA WITH

We treat your personal data confidentially and only share it where necessary to provide our services or comply with legal obligations.

Your personal data may be shared with the following categories of recipients.

• Accommodation Providers

To fulfil your booking, we share relevant information with:

Hotels.

Hotel chains.

Resorts.

Apartments.

Other accommodation providers.

Information shared may include:

Guest names.

Contact information.

Arrival and departure dates.

Number of guests.

Room preferences.

Special requests.

Booking references.

Only information necessary to complete your reservation will be shared.

• Travel Technology Providers

We work with various technology providers to manage hotel inventory, pricing and reservations.

These may include:

Bedbanks.

Hotel aggregators.

Channel managers.

Reservation platforms.

Distribution technology providers.

Such providers process personal information only for the purpose of facilitating your booking and providing related travel services.

• Payment Service Providers

Payments are processed by authorised third-party payment providers.

These providers process payment information securely in accordance with applicable payment security standards, including the Payment Card Industry Data Security Standard (PCI DSS).

We do not store your full payment card details or CVV security code.

• Fraud Prevention and Security

To protect our customers and business, we may share information with:

Fraud prevention agencies.

Identity verification providers.

Payment risk monitoring services.

Chargeback management providers.

These organisations assist us in identifying and preventing fraudulent or unlawful activity.

• Professional Advisers

We may disclose personal information to:

Solicitors.

Barristers.

Auditors.

Accountants.

Insurers.

Professional consultants.

Such disclosures will only occur where necessary for legitimate business or legal purposes.

• Government Authorities

Where required by law, we may disclose personal information to:

Courts.

Law enforcement agencies.

Regulatory authorities.

Government departments.

Tax authorities.

We will only disclose information where we are legally required or permitted to do so.

11. INTERNATIONAL TRANSFERS OF PERSONAL DATA

As BookMyHotels provides hotel booking services worldwide, your personal information may be transferred to countries outside the United Kingdom.

Examples include transfers to:

Hotels located outside the UK.

International accommodation providers.

Technology service providers.

Payment processors.

Cloud hosting providers.

Whenever personal data is transferred internationally, we take appropriate measures to ensure that your information remains protected.

These safeguards may include:

The UK International Data Transfer Agreement (IDTA).

The UK Addendum to the EU Standard Contractual Clauses.

Transfers to countries recognised by the UK Government as providing an adequate level of data protection.

Other lawful transfer mechanisms permitted under UK GDPR.

12. PAYMENT PROCESSING

Payments made through BookMyHotels are processed securely using authorised third-party payment service providers.

We do not store:

Full payment card numbers.

CVV security codes.

PIN numbers.

Payment providers may process:

Cardholder name.

Billing address.

Transaction amount.

Card type.

Payment status.

Fraud screening information.

All payment transactions are encrypted using industry-standard security measures.

13. FRAUD PREVENTION

To protect our customers, suppliers and business, we employ fraud prevention measures.

These may include:

Transaction monitoring.

Device analysis.

IP address verification.

Behavioural analysis.

Payment risk assessment.

Chargeback monitoring.

Identity verification.

Where necessary, we may refuse or cancel bookings where fraudulent activity is suspected.

14. LEGAL DISCLOSURES

We may disclose personal information where necessary to:

Comply with legal obligations.

Respond to lawful requests from public authorities.

Protect our legal rights.

Prevent fraud or financial crime.

Enforce our Terms and Conditions.

Protect the safety of customers, employees or the public.

15. THIRD-PARTY SERVICE PROVIDERS

We engage trusted third-party service providers to support our business operations.

These providers may include organisations offering:

Cloud hosting.

Customer support software.

Email delivery services.

Website hosting.

Analytics services.

Payment processing.

Fraud prevention.

IT support.

Security monitoring.

All service providers are required to process personal data only on our instructions, maintain appropriate security measures and comply with applicable data protection laws.

16. BUSINESS TRANSFERS

If FINDMYHOLIDAYS LTD undergoes a merger, acquisition, restructuring, sale of assets or other corporate transaction, personal data may be transferred as part of that transaction.

Any successor organisation will continue to process your personal data in accordance with applicable data protection laws and this Privacy Policy, unless you are notified otherwise.

Certainly. Below is the final part of your Privacy Policy. Together, Parts 1–4 form a comprehensive Privacy Policy for FINDMYHOLIDAYS LTD t/a BookMyHotels, suitable for publication on your website and aligned with the UK GDPR, Data Protection Act 2018, and PECR.

PRIVACY POLICY

PART 4 (FINAL)

26. AUTOMATED DECISION-MAKING AND PROFILING

BookMyHotels does not make decisions that produce legal or similarly significant effects based solely on automated processing, including profiling, without appropriate human involvement.

We may use automated systems to support our business operations, including:

Fraud detection and prevention.

Payment risk assessment.

Website security.

Booking verification.

Personalisation of website content (where applicable and permitted by law).

These systems are used to assist our staff and improve the security and efficiency of our services. Decisions that may significantly affect you will not be made solely by automated means unless permitted by applicable law or based on your explicit consent.

27. CHILDREN'S PRIVACY

Our website and services are intended for individuals aged 18 years or older.

We do not knowingly collect personal data directly from children under the age of 18.

Where a booking includes a child, the child's personal information must be provided by a parent, legal guardian or another adult authorised to make the booking.

If we become aware that personal data has been collected directly from a child without appropriate authorisation, we will take reasonable steps to delete that information unless we are legally required to retain it.

28. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites, including hotels, travel partners, payment providers and other external services.

These websites operate independently from BookMyHotels and have their own privacy policies and terms of use.

We are not responsible for the privacy practices, content or security of third-party websites. We encourage you to read the privacy policies of any third-party websites you visit before providing your personal information.

29. DATA ACCURACY

We take reasonable steps to ensure that the personal data we hold is accurate, complete and, where necessary, kept up to date.

You are responsible for ensuring that the information you provide to us is accurate and for notifying us promptly of any changes to your personal information.

30. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

Changes in applicable laws or regulations.

Updates to our services or business operations.

Changes in technology.

Improvements to our data protection practices.

Where changes are significant, we will take appropriate steps to notify you, such as by posting a notice on our website or, where appropriate, by contacting you directly.

The latest version of this Privacy Policy will always be available on our website and will include the effective date shown at the beginning of the document.

31. CONTACTING US

If you have any questions about this Privacy Policy, wish to exercise your rights under the UK GDPR, or have concerns about how we process your personal data, please contact us:

FINDMYHOLIDAYS LTD

Trading Name: BookMyHotels

Telephone: +44 2046100718

Email: support@bookmyhotels.co.uk

Website: https://bookmyhotels.co.uk

We will acknowledge your enquiry and aim to respond within the time limits required by applicable law.

32. COMPLAINTS

If you are dissatisfied with how we have handled your personal data or believe that we have not complied with applicable data protection laws, we encourage you to contact us first so that we have the opportunity to resolve your concerns.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

• Information Commissioner's Office
• Wycliffe House
• Water Lane
• Wilmslow
• Cheshire

SK9 5AF

• United Kingdom

Telephone: 0303 123 1113

Website: https://ico.org.uk

Lodging a complaint with the ICO does not affect any other legal rights or remedies that may be available to you.

33. GOVERNING LAW

This Privacy Policy shall be governed by and construed in accordance with the laws of England and Wales.

Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales, unless mandatory consumer protection laws provide otherwise.

34. SEVERABILITY

If any provision of this Privacy Policy is found by a court or competent authority to be unlawful, invalid or unenforceable, the remaining provisions shall remain in full force and effect.

35. NO WAIVER

Any failure or delay by BookMyHotels to exercise or enforce any right or provision under this Privacy Policy shall not constitute a waiver of that right or provision.

36. ENTIRE PRIVACY POLICY

This Privacy Policy forms the entire statement of our privacy practices relating to the collection, use, disclosure and protection of personal data by FINDMYHOLIDAYS LTD trading as BookMyHotels.

Where applicable, this Privacy Policy should be read together with our:

• Terms and Conditions
• Cookie Policy
• Cookie Preferences
• Website Terms of Use

37. EFFECTIVE DATE

Effective Date: 22 July 2026

This Privacy Policy remains in force until replaced by a revised version published by FINDMYHOLIDAYS LTD.