Privacy Policy

1. Overview and Data Controller

Jollystack Travel Media Ltd. ("we", "us", or "our"), incorporated in the United Kingdom under company registration number 14892014, with its registered address at 42 Queen Charlotte Street, Bristol, BS1 4HJ, is the designated Data Controller responsible for personal data processed via curviojollystack.com.

We are committed to operating transparently, adhering strictly to the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and applicable consumer privacy frameworks such as the California Consumer Privacy Act (CCPA/CPRA).

2. Data We Collect and Categories of Information

We collect only the minimum amount of personal data necessary to provide and improve our independent travel guides. Depending on how you interact with our website, this includes:

• Contact Information: When you submit a question through our contact form, we collect your full name, email address, inquiry topic, and message content.
• Technical and Device Data: IP addresses, browser types, device categories, operating system versions, and referring URLs collected through anonymous server logs.
• Cookie and Consent Data: Digital records of your cookie consent preferences stored locally on your device via browser localStorage.

3. Legal Bases and Purposes of Processing

Under GDPR Article 6, we process your personal data on the following legal bases:

• Legitimate Interests: To maintain website security, prevent spam submissions, and evaluate aggregated traffic patterns to improve our destination coverage.
• Consent: Where you have opted in to non-essential analytical cookies via our cookie banner.
• Contractual or Pre-contractual Steps: To respond directly to questions, feedback, or editorial suggestions submitted through our contact form.

4. Third-Party Data Processors and Service Providers

We do not sell, rent or monetize your personal information to marketing databases or advertising brokers. We may share limited data with vetted technical vendors that support our hosting infrastructure, such as cloud hosting providers, network firewalls, and spam prevention filters. All third-party processors are bound by strict Data Processing Agreements requiring equivalent data security standards.

5. International Data Transfers

Where technical server operations require data transfer outside the United Kingdom or the European Economic Area (EEA), transfers are governed by UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses (SCCs) to guarantee an equivalent standard of protection.

6. Data Retention and Security Measures

Contact form messages and correspondence are retained for up to twelve (12) months after resolution to maintain communication continuity, after which they are securely deleted. Server access logs are routinely anonymized or purged after ninety (90) days. We employ modern cryptographic protocols (TLS/HTTPS), strict server firewalls, and restricted administrative access to safeguard data against loss, misuse, or unauthorized alteration.

7. Your Statutory Rights (GDPR and CCPA)

Depending on your jurisdiction, you possess specific statutory rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that incorrect or incomplete data be corrected.
• Right to Erasure (Right to be Forgotten): You may request the deletion of your personal records where no overriding legal requirement exists.
• Right to Restrict or Object to Processing: You may object to data processing based on legitimate interests.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without penalty.
• Non-Discrimination: We never discriminate against any user exercising their statutory privacy rights.

8. Data Protection Officer and Privacy Requests

To exercise any of your privacy rights or to direct questions to our privacy compliance desk, please contact us at:

Email: [email protected]
Postal Address: Data Protection Desk, Jollystack Travel Media Ltd., 42 Queen Charlotte Street, Bristol, BS1 4HJ, United Kingdom.

If you are located in the UK and believe your concerns have not been addressed adequately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). Residents of the EEA may complain to their national supervisory authority.