Fora Travel Privacy Policy for UK/EEA Travellers

Last modified: August 31, 2026

Sections

At Fora Travel, Inc. (“Fora”, “we”, “us” or “our”), we are committed to protecting and respecting your privacy.

This privacy policy applies to our Services (defined below) used by customer or travellers (“you” or “your”) where we are subject to UK or EU data protection laws (whichever are applicable), including in respect of any processing of personal information:

  • in the context of a Fora establishment in the UK or EU; or
  • of individuals in the UK or EU where the processing relates to our offering of our Services to those individuals, or monitoring their behaviour as far as it takes place, in the UK or EU.

This privacy policy sets out how we collect, store, process, transfer, share and use data that identifies or is associated with you (“personal information”) when you use our website or platform, interact with our independent travel advisors in the context of our website, platform or services, or otherwise engage with us, including when you make a booking, sign up to marketing communications or enter into a commercial relationship with us (together our “Services”).

For our processing in relation to any of our other services not covered above, or where relevant US privacy laws apply, please refer to our Privacy Policy.

This privacy policy should be read alongside our Booking Terms & Conditions for UK Travellers.

Where you are providing information on behalf of another individual, such as a fellow traveller, it is your responsibility to tell them about this privacy policy and the information in it about how we may process their personal information.

Fora Travel, Inc. is a Delaware corporation with its registered office address at 228 Park Ave South #53272 New York, NY 10003-1502. We are a modern host travel agency that owns and operates a travel platform that allows independent travel advisors to manage customer enquiries and data, make and manage bookings, and access other functionality. You may make enquiries with us and book travel services with us through our independent travel advisors.

Fora is the data controller of the personal information we hold about you. For the purposes of UK data protection laws, we are registered as a data controller with the Information Commissioner’s Office under data protection registration number ZC157277.

We may collect your personal information either directly from you when you provide your information to our Services (please see the following section for further details) or via our independent travel advisors. When you make an enquiry or booking, or otherwise interact with a travel advisor in connection with our Services, that travel advisor will collect personal information from you, and share it with us so that we can facilitate your enquiry or booking, manage your travel arrangements (where necessary), process payments, provide customer support and comply with our legal and regulatory obligations.

Types of personal data collected by travel advisors

When you interact with a travel advisor, they may collect personal information about you, including:

  • ID information (including first name, last name, title, date of birth, gender, audio and visual information where provided, passport information and other government identifiers).
  • Contact details (including email address, phone number and postal address).
  • Transaction and booking information (including actual or potential travel dates, destinations, special requests, travel preferences, itinerary, arrangements, accommodation and transport details, relevant third party providers, loyalty and membership details (where applicable) and other relevant booking information).
  • Payment details and history (including, payment card details, bank account details, billing information and transaction records).
  • Correspondence data (including communications between you and us or our travel advisors).
  • Marketing preferences (regarding receiving marketing from us).
  • Technical information (including IP address, browser type, internet service provider, device identifier, your login information, time zone setting, browser plug-in types and versions, preferred language, activities, operating system and platform, and geographical location).
  • Usage data (including clickstream to, through and from the website, pages you viewed and searched for, page response times, length of visits to certain pages, referral source/exit pages, page interaction information (such as scrolling, clicks and mouse-overs), date and time pages are accessed, and website navigation and search terms used).
  • Special category data where you choose to provide it (information about your health, nutritional requirements, medical conditions, vaccination status or disabilities where relevant to your travel arrangements (“Health data”). We generally do not ask for, but you may also choose to provide us with, information about your politics, philosophical or religious beliefs or sexual orientation which, if we receive it, is also treated as special category data to which additional protections apply under data protection law.

Travel advisors typically act as separate and independent data controllers in relation to the personal data they collect. They are responsible for complying with applicable data protection laws in respect of their own processing of your personal information, including providing you with the relevant information about how they use your data and responding to your rights requests where applicable.

In practice, the categories of personal data collected by travel advisors will generally correspond to the categories of personal data described in this privacy policy, as this information is required for us to provide our Services.

However, travel advisors may collect additional information directly from you which is not shared with us or which is not for the purposes of the Services. Fora is not responsible for the processing of such information which remains the data protection responsibilities of the travel advisors.

Our Services are intended for use by adults aged 18 and over. Children under 18 should not make bookings or provide personal information to us directly through our Services.

Where a booking or enquiry includes a child, we may collect and use personal information about that child as necessary to arrange and manage the travel booking. This may include the child’s name, date of birth, passport or identity details, dietary, medical, accessibility or assistance requirements. We usually collect this information from the travel advisor, the person making the booking or another authorised adult. By providing this information about a child, you confirm that you have authority to do so.

We do not knowingly use children’s personal information other than for the above purposes. If we learn we have collected or received personal information from an individual under 18 without the involvement of a parent, guardian or other authorised adult, we will take appropriate steps, including promptly deleting that information where it is not required for a lawful purpose. If you have any questions about personal information we hold about a child, please contact us using the contact details at the end of this privacy policy.

The table at the Annex (at the end of this privacy policy) sets out the categories of personal information we collect about you and how we use that information. The table also lists the legal basis which we rely on to process the personal information.

More generally, you may provide us with personal information when you:

  1. communicate with our independent travel advisors in connection with your enquiry or booking and where those travel advisors collect and share your personal information with us in order to provide the Services;
  2. provide your contact details to make an enquiry with us, request information about us or book travel services with us through a travel advisor;
  3. provide personal information required to complete your booking;
  4. transact with us (for example, when you make a payment, or receive a refund);
  5. use our Services (including making enquiries, booking travel services, and managing or amending your booking);
  6. communicate or interact with us (whether online, through social media, or by phone or email), including when you share information with a travel advisor or with us, relating to your booking, or the Services (for example, providing booking information, feedback or responding to our surveys).

We may collect your personal data from a variety of sources, including:

  • directly from you when you use our Services, make a booking or communicate with us or a travel advisor;
  • travel service providers involved in your booking (such as tour operators, airlines, accommodation providers and transfer providers);
  • payment service providers to enable us to process payments and refunds;
  • our advertising and marketing partners, where you have interacted with our Services or marketing;
  • research providers where we conduct customer surveys or testing of our Services;
  • business partners, where we provide services jointly or in collaboration with them; and
  • automatically, including in relation to how you access and use our services, technical information regarding the device you use to access our Services and the way in which you interact with our marketing (such as whether you open these). We may also record telephone calls when you contact our customer services team by phone.

We use the information we collect about you to correspond with you, perform our agreements with you, comply with our regulatory responsibilities (such as anti-money laundering requirements), business generation, carry out marketing activities and our day-to-day business activities and operations.

We may link or combine the personal information we collect about you and the information we collect automatically. This allows us to provide you with a personalised experience regardless of how you interact with us.

We will indicate to you where the provision of certain personal information is required in order for us to provide you certain Services. If you choose not to provide such personal information, we may not be able to provide the Services you have requested, but we will notify you at the time if this is the case.

Special categories of personal information

Some of the personal information you provide to us may constitute sensitive (or “special category”) personal information (which are racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a natural person’s sex life or sexual orientation).

Where we process special categories of personal information, this is because you have voluntarily provided this information to us (for example, when making a booking or contacting us), and the processing is necessary to provide our Services, including meeting your travel or accessibility requirements. We will store such information in accordance with our data retention practices (see the Data Retention section below).

We may anonymise and aggregate any of the personal information we collect about you (so that it does not directly identify you). We may use anonymised information for purposes that include testing our Services and related systems, research, data analysis, improving our Services, promoting our Services and developing new products and features. We may also share such anonymised information with others.

We will store the personal information we collect about you for no longer than necessary for the purposes set out in the Annex (at the end of this privacy policy) in accordance with our legal obligations and legitimate business interests.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, as well as the applicable legal, regulatory, tax, accounting or other requirements.

We may share your personal information with the following categories of recipients (as required in accordance with the uses set out in the Annex):

  1. Travel advisors: we will need to share certain information about you with the travel advisor involved with your booking and as necessary to administer our relationship with the travel advisor in relation to your booking.
  2. Travel providers: we will need to share certain information about you with our third party travel providers involved in your booking (such as tour operators, airlines, accommodation providers and transfer providers) as needed as part of a booking and as necessary to administer our relationship with you in relation to your booking.
  3. Service providers: we may share your personal information with third party vendors and other service providers that perform services for us or on our behalf, which may include providing mailing, marketing, advertising, fraud prevention, credit checks, web hosting, CRM, project management, lead generation, customer support and communications, user engagement and business intelligence tools, AI support tools, data aggregation, engineering, security and support, payment gateway or analytics services.
  4. Professional advisors: we may share your personal information with our lawyers, accountants, insurers and other professional advisors to the extent we need to (for example, to defend ourselves against legal claims).
  5. Business partners: we may share your personal information (such as contact details) with our other business partners where this is necessary in the normal course of our business.
  6. Purchasers and third parties in connection with a business transaction: your personal information may be disclosed to third parties (such as buyers and their professional advisors) in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business.
  7. Research agencies (or their respective partners): if you have agreed to participate in a research group, user testing, collaboration exercise, questionnaire regarding the service, focus group or similar-type project in respect of the service, we may share certain information of yours with the research agency or our business partner (and/or their respective partner as appropriate) that requires your information as part of that project.
  8. Law enforcement, regulators and other parties for legal reasons: we may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities, unlawful activity and / or breaches of agreements; and / or (iii) exercise or protect the rights, property, or personal safety of Fora, its users, customers, travellers or others.
  9. Other members of the Fora group: (to the extent applicable) we may share your personal information with our group affiliates (for example, where they provide services on our behalf) or particularly where such sharing is otherwise necessary in accordance with the uses set out in the Annex (at the end of this privacy policy).

From time to time we may contact you with information about our Services. We may also send you information regarding our other products and services we may offer from time to time, updates, offers, discounts, newsletters and similar marketing (including related products and services of our travel partners such as accommodation providers, airlines, tours, operators and excursions) which we believe you may be interested in.

We may send marketing communications by email, SMS/text/WhatsApp message and, where permitted by law, by telephone. For some marketing messages, we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.

We will only send you electronic marketing communications if you have given us your consent to do so, unless consent is not required under applicable law. Where we make live marketing calls, we will not call you if you have told us that you do not want to receive marketing calls from us or we are not permitted to do so. Where you provide consent, you can withdraw your consent at any time, but without affecting the lawfulness of our processing based on consent before its withdrawal. In any case, you have the right to opt out of receiving electronic marketing communications from us by clicking on the ‘unsubscribe’ link contained in our marketing communications or (where available and applicable) updating your preferences in your account, or by contacting us using the details at the end of this privacy policy.

We may still send you service messages relating to your account, booking, travel arrangements or enquiries. For the avoidance of doubt, these are not marketing communications.

We participate in interest-based advertising and use third party advertising companies to serve you targeted advertisements based on your online browsing history and your interests. To do this, we or our advertising partners may collect information about how you use or connect to our Services, or the types of other websites, social media services, content and ads that you (or others using your device) visit or view or connect to our Services so that we or our advertising partners may play or display ads on our Services you may use, and on other devices you may use.

Typically, but not always, this information is collected through cookies and similar tracking technologies. We and our third party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research.

To learn about interest-based advertising and how you may be able to opt-out of some of this advertising and to limit some third party advertising cookies, you may wish to visit:

Please note that opting-out of receiving interest-based advertising through the NAI’s and DAA’s or Your Online Choices online resources will only opt-out a user from receiving interest-based ads on that specific browser or device, but the user may still receive interest-based ads on their other devices. You often must perform the opt-out on each browser or device you use.

Some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt-out again.

We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration or damage. All personal information we collect will be stored on our secure servers. Where data processing is carried out on our behalf by a third party, we take steps to ensure that appropriate security measures are in place to prevent unauthorised disclosure of personal information.

Despite these precautions, however, we cannot guarantee the security of information transmitted over the internet or that unauthorised persons will not obtain access to personal information.

The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where our affiliates and our third party service providers have operations. Please note that the information you give us or that we collect from you is stored in our secure servers within the United States. If you are located in the UK or European Economic Area (“EEA”), your personal information will therefore be transferred outside of the UK and EEA respectively to a country which is not recognised by the UK or European Commission as ensuring an adequate level of protection for personal data. These international transfers of your personal information will be made pursuant to appropriate safeguards, such as, where required, standard contractual clauses adopted by the European Commission and UK government (as applicable). If you wish to enquire further about the safeguards used, please contact us using the details set out at the end of this privacy policy.

In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

  1. Right of access. You have the right to obtain access to your personal information.
  2. Right of portability. You have the right, albeit in specific circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another data controller.
  3. Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
  4. Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not lawful or justified.
  5. Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
  6. Right to withdraw consent. If you have provided consent to any processing of your personal information, you have a right to withdraw that consent, but without affecting the lawfulness of our processing based on consent before its withdrawal.

You also have a right to object to any processing based on our legitimate interests in certain circumstances. You can also object to our direct marketing activities for any reason by clicking the “unsubscribe” link set out in any marketing communication you receive.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply. We may refuse a request for erasure, for example, where the processing is necessary to comply with a legal obligation or necessary for the establishment, exercise or defence of legal claims.

You can exercise any of your rights as described in this privacy policy and under data protection laws by contacting us using the contact details provided at the end of this privacy policy.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is manifestly unfounded or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to assist with our response. It will help us to process your request if you clearly state which right you wish to exercise, what personal information it is that is of particular concern to you and, where appropriate, why it is that you are exercising it.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or if we have received a number of requests. In this case, we will notify you and keep you updated.

We sometimes use algorithms to make decisions on our behalf. This is referred to as automated decision-making. We use automated decision-making for the following purposes:

  1. To detect and prevent fraud. Our, or our third party service providers’, algorithms may freeze a transaction or account if we suspect fraud or money-laundering against Fora, our travel advisors, customers, travellers, users or any relevant third parties. Such decisions are based on patterns in our data, such as the Fora account being used in a way that fraudsters work.

Subject to any applicable law or regulatory requirement which provides otherwise, you can ask for a member of our team to review an automated decision using the contact details set out at the end of this privacy policy. If a legal or similarly significant decision was based on automated decision-making, you can ask us to check this decision by using the contact details below.

Our Services use cookies and similar technologies to distinguish you from other users of our website. Please refer to our Cookies Policy for more information as to the way in which we use such technologies.

Our website, platform, terms and policies may, from time to time, contain links to and from third party websites, including those of our business partners, advertisers, news publications and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to the relevant data controller.

We may update this privacy policy from time to time and so you should review this page periodically. When we change this privacy policy in a material way, we will update the “last modified” date at the beginning of this privacy policy. Changes to this privacy policy are effective when they are posted on this page.

If you believe that we have processed your data in a way that does not comply with the data protection laws you have the right to complain to the relevant data protection regulator.

If you are in the UK, information on how to contact the Information Commissioner is available at www.ico.org.uk. If you are located in the EU, further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

We would, however, appreciate the chance to deal with your concerns before you approach the regulator so please contact us (using the contact details provided below). Where we receive a complaint relating to the processing of your personal data, we will acknowledge receipt of the complaint no later than 30 days from when we received the complaint and, without undue delay, take appropriate steps (making enquiries into the subject matter of the complaint, to the extent appropriate) to respond to the complaint, keeping you up-to-date on the progress and informing you of the outcome of the complaint.

If you have any questions, comments and requests regarding this privacy policy, you can contact us using one of the following methods:

By post:
FAO: Data & Privacy Officer
Fora Travel, Inc.
228 Park Ave South, Suite 53272
New York, NY 10003-1502

By email: privacy@foratravel.com

Category of personal dataPurpose of processingLawful basis for processing
  • ID information
  • Contact details
  • Transaction and booking details
  • Payment details and history
  • Correspondence data
  • To fulfil and manage your booking and travel arrangements, including via the relevant travel advisor(s) and third party travel providers.
  • To communicate with you, including providing customer support and service updates.
  • To match you with the appropriate travel advisor.
  • To process transactions, including taking payments, issuing refunds (where applicable) and maintaining records of financial transactions.
  • To manage our relationship with you and travel advisors.
  • To use other functionality in relation to the Services.
  • To perform and enforce our terms.
Such processing is necessary for the performance of our contract with you or in order to take steps at your request prior to entering into a contract. Otherwise, such processing is necessary for our legitimate interests in providing and improving our Services, and related functionality, and managing our relationship with you and travel advisors.
Health Data
Special category of personal data (see section 5)
  • To facilitate your travel arrangements and meet specific requirements.
  • To notify travel providers to ensure they are able to meet your specific requirements where required.
  • To ensure your suitability for certain travel activities where relevant.
Explicit consent where you voluntarily submitted to the travel advisor in relation to your booking.
Contact details, payment details and history, transaction and booking details and correspondence data.
  • To calculate the appropriate amounts due to us.
  • To process payments and (where applicable) refunds.
  • To retain such details for record keeping for billing, accounting, legal, regulatory and tax purposes.
  • To detect and prevent fraud and recover debts.
  • To correspond with you as appropriate and perform and enforce our terms with you.
Such processing is necessary for the performance of our contract with you. Otherwise, such processing is necessary for our legitimate interests (to recover debts due to us, keep records, correspond with you and enforce our terms).
Contact details and ID informationFraud prevention and other background checks as needed and, where necessary, share this with other financial institutions and regulatory bodies to comply with relevant laws.Compliance with a legal obligation. Otherwise, such processing is necessary for the performance of our contract with you or, if not applicable, such processing is in our legitimate interests to ensure that our Services are safe and secure and to detect, prevent or investigate unlawful acts as is necessary for reasons of substantial public interest.
  • Contact details
  • Marketing data
To send you marketing and promotional content about our Services and relevant offers.Consent or, where consent is not required under applicable law, it is in our legitimate interests to study how users use our Services and to grow and market our business.
  • Contact details
  • Technical information
  • Usage data
To share minimal details about you with our third party social media and advertising partners to more effectively personalise advertising to you.It is in our legitimate interests to study how users use our Services and to grow and market our business.
  • Contact details
  • Technical information
  • Usage data
  • To send you information regarding changes to our policies, other terms and other administrative information such as reminders, technical notices, updates and security alerts.
  • To contact you to help us with market research or to request feedback (from you or about you), with a view to improving our Services.
  • To ensure that you are provided with marketing and advertising that is in line with your preferences.
It is in our legitimate interests to ensure that any changes to our policies, terms and other such technical updates are communicated to you. It is in our legitimate interests to request feedback, or invite you or others to participate in a research (or similar) project in order to improve our Services, better understand the needs of our users, travel advisors and travellers, enhance the user experience and grow our brand.
Contact details, telephone recordings and correspondence data.To record your calls with our customer services team as permitted by law.Compliance with a legal obligation. Otherwise, to pursue our legitimate interests to establish the existence of facts relevant to the business (e.g. to keep a record of instructions given over the phone) and to monitor that our training and quality standards are being maintained.
Technical information and usage data
  • To administer our Services including resolving technical issues, troubleshooting, data analysis, testing, research, statistical and survey purposes.
  • To improve our Services to ensure that content is presented in the most effective manner for you and your computer, mobile device or other item of hardware through which you access our Services.
  • To help create and maintain a trusted and safe environment on our website.
  • To detect and prevent fraud and for data security.
  • To ensure that you are provided with marketing and advertising that is in line with your preferences.
Consent (to the extent required under applicable laws). Where consent is not required, such processing will be carried out on the basis of our legitimate interests to improve our Services, provide a safe and secure environment for our users, resolve issues for users and develop and grow our brand.
Any and all personal data mentioned above.
  • Compliance with any legal and / or regulatory requirements.
  • To exercise or protect the rights, property, or personal safety of Fora, its users, customers, travellers, staff or others.
Compliance with a legal obligation. To pursue our legitimate interests in protecting the rights, property, or personal safety of Fora, its users, customers, travellers, staff or others (including for the purpose of establishing, exercising or defending our legal rights).