Privacy Policy

Last updated: September 26th, 2026

This Privacy Policy explains how Polako Travel collects, uses and protects personal data when you visit polakotravel.com, buy a digital travel guide, book a trip, contact us or subscribe to our newsletter.

1. Who we are

Polako Travel is the controller of your personal data within the meaning of the General Data Protection Regulation (GDPR) and the UK GDPR.

  • Trade name: Polako Travel
  • Chamber of Commerce (KvK): 94134413
  • VAT number: NL003869549B42
  • Postal address: De Plevier 144, 7609 TW Almelo (NL)
  • Email: info@polakotravel.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy questions are handled directly at the address above.

2. Scope

This policy applies to polakotravel.com and to every service we provide through it, wherever you are located. It does not apply to websites we link to, such as social media platforms or the sites of our travel partners. Those have their own policies.

3. What data we collect and why

3.1 When you visit the website

Our hosting provider and our security systems record technical data: your IP address, browser type and version, device type, operating system, the pages you visit, the time of your visit and the page that referred you. We use this to keep the site running, to detect abuse and to diagnose faults.

Legal basis: our legitimate interest in a secure and functioning website (Article 6(1)(f) GDPR), and our legal obligation to secure personal data.

3.2 When you buy a digital travel guide

We collect your name, email address, billing address, country, the items you buy, the amount paid, the payment method and your order history. Your payment details, such as card or bank account data, are entered directly with our payment provider and are never stored by us.

Legal basis: performance of a contract (Article 6(1)(b) GDPR) and our legal obligation to keep accounting records (Article 6(1)(c) GDPR).

3.3 When you book a trip

For an organised trip we collect, in addition to the above: your telephone number, your date of birth, your passport details where this is needed for flights, accommodation or match tickets, the name and telephone number of an emergency contact, and any requests or notes you send us about the trip.

If you give us the details of an emergency contact or of a fellow traveller, you are responsible for informing that person that you have shared their details with us and for pointing them to this policy.

We do not ask for health information. If you choose to tell us something about your health or dietary needs so that we can take it into account, we treat that as a special category of personal data under Article 9 GDPR and we process it only with your explicit consent, only for that trip, and we delete it once the trip has ended.

Legal basis: performance of a contract, and explicit consent for any special category data.

3.4 When you contact us

Our contact form asks for your name, email address, the kind of trip you are interested in, the size of your group, your preferred period and your message. Form submissions are sent to our mailbox by email; they are not stored in a database on the website.

Legal basis: our legitimate interest in answering enquiries, or the steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

3.5 When you subscribe to our newsletter

We collect your email address and, if you give it, your name. You will receive a confirmation email and you are only added to the list once you have confirmed. Every newsletter contains an unsubscribe link that works immediately.

Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

3.6 When you create an account

We store your name, email address, password in encrypted form, address details and your order and download history, so that you can reach the guides you have bought.

Legal basis: performance of a contract.

3.7 Cookies and analytics

We use cookies and similar techniques. Analytics and marketing cookies are only placed after you have given consent through our cookie banner. Full details are in our Cookie Policy.

Legal basis: your consent, except for strictly necessary cookies, which rely on our legitimate interest.

4. How long we keep your data

  • Orders, invoices and payment records: seven years, as required by Dutch tax law.
  • Trip booking files, including passport details and emergency contacts: deleted no later than twelve months after the trip ends, except for the financial records named above.
  • Special category data you volunteer, such as dietary or medical notes: deleted as soon as the trip has ended.
  • Account data: for as long as your account exists. You can ask us to delete it at any time.
  • Contact enquiries: twenty four months after our last contact, so that we can pick up a conversation you started earlier.
  • Newsletter data: until you unsubscribe, plus a record of your unsubscribe so that we do not contact you again.
  • Technical and server logs: a maximum of twelve months.

5. Who we share your data with

We never sell your personal data. We share it only with parties who need it to deliver our service, and only under a written data processing agreement.

  • Strato: hosting of the website and its database. Servers within the European Union.
  • Mollie: processing of payments, including iDEAL, Bancontact, credit card and PayPal.
  • MailerLite: sending our newsletter.
  • Google: website statistics through Google Analytics, only after you consent.
  • Meta: measuring and targeting advertisements through the Meta Pixel, only after you consent.
  • Travel partners: for a booked trip we pass on what is strictly needed to the airlines, accommodation providers, local guides and ticket suppliers involved in that specific trip.
  • Our accountant, and public authorities where we are legally required to do so.

6. Transfers outside the European Economic Area

Our website and its database are hosted within the European Union. Some of the services listed above are provided by companies established outside the EEA, or use sub-processors that are. Where personal data is transferred outside the EEA or the United Kingdom, that transfer takes place on the basis of an adequacy decision of the European Commission, the EU-US Data Privacy Framework where the recipient is certified under it, or the European Commission's Standard Contractual Clauses combined with additional safeguards.

You may ask us for a copy of the safeguards that apply to a specific transfer by writing to the address in section 1.

7. How we protect your data

The site runs over an encrypted connection (HTTPS). Access to the administration of the website and to our mailbox is limited to people who need it and is protected by strong passwords and, where available, two factor authentication. Passwords are stored in hashed form and are never visible to us. Payment data never touches our own systems.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority within seventy two hours and, where the risk is high, we inform you directly.

8. Your rights

Under the GDPR and the UK GDPR you have the right to:

  • ask what personal data we hold about you and receive a copy of it;
  • have inaccurate data corrected;
  • have your data deleted, where we have no overriding obligation to keep it;
  • restrict how we process your data;
  • receive the data you gave us in a portable, machine readable format;
  • object to processing based on our legitimate interest;
  • withdraw consent at any time, without this affecting the lawfulness of what happened before you withdrew it.

Write to info@polakotravel.com to exercise any of these rights. We answer within one month. If your request is complex we may extend that by two months and we will tell you why. We may ask you to confirm your identity first, so that we do not hand your data to someone else.

We do not use automated decision making or profiling that produces legal effects for you.

9. Complaints

If you believe we handle your data incorrectly, please tell us first so that we can put it right. You also have the right to complain to a supervisory authority:

  • In the Netherlands: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl
  • In the United Kingdom: Information Commissioner's Office, ico.org.uk
  • Elsewhere in the EU: the supervisory authority of the country where you live or work.

10. Children

Our website and our services are not aimed at children under sixteen. We do not knowingly collect their personal data without the consent of a parent or guardian. If you believe we hold data about a child, contact us and we will delete it.

11. Changes to this policy

We may update this policy, for instance when we add a new service or a new tool. The date at the top shows when it was last changed. Substantial changes affecting your rights will be announced on the website, and where the law requires it we will ask for your consent again.

12. Contact

Questions about this policy or about your data: info@polakotravel.com.