Privacy Policy

1. Who we are

Time To Journey (“TTJ”, “we”, “us”) designs and delivers curated journeys and fully personal itineraries for both private and corporate clients. We also work as DMC with travel advisors and other business partners (B2B), and we sell directly to private small group travelers (B2C).

The data controller is Time To Journey, Østerled 1, DK-2100 København Ø, VAT no. 28195338. Contact: idl@timetojourney.dk, +45 2685 8683.

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you as the client have. It applies to our website www.timetojourney.dk, our communications, and our services, whether you are a traveler, a travel advisor or a business partner. Cookies are covered in our Cookie Policy.

2. Whose data we process and what we collect

Travelers who book directly with us: Name, contact details, billing address, date of birth, nationality, passport details where required, payment details (processed by our payment provider; we do not store full card numbers), travel dates and itinerary, accommodation and activity preferences, dietary requirements, emergency contact, travel companions, and anything else you share to tailor your journey.

Travelers booked through a travel advisor: The same categories, received from your advisor or from you. In this case your advisor and TTJ each handle your data for their own purposes, and your advisor’s privacy policy also applies.

Travel advisors and business partners: Name, company, role, business email and phone, communications with us, preferences, and booking history.

Special category data: Some journeys, especially wellness, healing and empowerment programs, e.g. such as our Time To Flourish and Time To Prosper, may require information about health, accessibility needs, allergies or religious dietary requirements. We collect this only when needed to provide the service safely, and only with your explicit consent or where another lawful basis applies. You can choose not to share it, but we may then be unable to tailor or offer certain experiences.

Website visitors, enquiries and subscribers: IP-address, device and browser data, pages visited, referral source, enquiry and form submissions, newsletter subscription, and cookie data.

Event and prospect contacts: business card details and notes from trade shows, meetings and outreach.

3. Why we use your data

We do not use your data for automated decision-making with legal or similarly significant effects.

4. Who we share data with

We share data only as needed and under appropriate agreements:

• Journey suppliers: hotels, guides, drivers, restaurants, activity and wellness providers, who need traveler details to deliver the service.
• Travel advisors: the advisor who booked or manages your journey.
• Service providers (processors): IT and hosting, CRM, email and newsletter tools, analytics, payment providers, accountants, insurers and professional advisors.
• Authorities: where required by law, for example border, tax or safety authorities.
• Business transfers: in the event of a merger or sale of the business, under confidentiality.

We do not sell personal data.

5. International transfers

Our journeys and providers span several countries, including the United States and countries outside the EEA/UK. Where we transfer personal data to a country without an adequacy decision, we use safeguards such as the EU-U.S. Data Privacy Framework (where the recipient is certified), Standard Contractual Clauses (with the UK Addendum where relevant), or, where permitted, your explicit consent or the need to perform your booking. You can ask us for a copy of the safeguards.

6. How long we keep data

• Booking and traveler data: until the journey is complete plus 12 months, then only what is needed for legal purposes.
• Accounting records: 5 years after the end of the financial year (Danish law).
• Health and dietary data: deleted within 3 months after the journey unless you ask us to keep it.
• Newsletter data: until you unsubscribe.
• Enquiries that do not lead to a booking: 12 months.
• Partner and prospect contacts: as long as the relationship is active, reviewed every 24 months.

We delete or anonymize data when it is no longer needed.

7. Security

We use appropriate technical and organizational measures, such as access controls, encryption in transit, and confidentiality obligations for staff and partners. No system is completely secure; if a breach affects you, we will notify you and the authorities as the law requires.

8. Your rights

EEA, UK and Switzerland. You may request access to your data, correction, deletion, restriction, or portability, and object to processing based on legitimate interests or direct marketing. Where we rely on consent, you can withdraw it at any time. You may complain to your supervisory authority: in Denmark, Datatilsynet (datatilsynet.dk); in the UK, the Information Commissioner’s Office.

United States. Depending on your state (e.g. California, Colorado, Connecticut, Virginia, Texas), you may have the right to know, access, correct and delete your personal information, to opt out of targeted advertising and the sale or sharing of personal information, to limit the use of sensitive personal information (such as health data), and not to be discriminated against for using these rights. In the past 12 months we have not sold personal information; advertising cookies, if accepted, may count as “sharing” or “targeted advertising”, which you can opt out of via our Cookie settings link or a Global Privacy Control signal. You may use an authorized agent to make a request; we may need to verify your identity. If we deny a request, you may appeal by replying to our decision.

Elsewhere. If your country gives you additional rights (e.g. Canada, Australia, Brazil), we will honor them.

To exercise any right, email idl@timetojourney.dk. We respond within one month (45 days for US requests, extendable where permitted).

9. Marketing communications

You can unsubscribe at any time using the link in our emails, on our unsubscribe page or by contacting us. Our marketing emails include our postal address and an opt-out, in line with CAN-SPAM, GDPR/ePrivacy, CASL and similar laws. Booking and service messages (such as confirmations and travel updates) are not marketing and will still be sent.

10. Children

Our website and marketing are aimed at adults. Children’s data is processed only as part of a booking made by a parent or guardian, and only as needed for the journey. We do not knowingly collect data from children under 16 without a parent’s or guardian’s involvement.

11. Third-party links

Our website may link to other sites. We are not responsible for their privacy practices.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version, and we will notify you of material changes where required.

13. Contact

Time To Journey, Østerled 1, DK-2100 København Ø, idl@timetojourney.dk, +45 2685 8683.