Exposha Privacy Policy

This policy applies whenever you interact with Exposha as a traveler, enquirer, or account holder. It covers personal data processed by Exposha Ltd and our website at exposha.com.

We do not collect more information than we need for these purposes. If you choose not to provide certain details — such as dietary requirements or travel dates — we may be unable to design a suitable escape or match you with appropriate partners.

This policy applies to all Exposha digital touchpoints, including our website, enquiry forms, personalized escape planner, travel mood quiz, account area, messaging features, and email communications with our team.

Browsing our website

When you explore destinations, experiences, travel guides, or product pages, we may collect technical data such as your IP address, device type, and pages viewed to keep the site secure and improve how it works.

Requesting a personalized escape

When you complete our multi-step planning form, we collect travel preferences — party size, dates, destinations, budget, pace, accommodation style, and contact details — so our team can design a bespoke itinerary for you.

Submitting an enquiry

When you contact us about a specific escape, destination, or experience, we collect the information you provide in your message along with your name and email so we can respond.

Creating an account or messaging us

If you register for an account or use our messaging features, we process your login credentials, profile information, and the content of your conversations with our team.

Taking our travel mood quiz

When you complete our quiz to discover escapes matched to your mood, we collect your responses and may associate them with your session or account. This helps us suggest relevant destinations and experiences — not to build unrelated advertising profiles.

Subscribing to our newsletter

When you subscribe for travel inspiration and destination updates, we collect your email address and record your consent to receive marketing communications. You can unsubscribe at any time.

Working with our travel partners

When you are ready to proceed with an itinerary, we may share relevant details with vetted hosts, hotels, guides, or experience providers — but only what they need to deliver your escape, and only with your consent where required.

The information we collect depends on how you use Exposha. We group it into the categories below so you can see exactly what we mean by each type.

We use your personal data only for defined purposes connected to designing and delivering exceptional travel experiences. We do not use your information for unrelated purposes without telling you first.

We will never send you marketing emails without your consent. Every marketing message includes a clear unsubscribe link, and opting out will not affect our ability to respond to an active enquiry or escape you are planning.

We treat your travel plans as confidential. We do not sell, rent, or trade your personal data to third parties for their own marketing. We share information only in the circumstances below, and always with appropriate safeguards.

We will always tell you before sharing sensitive information with a new partner where your consent is required. You can withdraw consent for future sharing at any time by contacting us, though this may limit our ability to complete your escape arrangements.

Vetted travel partners

When you approve an itinerary, we may share relevant details — such as your name, contact information, travel dates, party composition, and dietary or accessibility needs — with the hotels, guides, experience hosts, or tour operators involved in your escape. These partners operate under strict confidentiality agreements and may use your data only to deliver the services you have agreed to.

Payment processors

Where a payment is processed through Exposha, we use PCI-DSS compliant providers such as Stripe or PayPal. These processors handle card data according to their own privacy policies and industry security standards; Exposha does not store full card numbers.

Service providers who support our platform

We work with trusted vendors for email delivery, website hosting, analytics, and customer support tools. These providers process data on our behalf and only according to our instructions.

Legal and regulatory authorities

We may disclose information when required by law — for example, to customs or immigration authorities, tax regulators, or in response to a valid legal request.

International data transfers

Exposha is based in the United Kingdom, but our travelers and partners are worldwide. Your data may be processed in countries outside your own. Where this happens, we rely on GDPR-approved safeguards — such as Standard Contractual Clauses — to ensure your information receives equivalent protection.

We keep your personal data only for as long as we need it — to design your escape, maintain our relationship with you, or meet legal obligations. When data is no longer needed, we securely delete or anonymize it.

Active enquiries and customers

We retain your planning preferences, correspondence, and contact details for up to five years after your last enquiry or completed escape. This allows us to assist with rebooking, answer follow-up questions, and maintain records required for tax and accounting purposes.

Inactive accounts

If you create an account but do not use it for three consecutive years, we will delete or anonymize the associated personal data unless we are legally required to keep it longer.

Travel and immigration documents

Passport copies and similar documents collected for visa or immigration purposes may be retained for up to ten years where travel or immigration regulations require it.

Marketing preferences

If you unsubscribe from our newsletter, we retain a minimal record of your opt-out to ensure we do not contact you again for marketing purposes.

Whether you are planning a weekend retreat or a multi-country journey, you remain in control of your personal data. Depending on where you live — including if you are in the UK, the European Economic Area, or other jurisdictions with data protection laws — you may have the following rights:

To exercise any of these rights, email privacy@exposha.com with the subject line "Privacy Request". Please include enough information for us to verify your identity — such as the email address you used to contact us — and a clear description of your request. We will acknowledge your email promptly and respond within 30 days, as required by applicable law.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

Access and portability

Request a copy of the personal data we hold about you, in a readable format such as CSV or PDF. This includes your escape preferences, enquiry history, and correspondence with our team.

Rectification

Ask us to correct inaccurate or incomplete information — for example, a misspelled name on your itinerary or an outdated email address.

Erasure

Request deletion of your personal data, also known as the "Right to Be Forgotten". We will comply unless we are legally required to retain certain records — such as tax documents related to a completed booking.

Restrict processing

Ask us to temporarily pause how we use your data — for example, while we investigate a concern you have raised.

Object

Refuse processing based on our legitimate interests, including profiling or direct marketing. We will stop unless we have compelling legal grounds to continue.

Withdraw consent

Revoke consent at any time for health-related data processing, partner data sharing, or marketing communications. Withdrawal does not affect processing that already took place lawfully before you withdrew.

Clarity matters as much as compliance. The following practices are outside how Exposha operates:

We do not sell your data

Your travel preferences, contact details, and planning history are never sold, rented, or traded to data brokers, advertisers, or unrelated third parties for their own commercial purposes.

We do not share without purpose

Partner sharing happens only when you have approved an itinerary and consented where required. We do not disclose your details to partners you have not agreed to work with.

We do not profile you for unrelated marketing

We may suggest destinations or experiences based on preferences you share, but we do not build hidden profiles for unrelated advertising networks.

We do not retain data indefinitely

Personal data is deleted or anonymized when no longer needed, subject to legal retention requirements described in Section 5.

Trust is earned through action, not words alone. We implement technical and organizational measures designed to protect your personal data — from the moment you submit a planning form to the day your escape ends and beyond.

Encryption

Sensitive data is encrypted using AES-256 when stored and transmitted over TLS 1.2 or higher. Payment information is handled exclusively through PCI-DSS compliant gateways.

Access controls

Access to personal data within Exposha is limited on a need-to-know basis. For example, only authorized team members involved in designing your escape can view your travel preferences; payment details are restricted to authorized finance staff.

Partner due diligence

We vet travel partners before introducing them to travelers and require contractual commitments to handle shared data responsibly.

Breach notification

If a data breach poses a high risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay, explaining what happened and what steps we are taking.

Like most travel websites, Exposha uses cookies — small text files stored on your device — to keep the site working smoothly and to understand how visitors explore destinations and experiences.

You can manage cookie preferences through your browser settings at any time. When available, you may also use our Cookie Preferences dashboard to update your choices without clearing all browser data.

Essential cookies

Required for core functions such as maintaining your session, remembering form progress on the personalized escape planner, and keeping your account secure when logged in. These cannot be disabled without affecting how the site works.

Analytics cookies

Help us understand how travelers use our site — which destinations are popular, where visitors drop off in the planning form, and whether pages load correctly on mobile. These are enabled only after you opt in through our cookie banner.

Third-party cookies

Social media pixels and similar tools that measure the effectiveness of our content on platforms such as Instagram or Facebook. These are activated only with your explicit consent.

Exposha designs escapes for travelers of all ages, but our services are intended for adults making travel decisions. We do not knowingly collect personal data directly from children under the age of 16 without verified consent from a parent or legal guardian.

If you are a parent or guardian and believe your child has submitted personal information to us without your consent, please contact us at privacy@exposha.com. We will review the request and delete the information promptly where appropriate.

We may update this Privacy Policy as our services evolve — for example, if we introduce new planning tools, expand to new destinations, or change how we work with partners.

Minor changes (such as clarifying existing practices) will be posted on this page with an updated date. Significant changes — such as new ways we use your data — will be communicated by email where we hold your contact details, giving you the opportunity to review the changes before they take effect.

We encourage you to revisit this page periodically, especially before submitting a new personalized escape request.