Privacy Policy

When you use our services, you’re trusting us with some real personal information: where you’re from, who you’re travelling with, sometimes dietary or accessibility details. We don’t take that lightly, and we’ve written this to actually be readable, not just legally sufficient. It covers rooetd.com and, once it launches, our app ("our platforms," below).

A note on what’s live today versus what’s coming: references in this policy to our app describe functionality we may introduce in future; when it launches, we’ll update this policy and any relevant permissions to reflect the technologies it actually uses. The same goes for any future AI-assisted features, live payment processing, analytics tools, and marketing platforms mentioned below; we say clearly, in the relevant section, whether something is running today or is still to come.

The quick version

• We’re Mauj Lo Roj Lo Ltd, trading as Rooetd (a small UK company), and we’re responsible for your data. No dedicated data protection officer yet; it’s handled personally, by us, directly.
• We collect what you give us (name, email, phone, trip preferences, dietary needs) when you enquire, use our trip-quiz, or set up an app account, plus a little automatic data about how you found us.
• We use it to reply to you, build your itinerary, and (only if you say yes) understand which marketing actually works.
• We share the minimum needed with our India-based ground partners (hotels, guides, drivers) once you book, and with the handful of tools that run our platforms.
• We do not sell your personal data. Not to anyone, not ever.
• We generally keep your data for 18 months, then delete it: see below for the exceptions.
• You can ask what we hold, correct it, delete it, or take it elsewhere, any time: hello@rooetd.com or datahandling@rooetd.com.

The rest of this page is the full version, which is the one that legally governs.

2. What we collect

In short: pretty much just what you tell us when you enquire or book, plus a little basic technical data needed to run the site.

Information you give us directly

• Contact details: name, email, phone number (only if you choose to share it)
• Trip details: destination interests, group size and composition, travel dates or windows, budget range, dietary needs, any accessibility needs you mention, and any free-text notes you add. Some information you provide, particularly health-related dietary requirements or accessibility information, may amount to "special category data" under Article 9 UK GDPR. Where that applies, we identify an appropriate Article 9 condition alongside our ordinary lawful basis for processing (see clause 3); where we rely on explicit consent, we ask for that separately and clearly.
• Payment details, once we’re able to take payment: handled directly by our payment provider: see clause 4. We don’t collect or store full card numbers ourselves.
• Trip-quiz answers: we use the answers you give the trip quiz to provide the recommendation you asked for. Your matched trip is also saved automatically in your browser's local storage on your own device, so it can pre-fill a later enquiry if you come back to finish it; this never reaches us unless you actually submit the enquiry form. See our Cookie Policy for exactly how this is stored. Nothing about the quiz is used to build an advertising profile of you, sell the results, or use them for anything beyond the thing you asked it to do.
• App account details, once the app exists: whatever’s needed to create and secure your account
• Anything you send us by email or phone while planning a trip

A note on passports: we don’t collect or store passport copies through our platforms at this stage. As a standing caution, wherever passports come up across our site: make sure yours is valid for at least 6 months beyond your return date; that’s the international standard, and it’s worth checking early rather than at the airport.

Information collected automatically

• Marketing attribution: which campaign, link, or search brought you to us, stored only with your consent: see our Cookie Policy
• Approximate location from your network connection (city/region level, not GPS), used only to set currency display
• Standard technical logs from our hosting provider (IP address, browser or device type, pages/screens visited), kept only as long as needed for security and reliability
• Where a page embeds a YouTube video, the preview thumbnail is served from our own servers, so Google doesn’t see anything until you actively choose to press play: at which point YouTube (Google) may receive your IP address. See our Cookie Policy for exactly what this involves. We don’t embed Google Maps or load fonts from Google’s own servers anywhere on our platforms: our fonts are self-hosted, and our interactive map is self-hosted too, so no third-party mapping provider is used

We don’t collect health or medical information beyond what you volunteer as a dietary or accessibility need for trip-planning purposes.

3. Why we use it, and on what legal basis

In short: everything we do with your data has a genuine, specific reason behind it: here’s exactly what, and the legal basis the law requires us to name.

No automated decision-making or profiling that has a legal or similarly significant effect on you happens here today. The trip-quiz gives you a suggestion, not a decision; a real person looks at your enquiry before anything’s proposed. We may introduce additional automated or AI-assisted features as Rooetd develops; where these materially affect how we assess, recommend, or make decisions about you, we’ll update this policy and provide the information and safeguards required by applicable law.

4. Who we share it with

In short: only the people who genuinely need it to deliver your trip or run the business: never sold, never handed to marketers.

We share personal data only where it’s genuinely needed to run Rooetd, and we never sell it.

• India-based ground partners (the specific hotels, guides, drivers, and destination management companies delivering your trip): once a trip’s confirmed, we pass on what each of them individually needs (typically your name, dates, and any relevant special requirement), not your full file. Where personal data is transferred to them, we use a UK International Data Transfer Agreement (or equivalent safeguard): see clause 5.
• Website, app, and email infrastructure: Cloudflare, Inc., under Cloudflare’s standard Data Processing Addendum.
• Payment processor, once customer payments are enabled: will process your payment details on our behalf; we won’t store full card numbers ourselves.
• Marketing/newsletter platform, once selected: used only if and when you opt in to marketing emails.
• Third-party embeds (see clause 2 and our Cookie Policy): providers whose content is embedded directly on our platforms may receive limited technical data (like your IP address) when that content loads, independently of us.
• Professional advisers (accountants, insurers, lawyers) where needed to run the business.
• Regulators and law enforcement, where legally required.
• A prospective buyer, in the unlikely event of a sale, bound by confidentiality equivalent to this policy.

We don’t share your data with data brokers, advertising networks, or anyone chasing it for their own marketing.

5. International transfers

In short: some of your data travels to India along with your trip: we put proper safeguards around it when it does.

Some organisations we work with are based outside the UK, so your data may travel internationally. UK law requires extra safeguards whenever that happens to a country the UK hasn’t recognised as "adequate"; India is one of those.

Where UK law requires safeguards for a transfer like this, we use an appropriate lawful transfer mechanism (such as a UK International Data Transfer Agreement (IDTA) or the equivalent EU Standard Contractual Clauses with the UK Addendum) together with a transfer risk assessment and contractual safeguards, before making the transfer.

What this means in practice: personal data about our UK (and other) customers (typically your name, dates, and any relevant special requirement) is shared with our India-based ground partners so they can actually deliver your trip. India has its own data protection law, the Digital Personal Data Protection Act 2023; our ground partner agreements are expected to reflect their obligations under that law, on top of the safeguards we put in place under UK GDPR.

Cloudflare may process data outside the UK as part of its global network; this is governed by Cloudflare’s standard contractual transfer safeguards as part of our agreement with them.

6. How long we keep it

In short: 18 months for most things; financial records for as long as the law requires (currently around 6 years): that’s the law, not us.

Our general rule: 18 months. Our current general retention period for inactive enquiries, quiz responses, and general customer records is 18 months from your last meaningful interaction with us, after which we delete or anonymise it. We may keep specific information for longer where necessary to meet legal, tax, accounting, regulatory, or dispute-related requirements; the exceptions below are the main examples of that, not an exhaustive list.

The exceptions:

• Confirmed bookings and related financial records: kept for as long as applicable law requires: currently around 6 years under UK tax and accounting rules. This isn’t our choice; it’s a legal requirement, and it overrides the 18-month default.
• Marketing consent: kept until you withdraw it or unsubscribe, at which point we stop using it for that purpose.

If a legal dispute, claim, or regulatory obligation is ongoing, we’ll keep the specific data relevant to it for as long as that need genuinely lasts, even past these periods (and only for that purpose, not as a general excuse to hold onto everything).

7. Children’s data

In short: Rooetd isn’t for under-18s to book directly, and where a booking includes a travelling child, we collect only what’s reasonably necessary for it.

Rooetd isn’t directed at children, and bookings can only be made by someone with the legal capacity to contract: 18 or over. Our "trips with family" itineraries are booked and paid for by an adult. Where a booking includes information about a travelling child, we collect only the information reasonably necessary for the booking and its delivery, and keep it no longer than clause 6 sets out.

8. How we keep it secure

In short: encrypted, access-controlled, and if something serious ever goes wrong, we’ll investigate it properly and tell you and the ICO where the law requires.

Technical and organisational measures appropriate to a business our size: encrypted connections (HTTPS/TLS) throughout, access controls on who can see enquiry data, and reputable, security-audited infrastructure providers. Before we introduce anything higher-risk (a new payment processor, an AI-driven feature, anything processing special category data at real scale), we’ll carry out a Data Protection Impact Assessment first, not after the fact.

No online system is 100% secure, and we can’t guarantee the safety of anything sent to us over the internet. If we become aware of a personal data breach, we’ll assess and investigate it promptly and notify the ICO where the law requires. Where a breach is likely to result in a high risk to affected individuals, we’ll also notify those individuals without undue delay.

9. Marketing communications: your specific rights

In short: opt in if you want it, opt out any time with one click, no hard feelings either way.

If you’ve opted in to marketing emails or texts, you can opt out at any time. We may sometimes rely on the products-and-services "soft opt-in" under PECR instead of asking for opt-in consent; but only where all of its conditions are actually met, including that we obtained your details while selling or negotiating to sell a product or service to you, and gave you a clear opportunity to opt out at the time. A casual website visit or a general enquiry that never got that far doesn’t qualify.

• Every marketing email has an unsubscribe link: one click, no login, no "are you sure" friction.
• For texts, reply STOP, or email us and we’ll do it for you.
• Opting out of marketing doesn’t affect service messages about a trip you’ve booked (like a schedule change); those aren’t marketing, and you can’t opt out of communications genuinely necessary to deliver a trip you’ve paid for.

We don’t buy or rent marketing lists, and we don’t pass your details to anyone else for their marketing, ever.

10. Your rights

In short: you can see, fix, delete, restrict, or take away your data whenever you like: just ask.

Under UK GDPR, you can:

• Access the personal data we hold about you
• Rectify it if it’s wrong or incomplete
• Erase it, in certain circumstances
• Restrict how we use it
• Object to processing based on legitimate interests, including direct marketing
• Port: receive certain personal data in a structured, commonly used, and machine-readable format, and in some circumstances ask us to transfer it to another controller
• Withdraw consent any time we’re relying on it

Email hello@rooetd.com or datahandling@rooetd.com. We’ll respond within a month, free of charge for a reasonable request.

Not happy with how we’ve handled your data? Tell us directly, or complain to the regulator:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · 0303 123 1113

This is about your data specifically. If you’re looking for the right to cancel a trip you’ve booked (sometimes called a "cooling-off period"), that’s a different right, governed by a different law, and it lives in our Booking Conditions, not here. See the note in our Terms & Conditions, clause 12, for why.

11. Links to other sites

In short: we link out sometimes; once you leave our platforms, their rules apply, not ours.

Our platforms may link to third-party sites. This policy doesn’t cover them; check their own privacy notices.

12. Changes to this policy

In short: we’ll keep this page current and tell you clearly if anything meaningfully changes.

We’ll update this page as the business grows, and update the "last updated" date when we do. Where a change materially affects how we use your personal data, we’ll provide appropriate notice and, where required, obtain fresh consent.

13. Contact us

hello@rooetd.com · datahandling@rooetd.com · +44 7447 793716

Drafted against UK GDPR, the Data Protection Act 2018, and PECR (as amended by the Data (Use and Access) Act 2025).