Privacy Policy

Last updated 29 October, 2018

Why do we collect personal data?

This Privacy Policy explains how Kenneth Macleod Travel (KMT) uses personal information. KMT is a travel agency which provides travel services to corporate and private clients. KMT collects personal information from the Clients’ travellers, from participants at Client meetings & events organised by KMT, and from the users of the KMT website. The purpose of this information collection is for KMT to provide these services.

What information do we collect?

When servicing a given Client, a ‘client file’ is created in KMT’s proprietary tool for each traveller. The personal information is entered through feeds from the clients or by the traveller (or the authorised travel arranger). The personal information that we collect for each traveller may include: name, gender, date of birth, address, phone numbers, email addresses, travel destinations, travel schedules, travel preferences (seat, meal, smoking, etc.), passport and visa details. When organising a meeting or event for a Client, KMT collects personal information to register the participants to the meeting or event through tools that may be selected by the Client or receives lists of participants from the Client. KMT collects personal information from users to its websites through the use of online forms and when the user emails KMT his/her details. KMT forwards these user requests to the appropriate KMT team member to respond to the user.

How we process personal information

In addition to creating ‘passenger name records’ (PNRs), KMT uses the personal information (usually the PNR) of the traveller for the following travel and other travel-related purposes. Reservations: The “passenger name records” are stored in a database as a reference document to be consulted each time a reservation is to be made. When a reservation is made, KMT creates a “client file” that contains all of the personal information along with the reservation information that is needed to fulfil the travel request of a traveller and to fulfil regulatory requirements for travel to certain destinations such as the Secure Flight program in the
United States and the Advanced Passenger Information System in several countries such as the UK and China. To make reservations, KMT needs to transfer personal information to various third party travel suppliers (such as airlines, hotels, car rental companies, online booking tool companies and safety and security tracking providers, as well as computer reservation systems) within the traveller’s home country or in another country where the traveller may be traveling and often also to government bodies for certain destinations such as Department of Homeland Security in the USA. Without this information travel will not be possible.

Consolidation of Travel Data: At the request of the Client (the paying party for the travel), KMT or a third party may prepare information reports that summarise and analyse the travel expenditures per destination, per travel supplier, etc. Such reports may include certain personal information from the client file.

Transfers to Third Parties at Corporate Client’s Request: KMT may transfer personal information to third parties at the request of the Client, for example for information consolidation or emergency traveller tracking services. These transfers could involve transfers of personal information to other countries.

Transfers within KMT: Transfers are made throughout KMT, joint ventures and international partners to support travel-related services such as emergency online booking services, airline ticket issuance and technical help-desk requests, and for screening where required for compliance with the law.

Transfers to KMT service providers: Transfers are for KMT to obtain support services in connection with the travel and meetings & events services to its clients (such as administrative, information technology and technology platforms, telecommunications, payment services).

Regulatory transfers: KMT may be required by law to transfer information to governments and law enforcement agencies where required.

Compliance with Travel Policy: At the request of the Client, KMT may report on the compliance of the travellers with the travel policy of the Client and identify any exceptions to the compliance.

Collecting Travel Payments: KMT may transfer personal information to third parties in the traveller’s home country or to another country for the purpose of collecting payments related to travel reservations.

KMT Databases: The electronic “client files” that KMT maintains are stored in a central database. For clients using an OBT provider ,(i.e. Cruise Personalisers) the personal information may be stored by these third-parties.

New Products and Services: With the goal of improving service and based on the information given to KMT, the company may send additional information to the traveller if it applies to his/her trip or in advance of future trips. An example might be a list of restaurants near a specific hotel in the destination city or parking at the departure airport.

Application of the Policy

Transfer to Third Parties: KMT requires third parties processing EU traveller’s personal information to meet the standards of data privacy laws in the EU and the new GDPR rules from 23 May 2018

Security: KMT has implemented appropriate technical and organisational measures to protect the personal information obtained from our Clients’ travellers against accidental or unlawful disclosure or destruction.

Retention and Deletion: KMT keeps personal information only for 10 years to fulfil future marketing or items of client interest. KMT may need to keep certain information to comply with financial reporting laws or to inquiries from Clients on past travel activities.

Travellers’ Rights of Access

The traveller has a right of access to his/her personal data. The traveller can update his/her “client file”. To contact KMT with questions or issues about KMT’s information processing, the traveller may contact Giffnock@kmtravel.co.uk

You can ask us to erase any data that we hold about you where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. you withdraw your consent to the processing and there is no other legal ground for the processing;
3. you object to processing on grounds relating to your particular situation and our legitimate grounds for processing do not override your interests;
4. you object to processing for direct marketing purposes;
5. the personal data have been unlawfully processed;
6. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.

We are not required to erase your data where we need to process your data:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
3. for reasons of public interest in the area of public health;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes so far as the erasure of data is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. for the establishment, exercise or defense of legal claims.

You can ask us to restrict our processing of your data where one of the following applies:

1. you contest the accuracy of the personal data we hold about you for a period enabling us to verify the accuracy of the personal data;
2. the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
3. we no longer need the personal data for the purposes of the processing, but the data are required by you for the establishment, exercise or defense of legal claims;
4. you object to processing on grounds relating to your particular situation pending the verification of whether our legitimate grounds for processing override your interests.

Dispute resolution: Any questions or concerns regarding the use of disclosure of personal information may be directed to Giffnock@kmtravel.co.uk . KMT will investigate and attempt to resolve complaints and disputes regarding use and disclosure of your personal information.

If you think that there is a problem with the way that we are handling your data, you have the right to complain to the Information Commissioner’s Office. You can call their helpline on 0303 123 1113 or https://ico.org.uk/concerns/

This policy is subject to change. The changes will be posted on our website.