GDPR Compliance

Last updated: August 19, 2026

Our Commitment to Data Protection

vibrant-craft is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: When you voluntarily provide information through our forms
• Contractual Necessity: To fulfil travel arrangements you request
• Legitimate Interests: To improve our services and communicate with you about relevant offerings
• Legal Obligation: To comply with legal requirements

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data under certain circumstances.

Right to Restrict Processing

You can request that we limit how we use your personal data.

Right to Data Portability

You can request to receive your personal data in a structured, commonly used format.

Right to Object

You can object to processing of your personal data based on legitimate interests.

Right to Withdraw Consent

You can withdraw consent at any time where we rely on consent as the legal basis for processing.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements.

When personal data is no longer needed, we securely delete or anonymise it.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication measures
• Staff training on data protection

International Data Transfers

If we transfer your personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us at [email protected]

We will respond to your request within one month. This period may be extended by two additional months where necessary, taking into account the complexity of your request.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Contact Our Data Protection Officer

For questions about our data protection practices or to exercise your rights, contact us at [email protected]