Effective date: 11 November 2026
Last amended: 11 November 2026
Version: 2026-11-11
Hello!
Here at TRIPMYDREAM LTD (“tripmydream”) we are committed to protecting and respecting your privacy.
This Privacy Policy explains when, where, and why we collect personal data about people who visit our websites and use our app (together, the “Website”; the list is in section 1), how we use such data, the conditions under which we may disclose it to others, your rights in respect of your personal data, as well as how we keep it secure.
We tried to write this Privacy Policy in clear and plain language for your better understanding of the complicated legal stuff. By doing so we hope you will get all needed details to be assured your personal data is safe with us. In case you still have the question about your privacy, send your questions at: [email protected].
tripmydream provides services for travelers: we help them to search and compare flights, to find accommodation through Booking.com and travel insurance through our insurance partner, and to follow price changes. We also write articles on the Website with tips on how to find an interesting place to visit and arrange the perfect trip. As a company, we run an entity in the United Kingdom.
The controller of your personal data, that is the company that decides why and how your data is processed, is TRIPMYDREAM LTD, registered in England and Wales under the laws of the United Kingdom, company number 11148791, registered office 12 Mulberry Place, Pinnell Road, London, SE9 6AR.
For any question or request about your personal data, write to [email protected].
This Privacy Policy applies to the following websites and to the TripMyDream app for iOS:
Personal data (or “data”) is any information relating to you and that alone or in combination with other pieces of information gives the opportunity to the person that collects and processes such information to identify you as an individual. It can be your name, your identification number, your location data, or information related to your physical, physiological, genetic, mental, economic, cultural or social identity.
Processing of the information means any action with your personal data, for example, collection, recording, organization, structuring, storage, use, disclosure by any means and so on.
tripmydream collects from you only the following data and only for the stated below purposes:
We collect and further process your name, email address, a password in order to create and run your account on the Website, and we do so only at your request. Without these data we will not be able to provide you with the opportunity of possessing the account and making your use of the Website more convenient in such a way.
In your profile you may also give your country, currency and home airports, and we store the language you use. We store your password only as a salted hash, and your e-mail address and name in encrypted form. We do not ask for your phone number, passport or passenger details, or payment data.
If you choose to sign in with your Google account, we receive from Google your name, your e-mail address, whether Google has verified that address, and your profile photo. Google’s sign-in script loads only after you allow functional cookies.
We process the data from your account according to the Terms of Use, so the contractual basis applies to such processing.
When you sign in, your session lasts until 90 days after you last used it; signing out ends it on our server. A password-reset link is valid for 1 hour.
If you created your account on our previous platform, we moved to the new platform your e-mail address, name, password hash, country, language, currency, home airports, newsletter settings, the date you registered and whether your address was verified. We did not move IP addresses, birth dates, gender, previous sign-in sessions, links to social network accounts or inactive price alerts. You will need to sign in again; if you used Google, simply sign in with Google again.
Data from your account will be stored and processed by tripmydream as long as we believe that you are interested in possessing the account on the Website. This means that we will delete such data if you delete your account. You can delete your account at any time in your profile (see section 7).
When you send any request to our email, we collect your name, email address, and other data that you may send us. Please note that not all the data from your request will be personal, but all these data are collected and processed in order to communicate with you regarding your request and to provide you with all needed information.
You may provide such data only intentionally, so we consider that when making a request via email, you understand that we will have to process such data. Taking into account that we process these data at your request and in order to provide you with information services, the contractual basis is our ground for this processing.
We will store personal data from your requests until our communication with you ends and 24 months after to ensure that you are satisfied with our response and you have received all needed information.
When you subscribe to our newsletters, we collect and further process your email address in order to send you messages with some useful information about traveling or with some information of promotional nature. You may always opt-out from our newsletters, clicking the respective link in each message.
Price alerts. When you set a price alert, we use your e-mail address and the route, dates and other details you chose, to tell you when the price changes. You do not need an account for this.
Confirmation. A new subscription or price alert starts only after you click the link in the confirmation e-mail we send you. Subscriptions and alerts that were confirmed on our previous platform remain active.
E-mails about your searches and trips. If you have an account and the country in your profile is outside the European Economic Area, the United Kingdom and Switzerland, we may e-mail you when the price changes for a route you searched (“New price”), remind you of a search after you visited a Partner’s site (“Continue your search”), and, if we can link a booking made with one of our Partners to your account or your browser, send you a reminder before your trip. These e-mails use your recent searches, the offers you opened and the booking details the Partner reported to us (see 3.6). We send them unless you have unsubscribed. We do not send these e-mails to accounts whose country is in the European Economic Area, the United Kingdom or Switzerland.
Service e-mails. We also send e-mails that you need for your account or request: to confirm your address, to reset your password, to confirm a subscription or an alert, and to tell you that an alert has expired. They are part of the service you asked for, so the contractual basis applies, as for your account.
Legal basis. Newsletters and price alerts: your consent, which you give when you confirm the subscription or the alert with the link in our e-mail; subscriptions and alerts confirmed on our previous platform remain active on the same basis. E-mails about your searches and trips: our legitimate interest in showing you offers relevant to your searches, with an unsubscribe link in every e-mail.
How to stop. Every e-mail contains an unsubscribe link. One click is enough; no further confirmation is needed. The link in an alert stops that alert, and the link in a newsletter removes your address from the newsletter. If you have an account, you can also manage the newsletter and pause or delete your alerts in your profile.
Our e-mail provider. We send all e-mails through SendPulse, which may process data outside the European Economic Area and the United Kingdom. SendPulse receives your e-mail address, your language and the content of each e-mail, for example the route, dates, prices and links. For newsletter recipients it also receives the number of your price alerts and the dates of the first and the last alert. SendPulse tells us whether an e-mail was delivered, and about unsubscribes and complaints.
Personal data collected when you register on our mailing list will be stored as long as you are interested in receiving our emails. We consider that you’re interested until you unsubscribe from the mailing list (by clicking the respective link contained in each of our emails).
In order to improve and optimize the work of our website, in order to understand your needs and provide services and advertisements that are relevant to you, we may collect your Usage Data. Usage Data reflect your behavior on our website, for example such data show which pages you have viewed and for how long.
Our own measurement of visits. When you visit, we set two first-party cookies that hold a random identifier: tmd_guest, kept for 13 months and not extended when you return, and tmd_guest_session, which ends after 30 minutes without activity. Before storing anything, our server turns these identifiers into keyed pseudonyms. With them we record page views, certain actions on our pages and when you follow an offer to a Partner, together with the language, currency, type of page and whether you use a mobile or a desktop device. We do not store your IP address, your browser’s identification string, the full address of the page or your e-mail address with these records. We set these cookies and record these events for every visitor, whatever you choose in the cookie banner. We never use them for advertising or share them, and we link them to your account only if you have given analytics consent. Legal basis: our legitimate interest in understanding how the Website is used, with the safeguards described above.
Where and how long. These records are kept in our own analytics database in Frankfurt, Germany, and deleted 25 months after the event. Totals that contain no identifiers are kept longer.
History from our previous platform. Analytics records from our previous platform are moved to the new one with visitor identifiers turned into keyed pseudonyms. IP addresses, full browser strings, e-mail addresses, names, advertising click identifiers and page addresses with personal content are removed, and only site events of the last three years are moved.
Google Tag Manager. Our pages load Google Tag Manager, a Google service that loads other analytics and advertising tools (“tags”). The tags we use are: Google Analytics 4 tags, which measure how visitors use the Website. When they run depends on where you are and on your choice:
Legal basis: your consent in the European Economic Area, the United Kingdom and Switzerland; in other countries, our legitimate interest in understanding how the Website is used, with the option to decline at any time.
Some pages of our websites show ads from Google AdSense: travel guides, country pages, articles, and the pages about travel in Ukraine and help for refugees. Ads are shown from your first visit. In the European Economic Area, the United Kingdom and Switzerland, ads are not personalised until you accept marketing cookies, and they are not personalised if you decline marketing. In all other countries, including Ukraine, ads are personalised until you decline marketing cookies. Google sets its own cookies for these ads; see our Cookies Policy.
Legal basis: your consent for personalised ads in the European Economic Area, the United Kingdom and Switzerland; in other countries, our legitimate interest in funding the Website through advertising, with the option to decline at any time.
When you search, our servers ask our Partners for fares. These requests contain the route, dates, number of passengers and the market of your search.
When you follow an offer, we record this click-out with the pseudonymous identifiers described in 3.4. Your browser then goes to the Partner’s site with the offer and a random reference code. If you book, the Partner reports the booking back to us with that code: the amount, our commission, the Partner’s transaction number and the currency.
If you came to us through an affiliate network (SalesDoubler, Admitad or EPN), we store that network’s reference code in encrypted form and send the network a notice of each paid booking with the reference code, the order number, the amount or commission and the time. These notices contain no other personal data.
We use these records to receive our commission and to pay affiliate networks, to understand which offers are useful, and for the trip reminder described in 3.3. We keep click-out records for 761 days and booking records for 25 months. Legal basis: our legitimate interest in receiving our commission, paying affiliate networks and understanding which offers are useful.
From the moment you are on a Partner’s site, the Partner’s own privacy policy applies to what you enter there.
If you comment on an article, your comment is published with its text, date and your name and, if you signed in with Google, your Google profile photo. Flight reviews are checked by us before publication and are published with the name you enter, your text and your ratings. We keep the e-mail address you give with a review only as a keyed one-way hash, which cannot be turned back into the address.
To have a comment or a review removed, write to [email protected]. Deleting your account removes your comments and takes down your published reviews. Legal basis: our contract with you, because you asked us to publish your comment or review.
Our network provider Cloudflare tells us from which country and approximate area each request comes. We use this to preselect your country, currency and nearest airport and to decide which cookie banner to show you. We do not store or log this location. Legal basis: our legitimate interest in showing you the Website in the right country, currency and language.
When you make a choice in our cookie banner, your browser keeps it for 180 days in the tmd_consent cookie; after that we ask again. We also record each choice on our server as proof of consent: a visitor identifier, your account if you are signed in, the version of this policy, your answers and the time. We do not store your IP address or your browser’s identification string with it. We delete these records 13 months after you last confirmed your choice, and when you delete your account. Legal basis: our legal obligation to be able to demonstrate that consent was given.
To keep the Website secure and working, every request passes through Cloudflare’s network (encryption, firewall and domain name service), and our servers write technical logs. The log of our entry point records your IP address, your browser’s identification string and the address of the page you requested, without its query part. Our other logs are designed to leave out e-mail addresses and access tokens. We keep these logs with Grafana Labs (Grafana Cloud), which we use for logs, metrics and outage alerts, in Germany. We keep all logs of our servers and services in the European Union for no longer than 30 days. Cloudflare, which delivers and protects the Website, keeps its own security records of requests (your IP address, your browser’s identification string and the address requested) for up to 31 days. Legal basis: our legitimate interest in keeping the Website secure and working.
The cookies are tiny pieces of code that remain in your device after you have visited any website. These pieces then enable the server to provide you with the information that is customized with your needs when you use some platform or website for the next time. By giving the consent to tripmydream for using cookies you make our Website more efficient, fast, and safe, you improve its functioning. Our Cookies Policy lists each cookie we use and how long it lasts. Nevertheless, you may block, delete, or disable saving cookies on your device if your web-browser allows to do this. You can read more on our Cookies Policy.
The app uses the same accounts as the websites, and this Privacy Policy applies to it. The app sends usage events to our analytics with a keyed one-way identifier of the installation. If you allow notifications, we send them through Google Firebase Cloud Messaging, which receives your device’s notification token and the text of the message; we store the token in encrypted form.
The current version of the app also contains Google Firebase Analytics and the Facebook SDK by Meta with automatic event logging. They send data from your phone directly to Google and Meta under their own terms, and we cannot switch them off until a new version of the app is released. Legal basis: for app analytics, our legitimate interest in understanding how the app is used; for notifications, your consent, which you give when you allow notifications in iOS.
Please note that sometimes we may process your data for the period longer than indicated above. Such processing could be carried by tripmydream only for statistical purposes as it is provided for in Article 5 of the GDPR and subject to the appropriate safeguards in accordance with applicable data protection laws.
What are statistical purposes? Statistical purposes mean any collection and processing of personal data necessary for statistical surveys or to produce statistical results. Those statistical results may further be used for different purposes, for example, we use them in order to assess our business development, understand the market demands and improve our Services. The statistical purpose implies that such statistical result does not include personal data, but aggregate data.
In most cases, we will anonymize your data before starting to process it for the statistical purposes. As a result, such data will be no longer considered personal and its use will be not governed by data protection laws.
Note that we may process your personal data not only on the basis of your consent or at your request, but also when the processing is necessary:
In all cases, we will notify you about applied legal basis for processing and other relevant details, before we start processing of your personal data on the specific legal basis. However, we will not, if we are forbidden to do so in accordance with our obligations under any applicable legislation.
If tripmydream decides to change the purposes of processing specified above, we will inform you on such changes prior to the use of your personal data within the newly set purposes. The notification on such changes will be sent to your email and you will have to provide your consent for the amended purposes (unless additional purpose of processing is compatible with those listed above).
Please note that in no case we sell your data or make any decision based solely on automated processing that may produce legal effects or similarly significant effects.
In order to provide high-quality services, tripmydream hires people, enters into agreements with independent contractors as well as cooperates with other services providers, companies and organizations. For those reasons, some of your personal data can be passed to the mentioned persons.
First of all, our employees may have access to your data.
We use the following service providers:
Other recipients:
These well-known service providers will help us to ensure that your data is secure within tripmydream.
In all cases, if we pass your personal data to other persons, we ensure that your personal data is being protected and used only within the purposes specified in this Privacy Policy. This is achieved by using only certified services and products, signing agreements on protection of personal data with contractors and partners, as well as taking technical measures to ensure the information is protected when stored, used and while being processed and transferred.
You also have to know that tripmydream may disclose your personal data to enforce and comply with the law. In other words, tripmydream may disclose information necessary for the investigation or legal process on official request or the official bodies acting within their powers.
Our servers and databases are in Germany, with backups in France. Some recipients are located, or may process data, outside the European Economic Area and the United Kingdom:
For these transfers we rely on adequacy decisions where they exist, including the EU-US Data Privacy Framework for certified providers in the USA and the adequacy decisions between the European Economic Area and the United Kingdom, and otherwise on the standard contractual clauses adopted by the European Commission, with the United Kingdom addendum, which are included in our agreements with our providers. You can ask for a copy of the safeguards we use by writing to [email protected].
You have a right to access to your personal data processed by tripmydream and right to data portability. This means that you can ask tripmydream what personal data of yours is processed. You can also ask for the clarifications on the information described above, i.e. purpose of collecting and processing, period of processing, third parties which have access to information. You have a right to request from tripmydream your personal data in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller, if the processing is based on your consent or on contract and the processing is carried out by automated means.
You have a right to request from tripmydream to rectify your personal data. This means you can require all the inaccurate personal data concerning you being corrected. You can also complete the personal data if you feel there is a need to do so.
You have a right to request tripmydream to erase personal data. You can request tripmydream to erase personal data if its processing is no longer necessary to achieve purposes for which it was collected as well as if there are no legal grounds for the processing. In most cases, tripmydream will erase it unless otherwise required by legislation.
You have a right to restrict the processing of your personal data by tripmydream. In some cases, prescribed by law you will be able to restrict the processing of your personal data, for example, if you contest the accuracy of your personal data being processed or in case tripmydream is not interested in processing of your personal data any longer, but you want tripmydream to do this on different reasons, for example, to bring some claim for somebody and, instead of the erasure of information, its processing will be just restricted.
You have a right to withdraw your consent. You can withdraw your consent for the collection and processing of your personal data by tripmydream at any time by contacting us, or yourself as described below, without affecting the lawfulness of processing based on consent before its withdrawal. After we at tripmydream receive such withdrawal request from you, we will process it in a timely manner and we will no longer process your personal data, unless otherwise is set by law.
You have a right to object to processing of your personal data by tripmydream. In some cases, prescribed by the applicable laws you can object to processing of your personal data.
You have a right to object to processing of your personal data when the processing is related to the performance of our task carried in the public interest or in the exercise of official authority vested in us; or we process your data to pursue our or third party’s legitimate interests, and you believe that such interests are overridden by your interests or fundamental rights and freedoms.
If you make a request objecting to processing, we will no longer process the personal data unless we are able to demonstrate compelling legitimate grounds for the processing.
Please note that when processing of your personal data is carried for direct marketing purposes, you have the right to object at any time to such processing without providing any justification. We will no longer process your data for such direct marketing purposes. You may refer to relevant sections of this Privacy Policy to learn whether we process your data for direct marketing purposes.
How to exercise your rights as to your personal data? Any requests to exercise your rights can be directed to tripmydream through the contact details provided below. These requests are free of charge. You can also do the following yourself:
tripmydream will provide information on action taken on your request related to your rights specified above within one month of receipt of the request for the longest. That period may be extended by two further months if tripmydream is overwhelmed by the number of requests or the request at issue is complicated and requires a lot of action. tripmydream will inform you of any such extension within one month of receipt of the request, together with the reasons of such delay.
If you have doubts as to our reply or reaction, or absence of such, you have the right to lodge a complaint with a supervisory authority. For TRIPMYDREAM LTD this is the Information Commissioner’s Office (ICO), United Kingdom, ico.org.uk. If you live in the European Union, you may also complain to the supervisory authority of your own country.
You can use the Website without an account and without giving us your name or e-mail address. To create an account we need your e-mail address and a password, or your Google sign-in. To set a price alert or to subscribe to the newsletter we need your e-mail address. Without these data we cannot provide these services. Giving us any other data is up to you.
tripmydream processes your data using computers and/or other IT enabled tools. tripmydream takes technical and organizational measures to ensure the information is processed in a manner that ensures appropriate security of information, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage. For example, tripmydream uses verified contractors that might have access to the data as specified in Section 4 of the Privacy Policy with which the relevant data processing agreements are signed. We also guide and train our personnel to process your data securely according to our internal data protection policies.
Our measures include: encryption of all traffic between your device, Cloudflare and our servers, and between our servers; encrypted disks; separate encryption of e-mail addresses, names and affiliate reference codes; passwords stored as slow salted hashes, and session tokens and sign-in identifiers as keyed one-way hashes; a separate network zone for account data with restricted access; staff tools behind company sign-in with two-step verification; and encrypted backups.
The privacy of children is one of our concerns. Here at tripmydream we can provide services only in case you are aged 16 or older. If you are under 16 you will need to get your parent’s/guardian’s permission before submission of any personal data to tripmydream. If you are underage, and there are no data as to your parent’s/guardian’s permission to use our Website, please do not provide us with your consent for data processing. In such case, we will not collect or process your personal data that can be processed on the basis of the consent, and you will have a limited use of our Website.
If any personal data of yours would be under the breach, we would inform you and the respective data protection agencies as to the accidents without undue delay, if there are high risks of violation of your rights as data subject. We would also do our best to minimize any such risks.
Please note that we may change this Privacy Policy from time to time, so we ask you to check this page to ensure that you’re happy with all the changes. We publish each new version on this page with its date and version.
We hope this Privacy Policy helped you to understand how your personal data will be dealt here at TRIPMYDREAM. We will take care of it, so you can explore our Website and not be concerned over your privacy.
Your tripmydream team
Contact email: [email protected]
Postal address: TRIPMYDREAM LTD, 12 Mulberry Place, Pinnell Road, London, SE9 6AR, United Kingdom