1. Who We Are

This Privacy Policy explains how Therefore Solutions Ltd ("we", "us", "our"), trading as byANANTA, collects, uses, and protects your personal data when you use our platform at byananta.com.

Data Controller	Therefore Solutions Ltd
Trading Name	byANANTA
ICO Registration	ZC037850
Contact	hello@byananta.com
Website	byananta.com

We are registered with the Information Commissioner's Office (ICO) under registration number ZC037850. If you have any questions about how we use your personal data, please contact us at hello@byananta.com.

2. Data We Collect

2.1 Information You Provide

When you use our platform or make a booking, we may collect:

• Identity data: name, date of birth, title
• Contact data: email address, telephone number, postal address
• Travel document data: passport number, nationality, expiry date (required for certain bookings)
• Booking data: flight and hotel preferences, passenger details, special requests
• Financial data: payment card details (processed and stored securely by Stripe — we do not store raw card data)
• Communications data: messages sent to us via email or contact form

2.2 Information We Collect Automatically

When you visit byananta.com, we automatically collect:

• Technical data: IP address, browser type, device type, operating system
• Usage data: pages visited, time on site, search queries, clicks
• Cookie data: as described in our Cookie Policy

2.3 Information from Third Parties

We may receive information about you from travel suppliers (airlines, hotels) in connection with your booking, and from our payment provider (Stripe) in connection with payment processing.

3. How We Use Your Data

We use your personal data on the following legal bases under UK GDPR:

Purpose	Legal Basis
Processing your booking and communicating with suppliers on your behalf	Contract (Art. 6(1)(b))
Sending booking confirmations, updates, and changes	Contract (Art. 6(1)(b))
Processing payment	Contract (Art. 6(1)(b))
Complying with legal obligations (e.g. anti-money laundering)	Legal obligation (Art. 6(1)(c))
Responding to enquiries and complaints	Legitimate interests (Art. 6(1)(f))
Improving our platform and services	Legitimate interests (Art. 6(1)(f))
Sending marketing emails (where you have opted in)	Consent (Art. 6(1)(a))
Fraud prevention and platform security	Legitimate interests (Art. 6(1)(f))

4. Data Sharing

We share your personal data only where necessary:

• Travel suppliers: airlines, hotels, car hire companies, and rail operators require your personal data to process your booking.
• Payment provider: Stripe processes payment card data on our behalf under their own privacy policy.
• IT service providers: hosting, database, and email service providers who process data on our instruction.
• Legal and regulatory authorities: where required by law or to protect our legal rights.

We do not sell your personal data to third parties. We do not share your data for third-party marketing purposes.

Some of our service providers may be located outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

5. Data Retention

Data Type	Retention Period
Booking and passenger data	6 years from booking date (legal and tax obligations)
Payment transaction records	6 years (financial records requirement)
Email communications	3 years from last contact
Marketing preferences	Until you withdraw consent or 2 years of inactivity
Website usage / analytics data	13 months (standard analytics retention)
Cookie consent records	1 year

6. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data in certain circumstances ("right to be forgotten").
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us at hello@byananta.com with "Data Request" in the subject line. We will respond within 30 days. There is no charge for most requests.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk | 0303 123 1113.

7. Cookies

We use cookies and similar technologies on byananta.com. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• HTTPS encryption on all pages of byananta.com
• Payment card data processed exclusively via Stripe (PCI DSS compliant) — card data is never transmitted to or stored on our servers
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular review of data handling practices

No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

Our platform is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@byananta.com and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available at byananta.com/privacy. We will notify you of significant changes by email where we hold your contact details.

byANANTA · Therefore Solutions Ltd · Co. No. 16414999 · ICO: ZC037850 · byananta.com