Privacy.

Last updated 7 September 2026.

Who we are

Naylor & Co. is the trading name of Jessica Naylor, an independent travel consultant. All bookings are made through Colletts Travel Limited and are arranged under their licence, with Colletts Travel Limited acting as the licence holder.

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, Jessica Naylor is the data controller for personal data collected through naylorandco.com and through direct correspondence with clients and prospective clients.

Information Commissioner's Office registration: C1941810.
Contact: jessica@naylorandco.com.

What this policy covers

What personal data the practice collects, how it is used, how long it is kept, who it is shared with, and the rights you have. It covers data collected through this website, by email, by telephone, by WhatsApp, and through any other channel by which you contact the practice.

What we collect

Only what is needed to design and book travel for you, answer your enquiries, and meet accounting and regulatory obligations.

• Contact and identity. Name, email address, telephone number, postal address, and date of birth where a travel document requires it.
• Trip planning. Travel preferences, who is travelling and their ages, passport details where a booking requires them, dietary and medical requirements you choose to share, accessibility needs, frequent traveller numbers, and anything else you provide while a journey is being designed.
• Booking and payment. Payment is processed by Colletts Travel and its banking and card-processing partners. Naylor & Co. does not store full payment card numbers. Limited transaction records are kept for accounting and audit.
• Correspondence. Emails, messages, voice notes and call notes exchanged while planning a journey and afterwards.

Why we collect it

• Performance of a contract. When you ask for travel to be designed or booked, your data is needed to research options, secure bookings and deliver the journey, including sharing it with the suppliers involved.
• Legitimate interest. To answer enquiries that do not become bookings, and to keep a record of journeys designed for clients who may travel again. This is always balanced against your rights.
• Legal obligation. Tax, anti-money-laundering and package travel record-keeping require certain records to be retained.
• Consent. For Letters from the practice, the quarterly note. You can withdraw consent at any time.

Where it is stored

• Google Workspace, for email, files and calendar.
• Notion, for client records.
• Dolphin, the Colletts Travel back-office system, for booking records.
• Sabre, for passenger name records.
• WhatsApp Business, for direct correspondence.

Access is restricted to Jessica Naylor and, where necessary to deliver a booking, to staff at Colletts Travel and Global Travel Collection under contract terms equivalent to UK GDPR processor obligations.

Who it is shared with

• Colletts Travel Limited, for booking processing, payment handling and accounting.
• Global Travel Collection, for group-level systems and reporting where required.
• Suppliers, meaning the hotels, airlines, ground operators, insurers and others needed to deliver your journey. They receive only what they need.
• Professional advisers, meaning accountant, tax adviser and legal counsel where required.
• Regulators and authorities, where the law requires it.

Your data is never sold, and never shared with third-party marketers or advertisers.

International transfers

Some suppliers and platforms operate outside the UK and EEA. Where data is shared with parties in countries without a UK adequacy decision, the transfer relies on the appropriate safeguards under UK GDPR, typically the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long it is kept

• Clients: for the life of the relationship and seven years afterwards, in line with tax and package travel record-keeping.
• Enquiries that do not become bookings: twenty-four months from last contact, or sooner if you ask.
• Letters subscribers: until you unsubscribe.

Your rights

Under UK GDPR you may ask for access to the data held about you, ask for it to be corrected, ask for it to be deleted where no legal obligation requires it to be kept, restrict or object to certain processing, receive it in a portable format, and withdraw consent where consent is the basis. You may also complain to the Information Commissioner's Office at ico.org.uk.

To exercise any of these, write to jessica@naylorandco.com. A response follows within one calendar month.

Cookies and tracking

This website sets no cookies. There is no analytics, no advertising pixel, no tracking of any kind, and no third-party script. Typefaces are served from this site rather than from an external font service, so visiting these pages does not transmit your details to anyone else.

The enquiry form does not send data to a third-party form service. When you submit it, the details are composed into a message in your own email application, which you then send. Nothing is transmitted until you send it.

Changes

This policy may be updated. Material changes will be marked at the top of this page and, for clients, sent by email.