Privacy.

Last updated October 17, 2026.

Who we are

Naylor & Co. is the trading name of Jessica Naylor, an independent travel consultant. The business address is 79 Brent Street, London NW4 2EA. All bookings are made through Colletts Travel Limited and are arranged under their licence, with Colletts Travel Limited acting as the licence holder.

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, Jessica Naylor is the data controller for personal data collected through naylorandco.com and through direct correspondence with clients and prospective clients.

Information Commissioner's Office registration: C1941810.
Contact: jessica@naylorandco.com.

What this policy covers

What personal data the practice collects, how it is used, how long it is kept, who it is shared with, and the rights you have. It covers data collected through this website, by email, by telephone, by WhatsApp, and through any other channel by which you contact the practice.

What we collect

Only what is needed to design and book travel for you, answer your enquiries, and meet accounting and regulatory obligations.

• Contact and identity. Name, email address, telephone number, postal address, and date of birth where a travel document requires it.
• Trip planning. Travel preferences, who is travelling and their ages, passport details where a booking requires them, dietary and medical requirements you choose to share, accessibility needs, frequent traveller numbers, and anything else you provide while a journey is being designed.
• Booking and payment. Payment is processed by Colletts Travel and its banking and card-processing partners. Naylor & Co. does not store full payment card numbers. Limited transaction records are kept for accounting and audit.
• Correspondence. Emails, messages, voice notes and call notes exchanged while planning a journey and afterwards.

Why we collect it

• Performance of a contract. When you ask for travel to be designed or booked, your data is needed to research options, secure bookings and deliver the journey, including sharing it with the suppliers involved.
• Legitimate interest. To answer enquiries that do not become bookings, and to keep a record of journeys designed for clients who may travel again. This is always balanced against your rights.
• Legal obligation. Tax, anti-money-laundering and package travel record-keeping require certain records to be retained.
• Consent. For Letters from the practice, the monthly note, and, as explicit consent, for any health or dietary information you choose to share in the planning questionnaire. You can withdraw consent at any time.

For passport details and answers to the questionnaires, the basis is the contract for your journey (UK GDPR Article 6(1)(b)), with legitimate interest (Article 6(1)(f)) where no contract is yet in place. For health answers, it is your explicit consent (Article 9(2)(a), with Article 6(1)(a)).

Where it is stored

• Google Workspace, for email, files and calendar.
• The practice’s own private client record, hosted by Cloudflare, which also hosts this website.
• Calendly, for booking a first call, if you choose to book one.
• Dolphin, the Colletts Travel back-office system, for booking records.
• Sabre, for passenger name records.
• WhatsApp Business, for direct correspondence.
• Resend, which sends Letters and any automatic emails from this site. It keeps email data for 30 days.
• Anthropic, for Claude, the AI assistant I use to help prepare and organise my work, including correspondence and journey records.
• Notion, for working notes and client records.

Cloudflare, Resend, Anthropic and Notion act as the practice’s processors: they hold or handle data on my instructions and for no purpose of their own.

Access is restricted to Jessica Naylor and, where necessary to deliver a booking, to staff at Colletts Travel and Global Travel Collection. They use it as independent controllers, under their own privacy notices, to make and administer your bookings.

Who it is shared with

• Colletts Travel Limited, for booking processing, payment handling and accounting.
• Global Travel Collection, for group-level systems and reporting where required.
• Suppliers, meaning the hotels, airlines, ground operators, insurers and others needed to deliver your journey. They receive only what they need.
• Professional advisers, meaning accountant, tax adviser and legal counsel where required.
• Regulators and authorities, where the law requires it.

Your data is never sold, and never shared with third-party marketers or advertisers.

International transfers

Some suppliers and platforms operate outside the UK and EEA. Where data is shared with parties in countries without a UK adequacy decision, the transfer relies on the appropriate safeguards under UK GDPR, typically the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Cloudflare and Resend, which host this site and send its emails, are United States companies. Transfers to them rely on the UK Addendum to the EU Standard Contractual Clauses in their data processing agreements, and both are certified under the UK Extension to the EU-U.S. Data Privacy Framework.

How long it is kept

• Clients: for the life of the relationship and seven years afterwards, in line with tax and package travel record-keeping.
• Enquiries that do not become bookings: twenty-four months from last contact, or sooner if you ask.
• Letters subscribers: until you unsubscribe.
• Passport details: 30 days after you return home from your journey, or sooner if you ask.
• Health answers: three months after you return home from the journey they relate to, or sooner if you ask.

Your rights

Under UK GDPR you may ask for access to the data held about you, ask for it to be corrected, ask for it to be deleted where no legal obligation requires it to be kept, restrict or object to certain processing, receive it in a portable format, and withdraw consent where consent is the basis. No decision about you is made by automated means. If you have a concern about how your data is handled, please tell me first: it will be acknowledged within 30 days and you will be kept informed until it is resolved. You may also complain to the Information Commissioner's Office at ico.org.uk.

If you give me details of other people travelling with you, such as a partner, friends or children, please share this notice with them. Their details are used only to arrange the journey, in the same way as yours.

To exercise any of these, write to jessica@naylorandco.com. A response follows within one calendar month.

Cookies and tracking

This website sets no cookies. On these public pages there is no advertising pixel, no tracking of individual visitors, and no third-party script. Typefaces are served from this site rather than from an external font service, so visiting these pages does not transmit your details to anyone else.

The site keeps one count: how many times each page is viewed on each day, added up by the server that sends the page. Nothing is placed on your device and nothing runs in your browser to do it. It records the page and the date, and nothing about who viewed it: not your IP address, device, browser, location or where you arrived from. The counts are held by Cloudflare and deleted automatically after a year.

The enquiry form does not send your details to a third-party form service. When you submit it, they are sent to this site and held by Cloudflare, which hosts it and acts as the practice's processor. They are deleted automatically one year later, unless the enquiry becomes a booking, in which case the records described above apply instead. If you would rather not use the form, the email address on the contact page reaches the same person.

Where this site sends an automatic acknowledgement of an enquiry or a questionnaire, it is a service message and carries no marketing.

Private proposal pages

If you have been sent a link to a proposal, that page is not part of the public website. It is not indexed by search engines, and it is reached only by the link you were sent.

Two things on that page are recorded, and only for the person who wrote it. First, that the proposal was opened: the date it was first opened, the date it was last opened, and how many times. Second, if you use the journey decisions form, which options you chose and anything you typed into the note, so they can be read before we speak rather than repeated during the call.

Nothing else is recorded. Not your IP address, not your device or browser, not your location, and not where you arrived from. All of it is available and none of it is kept. These records are held by Cloudflare and deleted automatically after a year.

Questionnaires we send you

Before we speak, and again once we begin designing in earnest, you may be sent a link to a short questionnaire. Like a proposal, it is not part of the public website, it is not indexed by search engines, and it is reached only by the link you were sent.

The first is four questions: where you have in mind, when, who is travelling, and a rough budget. The second is longer and asks how you like to travel, what you have loved and would not repeat, how you like to be housed, and how you would like to decide.

It also asks about anything that affects the journey practically: how far anyone is happy to walk, allergies and dietary requirements, any condition a hotel, guide or airline needs to know about, any medication that needs special storage, anything to avoid, and whether there is someone to quietly make a fuss of. Some of that can reveal something about health or belief, and under UK data protection law it is treated more carefully than an ordinary preference. It is asked for one reason, which is that a journey designed without it is worse, and sometimes unsafe. Give as much or as little as you wish; every one of those questions can be left blank, and none is required to send the form. If you do answer them, the form asks you to tick a box consenting to this, and those answers are kept only if you do. You can withdraw that consent at any time by telling me, and they will be deleted.

Where a requirement has to reach the people delivering it, it will. A dietary requirement is of no use sitting in a file in London while you are at dinner in Kyoto, so it is passed to the hotel, airline, restaurant or ground operator concerned, and only to those who need it.

Once a journey is under way, the form called About you asks for the details from each traveller’s passport, typed, because flights and some hotels and services need them. If a supplier needs a copy of the photo page, I will ask you separately. Passport details go only to Colletts Travel Limited, the licence holder, which makes your bookings, and to the airlines and suppliers on your journey that need them.

Passport details and health answers are encrypted the moment they arrive, and only I can open them, on my own computer; the website only ever holds them encrypted.

You are never asked for a date of birth, any other identity document, a payment detail or a medical diagnosis. If a questionnaire ever asks you for one of them, something has gone wrong and you should say so.

If you are answering for other people, please make sure they are content for you to pass on what you are passing on.

Answers are sent to this site and held by Cloudflare, which hosts it and acts as the practice’s processor. They are not sent to a third-party form service. Passport details are deleted 30 days after you return home from your journey, and health answers three months after, or sooner if you ask. Other answers are deleted automatically one year later, unless the enquiry becomes a booking, in which case the records described above apply instead. If you would rather not use a form at all, say so and the same questions can be asked by email or on the telephone.

Changes

This policy may be updated. Material changes will be marked at the top of this page and, for clients, sent by email.