Privacy Policy

1. Controller

Sam White Ltd., 19, St. Mark Street, Valletta VLT 1362, Malta, is the controller responsible for the processing of your data on the 2Travel platform. Please submit data protection enquiries via the support area after logging in; they will be handled confidentially.

For the processing of your data in connection with the actual booking, payment, and accommodation, the respective booking partner and the accommodation property are each independent controllers. Their privacy notices will be made available to you during the booking process.

2. Data We Process

• Account data: name, email address, password (stored exclusively as a hash), preferred language and display currency
• Profile and booking data: telephone number, postal address, names of fellow travellers, ages of accompanying children, travel dates, booked rooms, prices, booking and confirmation numbers, cancellation status
• Search data: destination, travel period, occupancy – used to display offers, not permanently linked to your account unless you complete a booking
• Payment data: processed exclusively by the booking partner's payment service provider; we receive only a transaction reference and payment status
• Support data: contents of your support conversations as well as enquiries to accommodation properties and their responses
• Technical data: IP address, browser and device type, time of access, pages visited (server logs), error reports

3. Purposes and Legal Bases

• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR): provision of the customer account, display of offers, forwarding of your booking request to the booking partner, booking management, support
• Compliance with legal obligations (Art. 6(1)(c) GDPR): retention of booking- and billing-relevant data, disclosure to competent authorities
• Legitimate interests (Art. 6(1)(f) GDPR): security and stability of the platform, prevention of misuse and fraud, error analysis, enforcement of our terms
• Consent (Art. 6(1)(a) GDPR): usage analytics and any promotional emails, where you have given your consent; withdrawable at any time

4. Disclosure to Booking Partners and Accommodation Properties

As Sam White does not carry out the booking itself, we transmit the data required for the booking to the respective booking partner: the names of all guests, the ages of accompanying children, travel dates, selected rooms and rates, contact details of the person making the booking (email, telephone, postal address), and any special requests. The booking partner forwards the data to the accommodation property and processes the payment via its own payment service provider.

Booking partners and accommodation properties process this data as independent controllers in accordance with their own privacy policies. Accommodation properties may be established outside the EU/EEA; the transfer is necessary for the performance of the contract you have requested (Art. 49(1)(b) and (c) GDPR).

Enquiries you send to an accommodation property via the support chat are forwarded to the property together with your booking reference; the response will be delivered to you in the chat and by email.

5. Other Recipients and Processors

To operate the platform, we engage service providers who act on our behalf and in accordance with our instructions (hosting and databases, email delivery, error monitoring, mapping services). Data processing agreements in accordance with Art. 28 GDPR are in place with all processors; where data is processed outside the EU/EEA, this is done on the basis of adequacy decisions or EU Standard Contractual Clauses.

To handle support enquiries, we use an AI-powered assistant. The contents of your conversation and the booking data required to respond are transmitted to a language model provider and are not used there for training purposes.

For error analysis, technical error reports (error message, browser, anonymised page views) are transmitted to a monitoring service. Form data, cookies, and payment information are removed in this process.

Disclosure to authorities takes place only where we are legally required to do so.

6. Emails

We send you transactional emails (email address verification, password reset, booking and cancellation confirmations, responses to support enquiries and enquiries to accommodation properties). These are necessary for the performance of the contract. We send promotional emails only with your express consent, which you may withdraw at any time via the unsubscribe link.

7. Cookies and Analytics

We use technically necessary cookies for login, language and currency settings, and the booking process. Reach measurement is carried out only if you consent via the cookie banner. For details, please refer to our Cookie Policy.

8. Retention Periods

Account data is retained until your account is deleted. Booking data is retained in accordance with statutory retention obligations (in Malta, generally ten years for billing-relevant records). Support conversations are deleted no later than 24 months after the last entry. Server logs and error reports are deleted after 30 and 90 days respectively. Checkout sessions without a completed booking are discarded after 72 hours.

9. Your Rights

• Right of access to the data stored about you (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure, where no retention obligations apply (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent with effect for the future
• Right to lodge a complaint with a supervisory authority, in particular the Information and Data Protection Commissioner (IDPC), Floriana, Malta, or the supervisory authority of your place of residence

To exercise your rights, please contact us via the support area. Rights against booking partners and accommodation properties may additionally be asserted directly with them; we will assist you in forwarding your request.

10. Security

All connections are TLS-encrypted. Passwords are stored exclusively as hashes. Access to personal data is restricted to employees and service providers who require it for their tasks and are bound by confidentiality obligations. Complete payment data never reaches our systems at any point.

11. Changes to This Policy

We update this privacy policy when our processing activities or the applicable legal framework change. The current version is available on the platform at all times; the effective date can be found at the top.