Privacy Policy

In all matters related to personal data, you can contact us by email at [email protected] or via the contact form. The Controller has not appointed a Data Protection Officer.

We process personal data only to the extent necessary for the following purposes:

• Account and provision of the Service - email address, first and last name, password (stored only as a cryptographic hash), language and currency preferences, profile picture, search settings, trip plans, routes and saved places. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: until the Account is deleted.
• Signing in with Google - if you use "Continue with Google", we receive from Google your email address, first and last name and confirmation that the email address is verified. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: until the Account is deleted.
• Trip Gallery (Pro Package) - uploaded photos stored in WebP format, including the location read from their EXIF data. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: while the Pro Package is active and for at least 12 months after it expires; photos are permanently deleted within 7 days of a deletion request sent to [email protected] from the email address of the Account, or when the Account is deleted.
• One Click Trip - the trip details you enter (destination, dates, place of departure, number of adults and ages of children, price range and currency), the generated trip, your credit balance and history and, if you share a trip, its public link. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: until the Account is deleted; records of purchased credits as for settlements below.
• Evidence of registration and acceptance of the Terms - registration IP address, date of accepting the Terms and date of Account activation. Legal basis: our legitimate interest in demonstrating the conclusion of the contract and defending against claims (Art. 6(1)(f) GDPR). Retention: for the lifetime of the Account and then until the limitation period for claims expires.
• Sale of the Pro Package and One Click Trip credits, settlements and accounting - subscription and credit purchase history, billing period, price and currency, payment status and invoice data. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR). Retention: 5 years from the end of the calendar year in which the tax payment deadline expired.
• Subscription management records - date, time and IP address of each cancellation and resumption of the subscription. Legal basis: our legitimate interest in documenting your instructions and defending against claims (Art. 6(1)(f) GDPR). Retention: until the limitation period for claims expires.
• Contact, support conversations and complaints - name, email address and the content of your messages, including support conversations on the One Click Trip result page. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, for complaints, compliance with consumer law obligations (Art. 6(1)(c) GDPR). Retention: for the time needed to handle the matter and then until the limitation period for claims expires.
• Security, bot protection and statistics - IP address, visited page, date of the visit and the country determined from the IP address, as well as data processed by reCAPTCHA on the login, registration and contact forms, as well as, for blocked or suspicious requests, the browser identifier (User-Agent), the referring page, the request details and the email address entered in the form. Legal basis: our legitimate interest in securing the Service, preventing abuse and analysing traffic (Art. 6(1)(f) GDPR). Retention: visit logs are kept for 12 months. Security records of blocked requests are kept for 12 months.
• Displaying prices in the right currency - the country determined from your IP address. Legal basis: our legitimate interest in presenting a relevant offer (Art. 6(1)(f) GDPR). You can choose the currency yourself in the settings. Retention: as for visit logs.

Payments for the Pro Package and One Click Trip credits are processed by PayU S.A., with its registered office in Poznań (ul. Grunwaldzka 186, 60-166 Poznań, KRS 0000274399). To process a payment, we transfer to PayU the data necessary for this purpose: your email address, first and last name, the amount, currency and description of the order and your IP address. PayU processes payment data as an independent controller, in accordance with its own privacy policy available at payu.pl. We do not receive or store your full payment card details.

Your personal data may be disclosed to entities that help us provide the Service, acting on our behalf as processors or as independent controllers:

• PayU S.A. - payment processing;
• Amazon Web Services EMEA SARL - hosting of the Service, the database and stored photos (data centre in Frankfurt, Germany);
• OVH SAS - email delivery;
• Cloudflare, Inc. - network security and content delivery;
• Google Ireland Ltd - reCAPTCHA bot protection, web fonts and "Continue with Google" sign-in;
• DeepL SE or Google Ireland Ltd - automatic translation of the messages you send us, so that our team can read them (the text of the message);
• Grafana Labs - monitoring and application logs, which may contain IP addresses and the email address of an Account;
• GetYourGuide - activity widgets on trip pages, only if you accept them (see section 9);
• ip-api.com - determining the country from the IP address;
• OpenStreetMap Foundation and public content delivery networks (unpkg, cdnjs, jsDelivr, code.jquery.com) - map tiles and scripts loaded directly by your browser, which receive your IP address;
• public authorities, where required by law.

To prepare a One Click Trip, we send hotel and flight partners (LiteAPI/Nuitée and Travelpayouts/Aviasales) and - where the AI review is used - providers of artificial intelligence models only the parameters needed for the search or review (destination, dates, number and ages of travellers, planned places), never your name, email address or other data identifying you. When you follow a link to a hotel, flight, ticket or activity offer (e.g. Booking.com, Agoda, GetYourGuide), you leave the Service and the partner's website processes your data under its own privacy policy; affiliate links contain only identifiers of Holiday Plan and of the page with the link, and the search parameters of the offer (e.g. destination and dates), not data identifying you.

We do not sell personal data and do not use it for advertising.

Some of the providers listed above (e.g. Cloudflare, Google and Grafana Labs) may process data outside the European Economic Area, in particular in the United States. In such cases, data are transferred on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

You have the right to:

• access your data and receive a copy of it;
• rectify inaccurate data;
• have your data erased;
• restrict processing;
• data portability;
• object to processing based on our legitimate interest;
• withdraw your consent at any time, where processing is based on consent; this does not affect the lawfulness of processing before the withdrawal;
• lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise your rights, send a request to [email protected], preferably from the email address associated with your Account, so that we can verify your identity. We will respond within one month of receiving the request.

Providing personal data is voluntary, but necessary to create an Account, purchase the Pro Package or receive an answer to a message. Without it, we cannot provide these services.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The currency shown to you is suggested automatically based on your IP address, but you can change it at any time in the settings.

We set the following cookies, all of which are needed for the Service to work or to remember your choices:

• JSESSIONID - keeps you logged in during a session; deleted when the browser is closed;
• XSRF-TOKEN - protects forms against forged requests; deleted when the browser is closed;
• remember-me - keeps you logged in if you select "Remember me"; valid for 30 days;
• HP_LANG - remembers the selected language; valid for 1 year;
• holidayplan_cookie_consent - remembers your cookie choice; valid for 1 year.

We do not set advertising or tracking cookies ourselves. Cloudflare may set a necessary security cookie (e.g. __cf_bm) to protect the Service against bots. On pages with a reCAPTCHA form, Google may set its own cookies. The Service also stores some interface settings in your browser's local and session storage. You can delete cookies and local storage at any time in your browser settings; blocking necessary cookies may prevent you from logging in.

Optional content. If you choose "Accept" in the cookie banner, trip pages also load the GetYourGuide activity widget. GetYourGuide then receives your IP address and may set its own cookies, including to attribute bookings to Holiday Plan. Legal basis: your consent (Art. 6(1)(a) GDPR). If you choose "Only necessary", the widget is not loaded. You can change your choice at any time using the Cookie settings link in the footer.

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), storing passwords only as cryptographic hashes, access control and regular backups.

We may update this Privacy Policy, for example when the law or the way the Service works changes. The current version is always available on this page, and registered users will be informed of material changes by email.