Legal
Privacy policy
What we collect, field by field, why, on what legal basis, for how long, and where it goes. Written to be checked rather than skimmed.
Last reviewed 2026-09-11.
Who we are
Kanes Travel Agency Longford Limited, of 27 Ballymahon Street, Longford, N39 K5A4, Ireland, is the data controller for everything described here. You can reach us at info@kanestravelagency.com or +353 43 333 4500. We are not required to appoint a Data Protection Officer and have not appointed one; enquiries about data protection go to the address above and are answered by the company.
We do not ask you to consent in order to contact us
There is no tick-box on this site that you must accept before a form will submit. Answering an enquiry is processing that rests on Article 6(1)(b) of the GDPR, steps taken at your request before entering into a contract. Consent under Article 6(1)(a) is a different basis, and consent demanded as the price of sending a message would not be freely given within the meaning of Article 7(4). The only consent we rely on anywhere is the optional marketing opt-in, and the non-essential cookie choices described in the cookie policy.
The trip enquiry form
Purpose: to read your enquiry, check what is available for your dates, and reply with options and a written quotation.
Required fields
These rest on Article 6(1)(b). We cannot answer you without them, which is what makes them necessary for the step you asked us to take.
| Field | Why we need it | Lawful basis |
|---|---|---|
| Your name | To address the reply and the quotation. | Art. 6(1)(b) |
| Email address | To send you options and the written quotation. | Art. 6(1)(b) |
| Destination | A trip cannot be priced without knowing where it goes. | Art. 6(1)(b) |
| Approximate dates | Price and availability depend entirely on the dates. | Art. 6(1)(b) |
| Number of travellers | Room, cabin and fare type depend on the party. | Art. 6(1)(b) |
| Your message | The enquiry itself. | Art. 6(1)(b) |
Optional fields
An optional field cannot sit under Article 6(1)(b), because that basis covers only what is necessary for the requested step, and a field you may leave blank is not necessary by definition. These therefore rest on Article 6(1)(f), our legitimate interest in giving you a useful first answer rather than a list of questions. Article 21 gives you the right to object to processing on that basis, and leaving any of them blank makes no difference to the answer you receive.
| Field | Why we need it | Lawful basis |
|---|---|---|
| Telephone number | So a consultant can ring rather than exchange six emails. | Art. 6(1)(f) |
| Budget in mind | So the first set of options is realistic rather than a guess. | Art. 6(1)(f) |
| Planner itinerary | The itinerary you chose to attach, stored in words. | Art. 6(1)(f) |
| Marketing opt-in | Only if you tick it. Off by default and withdrawable at any time. | Art. 6(1)(a) |
The contact form
Purpose: to read and answer enquiries addressed to us, from consumers and businesses alike, including questions about an existing booking, complaints, corporate travel and data protection requests.
| Field | Why we need it | Lawful basis |
|---|---|---|
| Your name | Required. To address the reply. | Art. 6(1)(b) |
| Email address | Required. To reply to you. | Art. 6(1)(b) |
| Subject | Required. To route the message to the right person. | Art. 6(1)(b) |
| Your message | Required. The correspondence itself. | Art. 6(1)(b) |
| Telephone number | Optional. Leaving it blank changes nothing about the reply. | Art. 6(1)(f) |
Technical data we keep
When you submit either form we store a one-way SHA-256 hash of your IP address, salted, so that the form cannot be flooded. The hash cannot be reversed to an address, it is never used to identify or profile anyone, and it rests on Article 6(1)(f), our legitimate interest in operating a website that stays available. Our web server also writes ordinary access logs, which are rotated and deleted within 14 days.
The itinerary you build in the planner is calculated in your own browser. It is only sent to us if you choose to attach it to an enquiry, and it is stored on your device only if you have allowed preference storage in the cookie banner.
How long we keep things
- Enquiries that do not become bookings: deleted after 24 months.
- Correspondence: deleted after 24 months, unless it relates to a booking, a complaint, or a legal obligation that requires us to keep it longer.
- Booking records: kept for the period Irish tax law and travel-trade obligations require, which is currently six years from the end of the relevant accounting period.
- Marketing opt-ins: until you withdraw them, and we act on a withdrawal immediately.
- Web server access logs: 14 days.
Who else sees your data, and where it is
We do not sell personal data and we do not share it for anyone else's marketing. It is disclosed only to the parties below, and only as far as it has to be.
- Travel suppliers. To make a booking we must pass the traveller details to the airline, hotel, cruise line, tour operator or insurer concerned, and sometimes to authorities at the destination where entry rules require it. Which suppliers those are depends on your trip and is stated in your quotation.
- Namecheap, Inc. hosts this website and its database, in the United States (Los Angeles, California).
- Namecheap Private Email (privateemail.com) handles email for www.kanestravelagency.com, in the United States.
- Microsoft Advertising receives advertising measurement data only if you switch on advertising measurement in the cookie banner. If you do not, nothing is loaded and nothing is sent.
We deliberately do not use a content delivery network, a website analytics provider, a customer relationship system, a live chat widget, or an embedded social media or mapping service. Fonts are served from our own server rather than a font network, so loading a page on this site sends your IP address to no third party at all.
Transfers outside the European Economic Area
This is the part many websites get wrong, so it is stated plainly. Our server is operated by Namecheap, Inc. in the United States, which is a third country for the purposes of Chapter V of the GDPR. That was measured from inside the server itself on 2026-09-11 rather than read from a geolocation database. Email for our domain is likewise handled in the United States.
Personal data you submit through this website is therefore transferred to the United States. The transfer relies on Standard Contractual Clauses (GDPR Article 46(2)(c)). We do not claim that this site processes data only within the European Economic Area, because that would not be true.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it erased where we have no overriding reason to keep it, to restrict how we use it, to receive it in a portable form, and to object to processing that rests on our legitimate interests. Where processing rests on your consent, you can withdraw that consent at any time without affecting what was lawful before.
Write to info@kanestravelagency.com or to the registered address, or use the contact form and choose "A data protection request". We answer within one month, as Article 12(3) requires.
If you are not satisfied, you can complain to the Irish supervisory authority: the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, telephone +353 1 765 0100, dataprotection.ie.
Security
The site is served over HTTPS only. The database listens on the server's loopback interface and is not reachable from the internet. Database credentials are held in a file outside the application directory, readable only by the account the application runs as. Forms are protected against cross-site request forgery and rate limited. None of this makes a breach impossible; if one occurs and it is likely to result in a risk to your rights, we will notify the Data Protection Commission within 72 hours and tell you where the law requires it.
Children
This site is not directed at children and we do not knowingly collect data from them. Where a family booking includes children, their details are given to us by an adult making the booking and are processed as part of that booking.
Changes
If this policy changes we update the review date at the top. Material changes affecting how we use data already collected will be notified to the people affected rather than left to be discovered here.
Who is responsible for this website
Kanes Travel Agency Longford Limited, a private company limited by shares registered in Ireland under company number (CRO) 63823, with its registered office at 27 Ballymahon Street, Longford, N39 K5A4, Ireland. Telephone +353 43 333 4500, email info@kanestravelagency.com.