Who we are
OneSuitcase Travel ("OneSuitcase", "we", "us") is a travel design and small-group tour company based in Chicago, Illinois, United States. We are the controller of the personal information described in this policy.
You can reach us at hello@onesuitcase.com or +1 (312) 555-0148.
What we collect
We only ask for what a trip actually requires. That falls into three groups.
Information you give us
- Your name, email address and phone number when you send an enquiry, request a trip plan, or subscribe to our newsletter.
- What you tell us about the trip you want — dates, budget, who is travelling, and what matters to you.
- Correspondence: the emails, messages and call notes that make up our conversation with you.
Information needed to book travel
Once you book, suppliers require details we would not otherwise ask for:
- Full name as it appears on your passport, passport number, expiry date, nationality and date of birth.
- Emergency contact details.
- Dietary requirements, and any medical, mobility or accessibility needs you choose to share so we can plan around them. Under data protection law this is sensitive information, and we handle it only with your explicit consent and only to arrange your travel.
- Travel insurance details, which several of our operators require before boarding.
We do not store full card numbers. Payments are taken by our payment processor or directly by the tour operator.
Technical information
Our web host keeps standard server logs — IP address, browser type, pages requested, timestamps — for security and troubleshooting. This website runs no third-party analytics, advertising or social tracking scripts.
How we use it and why we are allowed to
We use your information to:
- Answer your enquiry and design a trip for you.
- Make and manage bookings with hotels, operators, airlines, guides and other suppliers.
- Contact you before, during and after a trip, including in an emergency.
- Take payment and keep the accounting records the law requires us to keep.
- Send you trip news, if you asked for it. Every email has an unsubscribe link that works immediately.
Where the UK or EU GDPR applies, our legal bases are: performance of a contract with you (booking and running your trip); your consent (marketing emails, and any health or accessibility information you share); our legitimate interests (answering enquiries, improving what we offer, protecting the business); and legal obligation (tax and accounting records).
Sending information abroad
A trip to Italy means sending your details to Italy. When we transfer personal information outside your country — including outside the EEA or the UK — we do it because it is necessary to perform the contract you asked us to arrange, or under appropriate safeguards such as standard contractual clauses.
How long we keep it
Enquiries that do not become bookings are deleted within two years. Booking records are kept for seven years after travel, which is what tax and liability rules require. Passport details are deleted once the trip is complete and any supplier requirement has passed. Newsletter subscriptions last until you unsubscribe.
Your rights
Wherever you live, you can ask us to show you the information we hold about you, correct it, delete it, or stop using it for marketing. Where the GDPR applies you also have the right to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time.
If you are a California resident, you have the right to know what we collect and why, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, and we do not process it for cross-context behavioural advertising.
To exercise any of this, email privacy@onesuitcase.com. We will respond within 30 days and will not charge you for it. If you are unhappy with our response, you can complain to your local data protection authority — in the UK, the Information Commissioner's Office.
Keeping it safe
The site is served over HTTPS. Access to booking records is limited to the people who need it, protected by two-factor authentication, and reviewed periodically. No system is perfectly secure, but if a breach ever affected your information we would tell you and the relevant regulator without undue delay.
Children
Children travel with us often, always as part of a family booking made by an adult. We collect a child's details only from their parent or guardian, and only what a supplier requires. We do not knowingly collect information directly from anyone under 16.
Changes to this policy
If we change how we handle your information, we will update this page and change the date at the top. Material changes affecting existing travelers will be sent by email.