Privacy Policy

This Privacy Policy explains how 2TierTravel ("we", "us", "our") collects, uses, shares and protects personal data when you visit 2tiertravel.com, create an account, hold a membership or contact us.

For the purposes of the UK GDPR and EU General Data Protection Regulation, 2TierTravel of Lime Wall Road, Gibraltar is the data controller of the personal data described below. You can reach us at support@2tiertravel.com.

1. Personal Data We Collect

• Account details: first name, last name, email address, mobile number, password (stored only as a secure hash) and your membership number.
• Membership and billing data: plan, currency, trial and renewal dates, subscription status, invoice history and the last four digits and card type held by our payment processor. We never see or store your full card number.
• Sign-up source: whether you joined via a partner such as Anyscor, and any promotional code used.
• Usage and technical data: pages viewed, device and browser type, approximate country derived from your IP address (used to show the right currency), and error/diagnostic logs.
• Support and guidance content: messages you send to us, and questions you put to Ask Alex, our travel and health guidance assistant.

We do not ask for special category data. Please do not include health, religious or other sensitive details in messages to us or to Ask Alex.

2. Why We Use It and Our Legal Basis

• Contract: to create and secure your account, provide member access, take payment, manage trials, renewals and cancellations, and provide support.
• Legitimate interests: to keep the service secure, prevent fraud and abuse, measure sign-up and conversion performance in aggregate, and improve the member experience.
• Consent: for non-essential cookies, marketing emails and, where you have opted in, SMS or WhatsApp updates. You can withdraw consent at any time.
• Legal obligation: to keep accounting, tax and consumer-rights records, and to respond to lawful requests.

3. Who We Share Data With

We do not sell your personal data. We share it only with service providers who process it on our instructions:

• Stripe — payment processing, subscriptions, invoices and the billing portal.
• Our hosting and database provider — secure application hosting, authentication and data storage.
• Our travel booking provider — when you move through to the member booking platform to search or book, the details you enter there are processed by that provider and the supplier of the hotel, resort, car hire or activity you book.
• AI guidance provider — Ask Alex questions are processed by a third-party AI model provider to generate travel and health guidance.
• Email, and where you opt in, messaging providers — to send membership, renewal and service communications.

Some providers are located outside the UK/EEA. Where that happens, transfers are covered by UK/EU Standard Contractual Clauses or another lawful transfer mechanism.

4. How Long We Keep It

• Account and profile data: while your membership is active and for up to 24 months after it ends, so you can rejoin without losing your history.
• Billing and tax records: 6 years, as required by law.
• Support messages and Ask Alex history: up to 24 months.
• Technical and security logs: normally up to 12 months.

5. Your Rights

You have the right to:

• access a copy of the personal data we hold about you;
• correct inaccurate or incomplete data — you can edit most details on your profile page;
• erase your data where we no longer need it;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent to marketing or non-essential cookies at any time.

Email support@2tiertravel.com and we will respond within one month. If you are unhappy with our response you can complain to your national data protection authority — as a Gibraltar-based business our lead authority is the Gibraltar Regulatory Authority (GRA), and depending on where you live this may be the Irish Data Protection Commission or the UK Information Commissioner's Office.

6. Security

Access to member data is restricted by authentication and row-level database policies, traffic is encrypted in transit, passwords are hashed, and card data is handled solely by our PCI-compliant payment processor. No system is perfectly secure, so please use a strong, unique password and tell us immediately if you suspect unauthorised access to your account.

7. Children

Membership is for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

8. Cookies

Details of the cookies we use and how to control them are set out in our Cookie Policy.

9. Changes and Contact

We may update this policy from time to time and will change the "last updated" date above. Material changes affecting your rights will be notified by email. Questions: support@2tiertravel.com.

See also our Terms and Conditions.