Your privacy

Who we are and how to contact us

Tilly Travels is the data controller for the personal information described on this page, which means we decide what is collected and why. You can contact us at [email protected].

What information we collect

If you turn analytical cookies on, Google Analytics collects information about your visit, including events such as scrolling and downloads.

If you email us, we hold your email address and whatever you put in your message.

Your browser sends your IP address to our host every time you load a page.

If you use the "Share your trip" form on our contact page, we hold what you send us, along with any name and contact details you give so we can reply and credit you.

There's nothing on this site you have to sign up for or fill in, so giving us personal information isn't a statutory or contractual requirement.

Why we collect it and our lawful basis

Analytics. We use it to see how many people visit and which guides get read, so we know what to work on. Our lawful basis is your consent, which you give by turning analytical cookies on in the banner.

Email. We use it to read your message and reply to you. Our lawful basis is legitimate interests, the interest being answering people who get in touch.

Hosting. Our host needs your IP address to send you the page, and it also uses it to keep the site running and secure. Our lawful basis is legitimate interests, the interest being running the site and keeping it available and secure.

We don't make automated decisions about you and we don't profile you.

Cookies and your choices

You can change or withdraw your choice at any time using the Cookie settings link in the footer of any page. Our cookie policy has the detail on each cookie and the banner categories.

Who we share it with

Google Ireland Limited runs Google Analytics for us as our data processor, which means it handles that information on our instructions rather than for its own purposes.

Cloudflare, Inc. hosts this site on Cloudflare Pages and acts as our data processor. It records technical information, including your IP address, when it serves our pages.

Where your information is processed

Google Ireland Limited is based in Ireland, which the UK recognises as providing an adequate level of data protection.

As part of providing the service, Google Ireland Limited may pass information to Google LLC in the United States. Google protects that transfer using standard contractual clauses, and Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework.

Cloudflare may handle requests on servers outside the UK. Our contract with Cloudflare includes the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which is the safeguard for those transfers. Email us if you'd like a copy.

How long we keep it

Google Analytics is set to delete user-level and event-level data after 14 months. Google keeps its standard aggregated reports indefinitely.

We keep emails for as long as we need them to deal with what you wrote to us about, then we delete them.

Cloudflare keeps its logs for as long as it needs them to run and secure its network. We can't access those logs, and Cloudflare doesn't publish a fixed retention period for them.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access. You can ask us for copies of your personal information.
• Your right to rectification. You can ask us to correct personal information you think is inaccurate, and to complete information you think is incomplete.
• Your right to erasure. You can ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing. You can ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing. You can object to the processing of your personal information in certain circumstances.
• Your right to data portability. You can ask us to transfer the personal information you gave us to you or to another organisation, in certain circumstances.

Where we rely on your consent, as we do for analytics, you can withdraw it at any time. Withdrawing it doesn't affect anything we did with your consent beforehand.

You don't have to pay a charge to exercise your rights. Email us at [email protected] to make a request, and we have one month to respond.

How to complain

If you have concerns about how we've used your personal information, email us at [email protected] and we'll look into it.

You can also complain to the Information Commissioner's Office, the UK's data protection regulator, if you're unhappy with how we've used your data.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
ico.org.uk

Changes to this notice

If what we collect or how we use it changes, we'll update this page before the change goes live.

Last updated 15 July 2026.