Privacy Policy

Last updated: [20 April 2026]

Protecting and using your personal data responsibly is very important to us. This Privacy Policy explains what happens to any personal data you provide to us, or that we collect about you, and the rights you have over it.

Who we are

This policy applies to personal information processed by or on behalf of:

• Book-O-Tel Limited, trading as arrangeMY (company number 03084962, ICO registration number ZA191843)
• Integrated Business Travel Ltd, trading as arrangeMY travel (company number 02682152)

Registered office: Unit 7 Berkeley Business Park, Wainwright Road, Worcester, WR4 9FA, United Kingdom.

In this policy, “arrangeMY”, “we”, “us” and “our” refer to both companies. For any questions about this policy or your personal data, email us at bookings@arrangemy.com.

When we collect your information

We may collect information about you when you:

• visit our website
• make a booking, or have a booking made on your behalf
• contact us by telephone or email
• receive a communication from us relating to your service

If you make a booking on behalf of another traveller, please draw their attention to this policy, as it explains how we will use their information.

What personal information we collect, and why

UK data protection law (the UK GDPR and the Data Protection Act 2018) requires us to have a “lawful basis” for processing personal data. The table below shows the lawful basis we rely on for each type of information we hold.

The travel data we store may include your name, address, email address, travel destinations and schedules, seating preferences, smoking or non-smoking accommodation, meal preferences, reservation information and passport details.

Traveller Profiles and booking records

When we provide services to a corporate client, we may create a “Traveller Profile” for each traveller. This holds their travel data and is consulted each time a reservation is made. When a reservation is made, a “Passenger Name Record” (PNR) is created, containing the information needed to fulfil that traveller’s request.

Complaints, disputes and business transfers

We may use any of your personal data to handle a complaint about our service or to review legal rights or obligations, either to perform our contract with you or in our legitimate interest in resolving disputes.

If we sell or transfer any part of our business, we may share your personal data with the prospective or actual purchaser. We do this in our legitimate interests (and theirs) so the business can be properly valued and the purchaser can continue providing services to you after the acquisition.

Do you have to provide your information?

Providing Advance Passenger Information (APIS) is a legal requirement for certain travel, including flights. If you do not provide it, you will not be able to travel.

Otherwise, providing your personal information is not a legal requirement. However, the information requested on our website, or that a Business Travel Consultant tells you is required, is needed for us to make bookings and manage your travel. Without it, we cannot provide our services.

Who we share your information with

Travel providers. When you book travel through us, we pass your information to the suppliers of those services, such as airlines, hotels, car hire companies or third-party intermediaries. You will know who your booking is with when it is made. These providers act as independent “data controllers”: their own privacy policies explain how they use your information, and they are responsible for complying with data protection law.

Your employer. If you use arrangeMY trip to book work travel paid for by your employer, we may share details of the travel booked with them. Your employer also acts as a data controller for this information.

Your administrator or booker. If someone else books travel for you (an administrator appointed by your employer, or a team administrator booking personal travel), they will have access to the information you have given them to enter onto arrangeMY trip.

Service providers. We use trusted third parties to help us deliver our services, including travel intermediaries, IT support and cloud hosting providers. We have agreements in place that restrict how they can use your personal information.

International transfers

If you request a booking with a travel provider outside the UK (for example, a hotel in New York), we will need to transfer your personal data to that provider to make the booking and perform our contract with you. Where we use service providers outside the UK, we put appropriate safeguards in place as required by UK data protection law.

How we keep your information secure

Transaction details are encrypted to protect them. However, no transmission of information over the internet is completely secure, and we cannot guarantee the security of data sent to us online; any transmission is at your own risk. You are responsible for keeping your arrangeMY trip password confidential.

ISO 27001 certification

arrangeMY is one of a small number of travel management companies certified to ISO 27001, the internationally recognised standard for information security management. An accredited, independent third-party auditor has assessed our processes and controls and confirmed they meet the standard.

Certification requires us to continually:

• systematically evaluate our information security risks, taking account of threats and vulnerabilities
• design and maintain a comprehensive set of security controls and risk management measures
• follow an overarching management process so those controls keep meeting our security needs

Our certification covers our Head Office in Worcester, our Data Centre in MediaCity, Manchester, and our IT Tech Team in Ombersley, Worcestershire, all within the UK. Its scope includes the business processes, systems, infrastructure, personnel, facilities and traveller data under arrangeMY’s control, or managed through arrangeMYTrip (SABScorp) and arrangeMYData (Travelogix). Its purpose is to protect the confidentiality, integrity and availability of the information we hold.

How long we keep your information

We keep your personal information in arrangeMY trip and our in-house systems while you are an active client, and for up to seven years after you leave our service. Information held on arrangeMY trip may be deleted one year after you stop being an active client.

In some cases we may need to keep information for longer, for example where required by law, for tax or record-keeping purposes, or to defend legal claims.

Cookies

[Our website uses cookies to make it work properly and to help us understand how visitors use it. Non-essential cookies, such as analytics cookies, are only set with your consent, which you can change at any time through our cookie banner. For full details of the cookies we use, please see our Cookie Policy.]

Your rights

Under UK data protection law, you have the right to:

• Access – request a copy of the personal data we hold about you
• Rectification – ask us to correct inaccurate or incomplete data
• Erasure – ask us to delete your data in certain circumstances
• Restriction – ask us to limit how we use your data in certain circumstances
• Data portability – receive data you provided to us in a reusable format, where processing is based on consent or contract
• Object – object to processing based on our legitimate interests
• Withdraw consent – where we rely on your consent, you can withdraw it at any time

Some rights depend on the lawful basis we use (see the table above). To exercise any of them, email bookings@arrangemy.com. We will respond within one month.

Concerns and complaints

If you have any concerns about how we handle your personal information, please contact us at bookings@arrangemy.com and we will do our best to resolve them.

If you believe we have not met our obligations under data protection law, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

We review this policy at least every 12 months and may update it from time to time. The latest version will always be published on this page, with the date it was last updated shown at the top.