This Privacy Policy explains how Odyssey DMC ("Odyssey DMC", "we", "us") collects, uses, shares, and protects personal data when you visit www.odysseydmc.com, contact us, or use our destination management services. We are registered in the United Arab Emirates, with our office at Office No. 311, Third Floor, Latifa Tower, Sh. Zayed Road, Dubai, UAE.

1. Who is responsible for your data

For website visitors, enquiries, and direct bookings, Odyssey DMC is the data controller. When a travel agent, tour operator, or corporate client sends us guest details to deliver a booking, that client is generally the controller, and we act as a processor or an independent controller for delivery purposes, depending on the arrangement.

Contact for privacy matters: enquiry@odysseydmc.com, Office No. 311, Third Floor, Latifa Tower, Sh. Zayed Road, Dubai, UAE

2. Data we collect

Information you give us

•         Contact details: name, email, phone, company, job title

•         Booking details: travel dates, itinerary preferences, party size, special requests

•         Traveller documents: passport details, nationality, date of birth, visa information (where needed for hotels, permits, or visas)

•         Payment details: processed through third-party payment providers; we do not store full card numbers

•         Health, dietary, or accessibility needs that you tell us about so we can arrange suitable services

•         Details of children travelling with you, provided by a parent or guardian

•         Communications with us, including emails, forms, chat, and call records

Information collected automatically

•         IP address, device and browser type, language, pages viewed, referring URLs, and time on site

•         Cookies and similar technologies (see Section 8)

Information from third parties

•         Travel agents, tour operators, and corporate clients making bookings for you

•         Hotels, transport, and activity providers involved in your trip

•         Analytics, advertising, and payment providers

3. Why we use your data and our legal basis

Where local law requires consent, such as for sensitive data like health information, we ask for it separately. You may withdraw consent at any time.

4. Who we share data with

We share personal data only as needed with:

•         Service providers for your trip: hotels, transport operators, guides, activity and campsite operators, airlines, and attraction ticketing partners

•         Our affiliates and group entities in other countries, where they support your itinerary

•         Technology vendors: hosting, CRM, booking and operations software, email, analytics, and payment processors

•         Professional advisers: lawyers, auditors, insurers

•         Authorities: immigration, tourism, and law enforcement bodies where required by law or to obtain permits and visas

•         Business transferees: a buyer or successor in a merger, acquisition, or restructuring

We do not sell personal data.

5. International transfers

We are based in the UAE, and our suppliers, systems, and partners operate globally, so your data may be transferred to and stored in countries other than your own. Where required, we rely on appropriate safeguards, such as adequacy decisions, standard contractual clauses, or your explicit consent for a specific transfer, and we require recipients to protect your data to a comparable standard.

6. How long we keep data

We keep personal data only as long as necessary for the purposes above, including legal, tax, and accounting requirements. As a general guide:

•         Booking and financial records: 7 years after the trip

•         Enquiries that did not become bookings: 6 months

•         Marketing data: until you unsubscribe or become inactive for 5 years

•         Traveller document copies: deleted 30 days after the trip unless the law requires longer

7. Your rights

Depending on where you live, you may have the right to:

•         Access the personal data we hold about you

•         Correct inaccurate or incomplete data

•         Request deletion of your data

•         Restrict or object to certain processing

•         Data portability (receive your data in a portable format)

•         Withdraw consent at any time

•         Object to direct marketing

•         Not be subject to solely automated decisions with legal effects (we do not currently make such decisions)

•         Complain to your local data protection authority

Regional notes

•         UAE: Rights under Federal Decree-Law No. 45 of 2021 (PDPL) and applicable free zone regimes.

•         EU/UK/EEA: Rights under the GDPR and UK GDPR. You may lodge a complaint with your national supervisory authority.

•         California and other US states: Rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information or share it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.

•         South Africa, Mauritius, Oman, and other jurisdictions: Equivalent rights under POPIA, the Mauritius Data Protection Act 2017, Oman's Personal Data Protection Law, and similar local laws.

To exercise any right, email. We may need to verify your identity, and we aim to respond within 30 days, or sooner where the law requires.

8. Cookies and tracking

We use:

•         Essential cookies for site function and security

•         Analytics cookies to understand site usage

•         Marketing cookies to measure campaigns and show relevant ads

Where required (EU, UK, and elsewhere), non-essential cookies are used only with your consent. You can change preferences through our cookie banner [link] or your browser settings. Some browsers send "Global Privacy Control" or "Do Not Track" signals, which we honour where legally required.

9. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, staff confidentiality obligations, and vendor due diligence. No system is completely secure, and we will notify you and the relevant authorities of a data breach where the law requires.

10. Children

Our website is not directed at children under 16, and we do not knowingly collect their data through it. Where children travel with a parent or guardian, we collect their details from that adult only to arrange the trip. If you believe a child has provided us data directly, contact us and we will delete it.

11. Third-party links

Our site may link to third-party sites, such as hotels, booking platforms, and social media. We are not responsible for their privacy practices, so please read their policies.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date shows the latest version, and we will notify you of material changes where required.

13. Contact and complaints

Questions or requests: enquiry@odysseydmc.com | +971 04 512 5224 | Office No: 311, Third Floor, Latifa Tower, Sh. Zayed Road, Dubai, UAE