Privacy Policy

This Privacy Policy explains how T&T TRAVEL GROUP LTD ("we", "us", "Weekender") collects, uses and protects your personal data when you visit our website and use our services.

Who we are

T&T TRAVEL GROUP LTD is the data controller for the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018). You can reach us at hello@weekender.solutions, or by post at Unit C, Blackett Street, Manchester, England, M12 6AE. We are not required to have, and do not have, a Data Protection Officer.

What we collect

• Account details - your email address, and the one-time codes we send you to sign in. We do not use passwords. We also count how many sign-in codes we have sent you in the last 24 hours, so that one address cannot be used to make us send unlimited email.
• Sign-in sessions - for each device you are signed in on, we store the session, the IP address it was last seen from, your browser's user agent and when it was last active. This is what keeps you signed in, and it is also how we enforce the limit on how many connections one membership can be used from at once (see our Terms). A session is deleted when you sign out, when it expires, or when it is the one signed out to make room for a new connection.
• Newsletter details - the email address you give us when you subscribe to our deals email, and your subscription status.
• Membership & billing data - if you subscribe, we store your Stripe customer and subscription identifiers, which plan you are on, its status and renewal date, and the card brand and last four digits Stripe reports back. If you redeem a voucher, we store which voucher and when.
• Usage & analytics data - collected via Google Analytics and Hotjar: pages viewed, links and buttons clicked, device and browser type, approximate location (derived from your IP address), referring site, and anonymised interaction data such as scrolls, clicks and session recordings/heatmaps (Hotjar). See our Cookies Policy.
• Your shortlist - the weekend trips you save to your account (route, weekend and the price at the time you saved it).
• Airport requests - if you vote for an airport we do not cover yet, we store that vote and the email address you gave, so we can tell you when it goes live.
• Affiliate click data - when you click an outbound deal, hotel, car or experience link, we record that the click happened, which partner it went to, and the IP address it came from, so we can measure referrals and spot click fraud.
• Instagram and Facebook - if you comment on one of our Instagram or Facebook posts with a keyword, or message our Instagram account or Facebook Page, we receive through Meta your Instagram username or Facebook name, the ID Instagram or Messenger uses for you in our conversations, the comment or message text, and when it was sent. If you then give us your email address in a message, we store that too, along with which messages we sent you and whether you opened the link we sent.
• Technical & security data - server logs containing your IP address, user agent and the time of requests, used to operate and secure the site.

We never see or store your full card number. Membership payments are taken on Stripe's own hosted checkout page: your card details go directly to Stripe and reach us only as the card brand and last four digits. Flight and hotel bookings are not ours at all - they happen on the airline or partner website, under their own terms and privacy policies.

How we use your data

• To let you sign in to your account, and to keep the weekends you have shortlisted - shortlisting is a members-only feature, but what you saved is retained if your membership ends, so it is still there if you return.
• To take payment for membership, give you the features you have paid for, renew or cancel your subscription, and keep the records HMRC requires.
• To send you the newsletter you signed up for (and let you unsubscribe at any time).
• To email you once if an airport you voted for goes live.
• To send you service messages about your membership - most importantly, a reminder before an annual membership renews.
• To measure, understand and improve how the site is used and performs.
• To answer you on Instagram or Facebook when you ask for a deal's details: we reply to your comment, send you the details by direct message, and send the link to the email address you give us, followed by at most one reminder message if you have not opened it. Your email address is used for that link only - it is not added to our newsletter unless you separately sign up.
• To track affiliate referrals and our commission entitlement.
• To operate, maintain and secure the website and prevent abuse.

Legal bases

• Performance of a contract - for running your account and, if you subscribe, for taking payment and providing membership.
• Legal obligation - for keeping billing and tax records for the period UK law requires.
• Consent - for sending the newsletter, for emailing you about an airport you voted for, and for setting analytics/Hotjar cookies. You can withdraw consent at any time.
• Legitimate interests - for operating, securing and improving the site, for measuring affiliate referrals, and for answering the questions you send us on Instagram or Facebook, in a way that does not override your rights.

Who we share it with

We do not sell your personal data. We share data with service providers who process it on our behalf, including:

• Stripe (Stripe Payments Europe, Ltd. and its group companies) - to take and manage membership payments. Stripe acts as our processor when it charges you on our instruction, and as an independent controller in its own right for fraud prevention and for the anti-money-laundering and regulatory duties it has as a payment provider. See Stripe's privacy policy.
• Google Analytics (Google Ireland/LLC) - website analytics.
• Hotjar Ltd - product analytics, heatmaps and session insights.
• Our email delivery provider - to send the newsletter.
• Our hosting and infrastructure providers - to run the site.
• Meta Platforms (Meta Platforms Ireland Ltd) - Instagram, Facebook and Messenger carry our replies and messages to you. What you post or send there is also subject to Instagram's privacy policy or Meta's privacy policy for Facebook and Messenger.
• Affiliate networks and partners - when you follow an outbound link, that partner becomes responsible for the data it collects under its own policy.

International transfers

Some of our providers (for example Google, Hotjar, Stripe and Meta) may process data outside the UK/EEA. Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement or equivalent mechanisms.

Automated checks on payments

Stripe screens every payment for fraud automatically, scoring it on things like the card used, the country the request comes from, and patterns across its own network. A payment can be declined by that scoring without a person looking at it. This affects whether a payment goes through, not any wider decision about you, and we take no automated decisions about you ourselves. If a payment of yours is blocked and you think it should not have been, email hello@weekender.solutions and a human will look into it.

Emails you can and cannot turn off

• Marketing - the deals newsletter. Consent-based, and every one carries an unsubscribe link.
• Service messages - sign-in codes, and billing notices such as the reminder before an annual membership renews. These are part of running your account and your membership, so they are not marketing and there is no unsubscribe. If you do not want them, close your account or cancel your membership.

How we keep it safe

The site runs over HTTPS. There are no passwords on the public site to leak: signing in uses a single-use code sent to your email, and the code is stored only as a hash. We never receive your full card number - it goes straight from your browser to Stripe. Access to the admin panel is restricted to named accounts. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data, as UK data protection law requires.

How long we keep it

• Account - until you delete your account.
• Billing records - for six years after the end of the tax year they relate to, because UK tax law requires it. This applies even if you delete your account, and it is the one thing we cannot erase on request.
• Newsletter - until you unsubscribe or ask us to delete it.
• Airport requests - until the airport goes live and we have told you, or until you ask us to delete it.
• Affiliate click records - up to 24 months, which covers a partner's commission and dispute window.
• Instagram and Facebook conversations - deleted automatically 12 months after the last activity in them, or sooner if you ask. The raw notifications Meta sends us are deleted after 30 days.
• Analytics - for the retention period set in Google Analytics and Hotjar.
• Server logs - for a limited period for security and troubleshooting.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. Deleting your account removes your profile and shortlist; billing records are kept for the statutory period described above, because we are legally required to hold them. To exercise any of these, email hello@weekender.solutions. You can unsubscribe from the newsletter using the link in any email. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Deleting your Instagram or Facebook data

You do not sign in to Weekender with Instagram or Facebook; we only hold what you sent our Instagram account or Facebook Page, as described above. To have it deleted, email hello@weekender.solutions with the subject "Delete my Instagram or Facebook data" and your Instagram username or the name on your Facebook profile. We delete your comments, messages, email address and conversation record within 30 days and confirm by email when it is done. This does not delete anything from Instagram or Facebook itself - comments you posted stay there until you remove them.

Children

Weekender is not directed at children under 16 and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed.