Privacy Policy — Adonis Global

This Privacy Policy explains how Adonis Global Ltd (“Adonis Global”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use Adonis Hub at travel.adonisgroup.us — including travel program bookings, our multi-vendor marketplace (courses, digital products, and books), vendor accounts, and related services (together, the “Platform”). Physical/shippable goods are not currently offered on the Platform.

01 Who We Are

Adonis Global Ltd is the data controller for personal data processed through Adonis Hub at travel.adonisgroup.us, except where a Vendor (defined below) acts as an independent controller for order fulfilment data they receive directly from you.

We are registered in England and Wales under company number 17270636, with registered office at Unit 82a, James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, England.

Data protection contact: privacy@adonisgroup.us

02 Scope and Applicable Law

This Policy is designed to meet the requirements of the UK GDPR, the Data Protection Act 2018, and the EU General Data Protection Regulation (GDPR) where it applies to our processing. It also includes disclosures for users in other jurisdictions, including California (CCPA/CPRA) and, where relevant, Canada (PIPEDA) and Brazil (LGPD).

Nothing in this Policy limits mandatory data-protection or consumer rights that apply to you under the laws of your country or state of residence.

03 Personal Data We Collect

We collect only the data reasonably necessary to operate the Platform. The categories below depend on how you use our services.

Category	Examples	Typical users
Account & identity	Name, email address, Firebase user ID, profile photo (e.g. from Google sign-in), display name, language preference	All registered users
Contact	Phone number, WhatsApp/Telegram (if provided on a vendor profile), support messages	Buyers, vendors, bookers
Booking data	Travel program selected, guest name, phone, payment method choice, booking notes, booking status	Travel bookers
Order & transaction data	Products purchased, order ID, amounts, currency, delivery/access status, refund/dispute records	Marketplace buyers & vendors
Payment data	Payment status, Stripe customer/payment-intent identifiers, last four digits and card brand where returned by Stripe. We do not store full card numbers.	Paying users
Vendor & seller data	Business/display name, bio, specialisation, website, product listings, commission and sales records, wallet balance, withdrawal requests and payout details you submit	Vendors
Verification data	Government ID, licences, permits, proof of address, or other documents submitted for vendor or guide verification	Vendors / travel providers
Technical & usage	IP address, browser type, device information, pages viewed, session logs, error diagnostics, timestamps	All users
Preferences & local storage	Language choice (stored in browser local storage), cookie/consent choices where applicable	All users

We do not intentionally collect special category data (such as health information) unless you voluntarily include it in booking notes or support messages. Please avoid sharing sensitive personal data unless strictly necessary.

04 How We Use Personal Data

Purpose	Legal basis (UK/EU GDPR)
Creating and managing your account; authenticating sign-in (email/password or Google)	Contract; Legitimate interests (security)
Processing travel bookings and marketplace orders; delivering digital access links or fulfilment instructions	Contract
Processing payments, refunds, vendor wallets, and withdrawal requests via Stripe and our backend	Contract; Legal obligation (tax/accounting)
Reviewing and approving vendor listings; verifying identity and credentials	Legitimate interests; Legal obligation where applicable
Customer support, dispute handling, and fraud prevention	Legitimate interests; Legal obligation
Sending transactional communications (confirmations, receipts, account notices)	Contract; Legitimate interests
Platform announcements via the on-site news bar (non-personalised)	Legitimate interests
Marketing emails or promotional messages	Consent (where required). You may opt out at any time.
Improving Platform performance, security, and user experience	Legitimate interests
Complying with law, regulatory requests, and enforcing our Terms	Legal obligation; Legitimate interests

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects without appropriate safeguards and, where required, your consent.

05 Cookies and Similar Technologies

We use cookies, local storage, and similar technologies as follows:

Strictly necessary: Authentication session cookies/tokens (e.g. Firebase Auth), security, and core Platform operation. These cannot be disabled if you wish to use account features.
Functional / preference: Remembering your language selection (e.g. siteLang in local storage).
Analytics (if enabled): To understand aggregated usage. Where required by law, we will request consent before non-essential analytics cookies are placed.
Marketing (if enabled): Only with your consent where required.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent sign-in or checkout from working correctly.

06 How We Share Personal Data

We do not sell your personal data. We do not share it for cross-context behavioural advertising as defined under California law.

We may share personal data with:

Vendors / travel providers: When you book or purchase, we share information needed for fulfilment (e.g. your name, contact details, order/booking details). Vendors may be independent controllers of that data for fulfilment purposes.
Payment processor — Stripe, Inc.: To process payments, refunds, and connected payouts. Stripe’s privacy policy applies to its processing: stripe.com/privacy.
Cloud infrastructure — Google Firebase / Google Cloud: Authentication, database (Firestore), file storage, and serverless functions. Google acts as a processor under applicable data-processing terms.
Professional advisers and insurers: Where reasonably necessary for legal, accounting, or risk purposes.
Law enforcement and regulators: When required by applicable law, court order, or to protect rights, safety, and Platform integrity.
Business transfers: In connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality safeguards.

07 International Data Transfers

Our service providers may process data in the United Kingdom, the European Economic Area, the United States, and other countries. Where personal data is transferred outside the UK or EEA to a country without an adequacy decision, we implement appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or equivalent mechanisms permitted by applicable law.

You may request further information about transfer safeguards by contacting privacy@adonisgroup.us.

08 Data Retention

We retain personal data only for as long as necessary for the purposes described above:

Active accounts: For the life of the account and up to 2 years after closure (unless a longer period is required).
Bookings, orders, and payment records: Up to 7 years for accounting, tax, and legal compliance.
Vendor verification records: For the duration of the vendor relationship and as required for disputes, regulatory, or safety purposes.
Marketing consent records: Until you withdraw consent, plus a reasonable period to demonstrate compliance.
Support and dispute records: Until resolved, plus any applicable limitation or regulatory period.

We may retain anonymised or aggregated data that no longer identifies you.

09 Security

We implement appropriate technical and organisational measures, including encryption in transit (TLS/HTTPS), access controls, and secure cloud hosting. Payment card data is handled by Stripe in accordance with PCI-DSS standards; we do not store full card details on our servers.

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential.

10 Your Rights (UK & EU / EEA)

Subject to applicable law, you may have the right to:

Access — obtain a copy of your personal data.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion in certain circumstances.
Restriction — limit how we use your data.
Data portability — receive data you provided in a structured, machine-readable format.
Object — to processing based on legitimate interests or for direct marketing.
Withdraw consent — where processing is based on consent, without affecting prior lawful processing.
Lodge a complaint — with a supervisory authority.

To exercise these rights, email privacy@adonisgroup.us. We will respond within one month (extendable by two months for complex requests, as permitted by law). We may need to verify your identity.

11 Additional Disclosures by Region

California residents (CCPA/CPRA)

In the preceding 12 months we may have collected the categories of personal information listed in Section 03 for the business purposes in Section 04. We do not sell or share personal information for cross-context behavioural advertising. California residents may request access, correction, deletion, and information about disclosures. We will not discriminate against you for exercising these rights. Submit requests to privacy@adonisgroup.us.

Other jurisdictions

Users in Canada, Brazil, and other countries may have additional rights under local law (e.g. confirmation of processing, anonymisation, or review of automated decisions). Contact us and we will respond in accordance with applicable requirements.

12 Children's Privacy

The Platform is intended for persons aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@adonisgroup.us and we will take appropriate steps to delete it.

13 Third-Party Links and Vendor Services

The Platform may link to third-party websites or allow vendors to provide external delivery links (e.g. course platforms, download URLs). Those third parties have their own privacy policies. Travel experiences may involve independent providers who process your data under their own terms once shared for fulfilment.

14 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email (where we have your address), a prominent notice on the Platform, or both. The “Last updated” date at the top indicates the current version.

15 Contact & Supervisory Authorities

Adonis Global Ltd
Unit 82a, James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, England
Email: privacy@adonisgroup.us

If you are in the United Kingdom and remain unsatisfied with our response, you may contact the Information Commissioner's Office (ICO): ico.org.uk · Helpline: 0303 123 1113.

If you are in the EU/EEA, you may lodge a complaint with your local data protection authority. A list is available at: edpb.europa.eu.