Privacy Policy

• Full name — so we can address you correctly and include it accurately in your booking documents and traveler details.
• Email address — to send you travel options, booking authorization documents, payment confirmations, and booking confirmations.
• Phone number (optional) — to reach you if a time-sensitive question arises about your booking.
• Travel preferences and itinerary details — departure city, destination, travel dates, number of travelers, cabin preference, flexibility, and any other details you include in your request form or communications.
• Payment information — we do not collect or store full card numbers, CVV codes, or sensitive payment data directly. Payment processing is handled by a PCI-DSS compliant payment processor. See Cookies for more on third-party data flows.

• Respond to your travel request and present you with suitable options and associated costs.
• Prepare and send your written booking authorization document, including full itinerary, itemized cost breakdown, and billing descriptor details.
• Process payment after you have provided explicit written authorization — payment is never processed without your written approval.
• Send booking confirmations, ticket details, e-tickets, and any required follow-up documentation.
• Improve the quality of our service — for example, understanding what types of requests are most common, so we can serve future clients better.
• Maintain records for dispute resolution and regulatory compliance.

We retain booking records — including authorization documents, payment records, and itinerary correspondence — for 1 year from the date of the booking or the completion of the travel, whichever is later. This retention period exists to:

• Resolve any payment disputes or questions that arise after travel.
• Provide you with documentation if you need to reference a past booking.
• Comply with applicable financial record-keeping requirements under US law.

Enquiries that did not result in a booking are deleted after 6 months from the date of last contact.

After the applicable retention period, your data is deleted from our systems. If you request deletion before this period, we will accommodate your request where we are not prevented from doing so by a legal obligation (for example, a retained financial transaction record).

We share your personal information only as necessary to deliver the services you have requested:

• Airline and fulfillment infrastructure — traveler names, travel dates, and contact details are provided to airlines or booking systems as required to make a reservation on your behalf. This information is provided only after you authorize the booking in writing.
• Payment processor — payment card details are handled by our PCI-DSS Level 1 compliant payment processor. We do not receive or store your full card number. The processor's privacy policy governs their handling of payment data.

We do not sell your personal information to any third party. We do not share your data with advertising networks, data brokers, or analytics platforms. We do not use your data to build retargeting or lookalike audiences.

• Right to access — you can ask what personal information we hold about you and receive a copy.
• Right to correct — you can request correction of any inaccurate information we hold.
• Right to delete — you can request deletion of your personal information, subject to our legal retention obligations.
• Right to opt out of sale — we do not sell personal information. This right applies, but there is nothing to opt out of.

To exercise any of these rights, contact us at support@travelfirst.us. We will respond within 10 business days (or the timeframe required by applicable state law, whichever is shorter).

• Right of access (Article 15 GDPR) — you can request a copy of all personal data we hold about you.
• Right to rectification (Article 16 GDPR) — you can request correction of inaccurate data.
• Right to erasure (Article 17 GDPR) — you can request deletion of your data where we no longer have a lawful basis to retain it.
• Right to data portability (Article 20 GDPR) — you can request your data in a structured, machine-readable format.
• Right to object (Article 21 GDPR) — you can object to processing of your data in certain circumstances.
• Right to lodge a complaint — you have the right to lodge a complaint with your local supervisory authority (for example, the ICO in the UK, or the relevant DPA in your EEA country).

To exercise any of these rights, or to raise a privacy concern, contact us at support@travelfirst.us. We will respond within 30 days as required by GDPR Article 12.

This website uses session cookies to support form functionality — for example, preserving your form input while navigating between steps. These cookies expire when you close your browser and are not used for tracking or advertising.

We also store a single functional cookie (tf_cookies_accepted) to remember your cookie consent preference for 12 months.

We do not use:

• Advertising or retargeting cookies.
• Analytics cookies (such as Google Analytics).
• Social media tracking pixels.
• Persistent cross-session behavioural tracking cookies.

Ready to begin a travel request?