Privacy policy

Little Traveller is a company registered in England and Wales. Our registration number and registered office will be published here before we begin trading.

We are the data controller for the information described here, and you can reach us through the contact details in the footer of every page.

We are run from the United Kingdom. We hold no stock and have no premises or staff in the United Arab Emirates: everything you order is bought and delivered there by independent partner businesses, on our instructions, for your booking. That is why your details reach a partner in Dubai on every order rather than only on some.

To take and deliver an order we collect: your name; the name your accommodation is booked under, if it is different; your email address; a phone number where the delivery is not to a hotel; where you are staying and, for a holiday let, its address; your arrival and departure dates; your flight number if you give us one; the ages of your children in months; what you ordered; and anything you write to us, whether in a note with your order, by email or on Telegram.

We use it to do the one thing you asked us to do: get the right equipment to the right room on the right day, and answer you while you are travelling. The lawful basis is that we need it to perform our contract with you.

If you leave feedback after your stay, we keep the rating and any comment. That is our legitimate interest in knowing whether the service worked.

Your flight number is used to check the flight's status from the day before you travel, so a delay moves the delivery rather than wasting it.

When you pay, Stripe also passes us the billing address held against your card — street, city, postcode and country. We keep it for two reasons: an invoice has to carry the address of the person being invoiced, and the country decides how the sale is treated for tax. It is not used to deliver anything, and it is the one thing here we could never ask you for later, because by then you are travelling.

We ask how old your children are because it decides what we suggest and what is safe to send — a cot suits a different child from a bed rail.

We store an age in months. We do not ask for and do not hold a child's name or date of birth, and the age is attached to your booking rather than to any record about the child.

The partner fulfilling your order is told the ages, because it is how they know which size to pick. They are not told who your children are, because we do not know either.

We never see or store your card details. Payment is handled by Stripe, who take the card details directly and tell us only whether the payment succeeded, along with the name on the card and a reference we use to issue refunds.

You can talk to us on Telegram instead of email if that is easier. It is optional, and nothing about your booking depends on it.

If you do, we store the chat id Telegram gives us — a number, not your account — the language you are writing in, and both sides of the conversation. We do not store your Telegram name, your username or your phone number, because we never ask Telegram for them.

The messages travel through Telegram and are stored in the app as part of your chat history, because a conversation with a bot is an ordinary Telegram chat. It is not end-to-end encrypted, and a chat with a bot cannot be. What Telegram holds about your use of their app is governed by their privacy policy rather than this one, and we can neither see it nor delete it on your behalf.

Before the bot will show you your booking it asks for your order reference and the email address on the order, and both have to match. That is so somebody who reads your reference over your shoulder cannot open your itinerary. The link between a chat and a booking expires thirty days after you leave.

Replies come either from the bot or from one of us, and either way our team can read the whole conversation beside your order — which is how a question you asked on Sunday is still known about on Monday. You can ask us to unlink a chat from your booking whenever you like, and you can block the bot in Telegram, which stops us reaching you there at all.

The partners in the UAE who buy your items and bring them to you are told what they need in order to do it: your name, where you are staying, your dates, your children's ages, the order reference and the items themselves. Your name because it is what a hotel desk matches a delivery against, and without it the equipment cannot be handed over.

If you are staying somewhere without a front desk — a holiday home or an apartment — they are also given the address, the delivery window and a phone number, because there is nobody to leave anything with and the driver has to be able to reach you on the day.

They are not given your email address, and they are never told what you paid.

Where a hotel is receiving the delivery on your behalf, we give the hotel the name your room is booked under, because that is what they match it against.

We use a small number of service providers who process data on our instructions: Stripe for payments; Resend to send you email; Supabase for our database, hosted in London; and Vercel to host the site. We also use a flight-status service, which receives only a flight number and a date. Telegram is not on that list, because if you message us there the messages travel on Telegram's terms rather than on our instructions — the section above says what that means for you.

Our website analytics does not use cookies and does not build a profile of you or follow you to other sites. We do not sell your data, and we do not share it for advertising.

Everything you order is bought and delivered in Dubai, so the details above go to our partners in the United Arab Emirates on every order — there is no version of this service where they do not. The UAE is not covered by the UK's adequacy regulations, which means a transfer there needs a lawful mechanism of its own, so we put a data transfer agreement in place with a partner before we share anything with them.

Our database is hosted in London. Some of our other providers process data in the European Economic Area and the United States under the transfer safeguards their own terms provide. Telegram is not a UK company either, so a message you send us there leaves the UK as soon as you send it — if you would rather your dates and your children's ages stayed on fewer networks, use email.

We set two cookies and neither is for advertising. One remembers the trip you are shopping for — your dates, where you are staying and your children's ages — so you do not have to type it on every page. The other remembers what is in your basket.

Both are necessary for the site to work as a shop, and both are removed when they expire or when you start again with a different trip. We do not use advertising or tracking cookies, which is why you are not asked to accept any.

We keep records of orders for six years after the end of the tax year they fall in, because company and tax law requires us to be able to produce them.

An enquiry you send through the form on this site reaches us as an email and is not kept in our database at all. We delete it from our mailbox within twelve months. A basket or trip left in a cookie disappears on its own well before that.

A Telegram conversation attached to an order is kept with that order, for the same six years, because it is part of the record of what we agreed and what we were told. A conversation with somebody who never ordered is deleted twelve months after we last heard from them, by something that runs every night rather than when one of us remembers. Deleting your side of it in Telegram is something only you can do and it does not reach our copy — ask us and we will delete ours.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us using it, or ask for it in a portable form. Ask us and we will do it — there is no form and no account to create.

Deleting an order we still have to keep for tax purposes is the one thing we may not be able to do in full. Where that applies we will tell you exactly what we are keeping and why, and we will delete everything else.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

If we change what we collect or who we share it with, we will update this page and change the date at the top.