Privacy

This Privacy Policy explains how personal information is collected, used, stored, shared, and protected through jimsmithtravel.com only, including the following enquiry forms and conversation:

• The Dream Builder conversation at /dream;
• The Start Planning trip-enquiry form at /start-planning; and
• The Business & Groups enquiry form at /business-and-groups.

When a record is created. Nothing is saved from the Dream Builder conversation until you give your contact details and agree to this Policy. From the point you agree, a record of your enquiry is created and saved, and it is updated as the same record as the conversation continues. If you stop part way through, the record holds the part of the conversation that had taken place up to that point, and nothing further is added. No record is created, and nothing is written, before you agree. For the Start Planning and Business & Groups forms, a record is created when the form is submitted.

The website and related enquiry services are owned and operated by Jim Smith, trading as Jim Smith Travel, an individual sole proprietor. Jim Smith is an Independent Travel Advisor of Fora Travel.

Jim's travel planning services are provided through his affiliation with Fora Travel, a licensed travel agency. Jim Smith Travel is an independently owned and operated business and is not owned by, operated by, or a branch of Fora Travel. The Fora affiliation statement is maintained in all client-facing materials.

For purposes of applicable data-protection laws, Jim Smith, trading as Jim Smith Travel, is the controller or business responsible for personal information collected through the website, except where a third party independently determines how it uses information under its own privacy policy.

This Policy applies to information submitted through the website forms and to related communications and enquiry records. It does not necessarily apply to third-party websites, booking platforms, travel suppliers, or Fora Travel's own services, which may have separate privacy policies.

Jim may use personal information to:

• Respond to travel enquiries;
• Contact an individual by email or phone using the selected preferred contact method;
• Understand travel preferences, needs, destinations, dates, and group composition;
• Prepare travel recommendations, itineraries, proposals, and quotations;
• Arrange, coordinate, and fulfil travel bookings;
• Communicate with airlines, hotels, tour operators, cruise companies, insurers, destination providers, and other travel suppliers;
• Provide travel-advisory and client-support services;
• Process or assist with booking-related requests and payments where applicable;
• Maintain enquiry, client, booking, tax, accounting, and business records;
• Protect the website, accounts, systems, and business against fraud, misuse, and security threats;
• Improve the website, services, and client experience;
• Comply with legal, regulatory, insurance, accounting, and professional obligations; and
• Send travel information, news, or marketing communications where the recipient has agreed to receive them or where otherwise permitted by applicable law.

Submitting a travel enquiry does not automatically subscribe a person to marketing communications unless the applicable form or subsequent communication clearly states that it does and obtains any consent required by law.

Marketing communications may be stopped at any time by using the available unsubscribe method or by contacting Jim at info@jimsmithtravel.com.

Jim communicates with clients by email, telephone, and text message.

A client's mobile number is collected where the client provides it and is used to contact the client about travel arrangements, including trip planning, itinerary coordination, time-sensitive updates, and other service-related communications.

Jim Smith's mobile number is provided to clients once the engagement begins. The office number published on the website cannot receive text messages, so text communication takes place on the mobile number provided to clients.

Message frequency varies depending on the travel being planned.

A client may opt out of text messages at any time by replying STOP or by contacting Jim using the details in this Policy, and opt-out requests are honoured promptly. A request to stop text communication does not end the travel relationship, but it will end text contact.

Mobile numbers and the content of text messages are not sold, rented, or shared for advertising or marketing, and are not shared with suppliers except where necessary to arrange the travel.

Marketing or promotional text messages are sent only with the client's prior express written consent as required by the Telephone Consumer Protection Act and applicable law. Consent may be withdrawn at any time by replying STOP or by contacting Jim.

Message and data rates may be charged by the client's mobile carrier and are not within Jim's control.

The lawful bases for text communication are consent and the performance of a contract or steps prior to a contract, together with legitimate interests in communicating about the client's travel.

Mobile numbers and text message records are retained in line with the retention periods stated in this Policy. A client may ask for their mobile number to be corrected or deleted by using the contact details in this Policy.

Visitors and clients may contact Jim by telephone. The business telephone number published on the website is an office line that cannot receive text messages.

Calls to this business number are answered by an automated virtual receptionist acting on Jim's behalf. Callers are told at the start of the call that they are speaking with an automated assistant.

Calls to this line may be recorded. The purpose of recording is accuracy and record-keeping: so that the details a caller provides are captured correctly and passed to Jim, and so there is a reliable record of what was discussed.

Where recording is used, the lawful basis is:

• Consent, obtained at the start of the call; and
• Legitimate interests, in keeping an accurate record of enquiries and instructions.

If a caller does not wish the call to be recorded, they may say so at any time and the recording will be stopped. They may instead contact Jim by email at info@jimsmithtravel.com.

Callers in jurisdictions requiring the consent of all parties to a recording are asked for their agreement at the start of the call, and recording will not continue without it.

Recordings are used to generate a written note or transcript of the call for Jim's enquiry records. Call recordings, where made, and the transcripts produced from them are retained by the technology provider that supplies the automated virtual receptionist service (Marblism) in accordance with that provider's own retention arrangements, and are retrievable by Jim and by Marblism while they are held.

The transcript or written note forms part of the client enquiry record held in the systems described in this Policy and is retained in line with the retention periods stated in this Policy.

A person may ask for the recording of their call and the transcript of it to be deleted. Jim will action the request through Marblism (as the provider that holds or controls access to call audio and transcripts) and will confirm to the requester once it has been actioned. Jim will not use a recording or transcript for any purpose after such a request.

Call audio and transcripts are not used for advertising or to build advertising profiles, and are not sold or shared for marketing. Jim Smith Travel does not use call recordings or transcripts for voice identification, voice analytics, voice printing, or any other biometric purpose, and has not instructed Marblism to do so. Marblism's published documentation does not describe the application of voice analytics, speaker identification, voice printing, or other biometric processing to call audio or transcripts created by the automated virtual receptionist service.

The automated receptionist service is operated through the platform provider that hosts and supports Jim's website and business systems (Marblism). Any speech processing or speech recognition service used by Marblism processes the audio only to provide the service.

The website chat is text-based. A visitor types their messages and receives written replies. Voice input is not offered on the website.

Jim sends marketing and outreach emails, including cold email outreach and email campaigns to existing clients.

Every commercial email includes (i) a clear and conspicuous unsubscribe mechanism and (ii) Jim's valid physical postal address, as required by the CAN-SPAM Act. The postal address provided is a post office box registered to Jim Smith and satisfies the physical postal address requirement for commercial email identification. Opt-out and unsubscribe requests are honoured promptly, and no later than the deadlines set by applicable law and by major email providers' bulk sender requirements.

Marketing contact details are retained until consent is withdrawn or the person opts out. Recipients may object to, or withdraw consent from, marketing at any time without affecting service delivery. Where consent is the basis for marketing, consent can be withdrawn at any time.

Jim does not sell personal information. Jim does not share personal information for cross-context behavioural advertising.

Information may be shared with the following categories of recipients where reasonably necessary for the purposes described in this Policy:

Jim uses third-party service providers to operate the website, receive and store enquiries, communicate with prospective and current clients, and support travel-advisory services.

Personal data processed on Jim's behalf by service providers is governed by written terms under which the provider acts only on Jim's documented instructions, including (where applicable) a data processing agreement covering EU and UK personal data. Jim has such agreements in place, or is putting them in place, with each provider.

Website platform and business systems (Marblism). Marblism provides the website hosting, the website chat, and the automated virtual receptionist service. Marblism acts as a data processor on Jim's instructions and processes personal data (including, where used, audio and transcripts) only to provide these services.

Marblism has confirmed that customer data is processed and stored on Amazon Web Services (AWS) in the us-east-1 region (United States). Marblism may use sub-processors as part of providing the services, including:

• Cloud infrastructure providers (including AWS); and
• AI inference providers (including OpenAI, Anthropic, and Google), where inference may be routed under contracts that prohibit training on inference data and require zero or short-term retention.

Marblism has confirmed that customer content is not used to train models. A full sub-processor list and a data processing agreement are available from Marblism on request.

Form submission workflow (Google Apps Script → Google Sheets). When a form is submitted on the static website, the website sends the submission to a Google Apps Script web app deployed under Jim Smith's own Google account, which writes the submission into a Google Sheet that Jim owns and controls. The website itself holds only the Apps Script web app URL and does not contain credentials or store enquiry data.

Google (Google LLC). Google Sheets and Google Apps Script (Google Workspace services) are used as a data-processing service for enquiry and client records. Jim owns and controls the relevant Google Sheet and determines why the information is collected and how it is used. Google LLC processes the information on Jim's instructions and only to provide Google Sheets and Google Apps Script services. The Google Sheet is private (not shared publicly or via a public link) and access is limited to Jim.

Email (Hostinger). Form submissions are also delivered by email to info@jimsmithtravel.com using Hostinger. Hostinger provides email hosting and stores and transmits the enquiry notification emails and client correspondence sent to and from info@jimsmithtravel.com on Jim's behalf and on Jim's instructions, processing the data only to provide the service.

Jim relies on reasonable security features made available by service providers, which may include encryption in transit and at rest, account authentication, access controls, system monitoring, backups, and other measures described by the applicable provider.

Jim will limit access to enquiry records to authorised persons and will configure available security controls, including multi-factor authentication where enabled.

Third-party processing may involve storage or access on servers located outside the visitor's country. Processors are bound by written terms under which each acts only on Jim's documented instructions, and a data processing agreement is in place or being put in place with each provider. A current list of relevant processors and services is:

• Marblism (website hosting, website chat, automated virtual receptionist service);
• Google LLC (Google Workspace: Google Sheets and Google Apps Script); and
• Hostinger (email hosting provider for info@jimsmithtravel.com).

Jim retains information only for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining records, resolving disputes, enforcing agreements, meeting legal obligations, and protecting the business.

Retention periods:

• Unconverted enquiries: deleted after 24 months of inactivity, unless a longer period is reasonably necessary or legally required;
• Active client and booking records: retained for the duration of the client relationship plus 7 years for tax and accounting purposes;
• Marketing contact details: retained until consent is withdrawn or the person opts out;
• Technical and security records: retained for the period reasonably necessary for website security, diagnostics, legal compliance, and business administration; and
• Backups: deleted or overwritten according to the applicable service provider's backup and deletion schedule.

Information may be retained longer where required by law, necessary to establish or defend legal claims, required by an insurer or professional adviser, or necessary to complete a requested service.

Subject to applicable law and any relevant exceptions, individuals may have the right to:

• Request access to personal information (including, where applicable, call recordings and transcripts);
• Request correction of inaccurate or incomplete information;
• Request deletion or erasure of personal information (including, where applicable, deletion of a call recording and its transcript, which may be held by a service provider on Jim's behalf);
• Request restriction of processing;
• Request portability of certain information;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Withdraw consent where processing is based on consent;
• Request information about how personal information is used and shared; and
• Complain to a relevant data-protection or supervisory authority.

Individuals in Colorado and other jurisdictions may have additional rights under applicable state privacy laws. These rights may apply only in certain circumstances and may be subject to lawful exceptions.

To exercise a right, email info@jimsmithtravel.com with:

• The nature of the request;
• The email address or other information associated with the relevant enquiry;
• Any information reasonably needed to verify identity; and
• The preferred method for receiving a response.

Where a request concerns data held by a service provider on Jim's behalf (for example, call recordings or transcripts stored through Marblism, or email correspondence stored through Hostinger), Jim will act through that provider to action the request and will confirm to the requester once it has been actioned.

Jim may request reasonable information to verify identity before disclosing, correcting, or deleting personal information. Jim will not request unnecessary sensitive information for verification.

Jim will respond without undue delay and generally within 30 days. Where applicable law permits a longer period, including 45 days or an extension for complex requests, Jim will explain the reason for the extension.

A person will not be discriminated against for exercising a privacy right. Jim may, however, be unable to provide a requested service if the information is necessary to provide that service or comply with a legal obligation.

Individuals in the EU or UK have the right to lodge a complaint with their local data-protection supervisory authority. Individuals in Canada may contact the Office of the Privacy Commissioner of Canada. Individuals in the United States may contact the relevant state attorney general or other applicable regulator.

Data subject requests from EU, UK, and Canadian visitors are handled using the same process described in this section.

Jim uses reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

These safeguards may include:

• Password-protected accounts;
• Access limited to Jim and authorised users;
• Multi-factor authentication where enabled;
• Secure service-provider accounts;
• Encryption and security features provided by service providers; and
• Reasonable procedures for handling privacy requests.

Marblism has confirmed that customer data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256.

No method of transmission over the internet or method of electronic storage is completely secure. Jim cannot guarantee absolute security.

The forms are intended for use by adults aged 18 or over.

A parent, guardian, or other adult may provide information about children or other minors travelling as part of a family or group booking. A person submitting information about another traveller confirms that they have authority to provide that information and request travel-planning services involving that person.

Jim does not knowingly collect personal information directly from children under 13 through the forms. If a parent or guardian believes that a child under 13 has submitted personal information directly, they should contact Jim at info@jimsmithtravel.com.

Jim is based in the United States, but some of the service providers he uses are established outside the United States, including in the European Union. Personal information may therefore be stored and processed in the United States and in the European Union, depending on the services used.

Marblism has confirmed that customer data processed for its services is processed and stored on AWS in the us-east-1 region (United States), and that inference may be routed to sub-processors (including OpenAI, Anthropic, and Google) under contracts that prohibit training on inference data and require zero or short-term retention.

Where information originates in the European Economic Area or the United Kingdom and a lawful transfer mechanism is required, transfers rely on appropriate safeguards such as Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum) or an equivalent lawful transfer mechanism recognised under applicable law.

Details of the transfer mechanism may be requested by contacting info@jimsmithtravel.com.

Jim maintains reasonable safeguards designed to prevent and respond to unauthorised access, acquisition, use, disclosure, alteration, or destruction of personal information.

If Jim determines that a security incident creates a legally required risk of harm, Jim will notify affected individuals and relevant authorities without unreasonable delay and in accordance with applicable law, including applicable Colorado data-security and data-breach-notification requirements.

Notification may be delayed where permitted or required by law, including where delay is necessary to avoid interfering with a law-enforcement investigation.

Jim may update this Policy from time to time to reflect changes in the website, services, technology, law, or business practices.

If a voice or audio feature is introduced on the website in future, this Policy will be updated before it goes live, and visitors will be told and asked for their agreement before anything is captured.

The updated Policy will be posted on jimsmithtravel.com with a revised effective date or last-updated date. Unless otherwise stated, changes take effect when posted.

The current version of this Policy is the version displayed on the website at the time of use.

Questions, privacy requests, and concerns may be directed to:

Jim Smith, trading as Jim Smith Travel
Jim Smith is an Independent Travel Advisor of Fora Travel.
Travel planning services provided through Fora Travel, a licensed travel agency
Email: info@jimsmithtravel.com
Office telephone: 303-664-4083 (office line; cannot receive text messages)
Mailing address: Jim Smith, trading as Jim Smith Travel, PO Box 300132, Denver, CO 80203

The mailing address listed above is a post office box registered in the name Jim Smith Travel and satisfies the physical postal address requirement for commercial email identification.

Jim Smith Travel is an independently owned and operated business and is not owned by, operated by, or a branch of Fora Travel.

Jim Smith operates as an independent travel advisor under the seller of travel registrations held by Fora Travel.

Fora Travel is registered as a Seller of Travel in:

• California, Registration No. 2151995-50; and
• Florida, Registration No. ST43973.

"Fora is registered with the State of Florida as a Seller of Travel Registration No. ST43973."

Jim Smith Travel maintains professional liability (errors and omissions) coverage through its host agency, Fora Travel.