Privacy Policy
Last updated: 12 July 2026
We only use personal data when it is needed to operate the website, answer messages, fulfil shop orders, keep the service secure or load optional third-party content you have accepted.
1. Who is responsible for your data?
MSL Holidays, operating under the trade name MSL Holidays, is responsible for the processing described in this policy.
- Business status
- [TO BE COMPLETED BEFORE SHOP LAUNCH — business registration pending]
- Address
- [TO BE COMPLETED BEFORE SHOP LAUNCH — full business address, Netherlands]
- info@mslholidays.com
- Website
- https://mslholidays.com
2. Personal data we process
Depending on how you use MSL Holidays, we may process:
- name, email address and the contents of messages sent through the contact form;
- account details, encrypted passwords and account activation information;
- billing and delivery details, order contents, payment status and limited payment metadata;
- saved addresses and customer-service correspondence;
- IP address, browser details, requested pages, timestamps and security events;
- shopping-cart, session, currency and consent preferences;
- information generated when you choose to load YouTube, Google, GetYourGuide or Expedia content.
MSL Holidays does not store full payment-card details. Payments are handled by Stripe.
3. Why we use personal data
| Purpose | Legal basis |
|---|---|
| Responding to questions and requests | Steps requested by you and legitimate interests |
| Creating and managing customer accounts | Performance of a contract |
| Processing, delivering and supporting shop orders | Performance of a contract |
| Accounting, tax and statutory records | Legal obligation |
| Fraud prevention, security, abuse prevention and technical logs | Legitimate interests and, where applicable, legal obligations |
| Optional external media and affiliate widgets | Your consent |
4. Service providers and other recipients
Data may be shared only where necessary with hosting and email providers, payment provider Stripe, delivery providers used for an order, and professional advisers where required. If you consent to optional content, data such as your IP address may also be received by Google/YouTube, GetYourGuide or Expedia Group. Clicking an affiliate link takes you to the relevant partner, whose own privacy policy then applies.
5. International transfers
Some providers may process information outside the European Economic Area. Where required, the provider must use a recognised transfer mechanism, such as an adequacy decision or standard contractual clauses. You can avoid optional third-party transfers by selecting “Necessary only” in the cookie settings.
6. Retention
- contact messages are normally retained for no longer than 12 months after the conversation ends;
- security and form-abuse logs are normally retained for no longer than 12 months;
- guest shopping-cart identifiers expire after 30 days;
- account data is retained until the account is deleted or no longer needed;
- order and financial records may be retained for up to 7 years where required for administration, tax or legal claims;
- cookie preferences are stored for up to 180 days, after which we ask again.
7. Your rights
Subject to the conditions of the GDPR, you may request access, correction, deletion, restriction or portability of your data, or object to certain processing. You may withdraw consent at any time through .
Send privacy requests to info@mslholidays.com. We may ask for information needed to verify your identity. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Security
We use proportionate technical and organisational measures, including HTTPS, access controls, CSRF protection, password hashing and payment processing through Stripe. No internet service can guarantee absolute security.
9. Children
The website and shop are not intentionally directed at children under 16. If you believe a child supplied personal data without appropriate permission, contact us so we can review and remove it where required.
10. Changes
We may update this policy when the website, suppliers or legal requirements change. The latest version and update date will always be published on this page.