Privacy Policy
1. Who we are
AALABU LIMITED (company number 16660516), registered office Office 13953, 182–184 High Street North, East Ham, London, United Kingdom E6 2JA, is the data controller for the personal data described in this policy.
2. What we collect
When you make a booking, we collect: your name, email address and phone number; your stay dates and guest composition (including children's ages, where relevant to pricing); whether you are travelling for work and your trip type, if provided; any special requests you choose to give us; your transfer selection, where applicable; messages you send us about your booking; and any review you choose to submit. aAlabu does not require you to create a customer account.
3. Payment data
Card details are entered directly into our payment provider's own secure interface and are not stored on aAlabu's systems. We do not store your full card number. We keep a payment reference from our payment provider so we can match your payment to your booking.
4. Booking recovery data
Because aAlabu does not require an account, we let you access a booking using your booking reference together with the email address you booked with, or a recovery link we send to that email. Your browser also stores a small, device-local recovery token so your booking stays accessible on that device.
5. Technical data
We collect standard technical and session information needed to operate the site securely. See our Cookie Policy for details of the specific technologies involved.
6. Special requests and sensitive information
The special-requests field on our booking form is free text intended for ordinary booking preferences (for example, a room location preference). We do not ask you for health, religious, or other sensitive information. If you voluntarily include information of that kind in a special request (for example, an accessibility need), we process it only to try to fulfil that specific request, and we ask that you share only what is necessary for us to act on it.
7. Why we use your data
We use your booking and stay details, and any special request you give us, because it is necessary to perform your booking (a contract with you). We use your payment reference because it is necessary to perform your booking and to meet our own accounting obligations. We do not use your data for marketing, and we do not currently offer a marketing opt-in.
8. Who we share it with
- The accommodation provider you book with, to the extent needed to fulfil your booking (for example, your name, stay dates, and any relevant request or transfer selection).
- Our payment provider, to process your payment.
- Our transactional email provider, to send booking confirmations, recovery links, and service messages about your booking.
- Our hosting and infrastructure providers, who store and run the platform on our behalf.
We retrieve publicly available reputation information about properties (such as a public rating) from third-party sources on our own server; this does not involve sending your personal data to that source.
9. International transfers
Where a service provider processes data outside the UK, we rely on the safeguards recognised under UK data protection law for that kind of transfer.
10. How long we keep it
We keep personal data only for as long as necessary for the purposes described in this policy, including to fulfil your booking, to meet legal, accounting, and tax record-keeping obligations, to handle disputes or fraud, and for reasonable operational purposes such as security logs. We are currently finalising the exact retention periods for each category of data as part of our launch preparation; this policy will be updated once those periods are confirmed.
11. Your rights
Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your personal data, and the right to receive certain data in a portable format. Contact aalabu@aalabu.com to exercise these rights.
12. Complaints
If you believe we have mishandled your personal data, you can complain to the Information Commissioner's Office (ico.org.uk), the UK's data protection regulator.
13. Changes to this policy
We will update the version and effective date shown above if this policy changes materially.