Privacy Policy
What we collect, why, the legal basis for it, and your rights.
Draft · Effective 29 July 2026
Who we are
This website and the direct-booking and concierge services offered through it are operated by Vrelo Collection LLC, registered in Wyoming, United States, which is the controller of the personal data described here. This policy explains, in plain terms, how we handle the personal data of guests and visitors. For any privacy question, write to concierge@vrelocollection.com.
What we collect
We collect what we need to book and look after your stay: (a) details you give us — name, email, phone, booking preferences, any dietary or accessibility needs, and messages to the hosts; (b) reservation and payment records — bookings, amounts, and a payment reference (your card details are handled by our payment processor, not stored by us); (c) your Upstream account, if you join; and (d) limited technical data — IP address, device and browser type, and the usage needed to run and secure the site.
Health information for hosted journeys
If you reserve a hosted journey, we ask for limited health and fitness declarations (for example, regarding heat, cold water, walking, and allergies) so that we can host you safely and plan alternatives where needed. Because this is sensitive information, we collect it only with your explicit consent, use it only for the safe running of your journey, share it only with the hosts and, where strictly necessary, the partner delivering a specific activity, and delete it after your journey ends except where law requires otherwise. You may decline to provide any declaration; it simply means we will plan the relevant activity with you differently.
How we use it, and our legal basis
We use your data to confirm and manage reservations and provide what you ask for (to perform our contract with you); to run Upstream and remember your preferences (our legitimate interests, or your consent where required); to send service messages such as confirmations (contract) and, only if you opt in, occasional updates (consent); and to keep the site secure, prevent fraud, and meet legal duties (legitimate interests and legal obligation). You can withdraw consent at any time.
Sharing and processors
We share only what is necessary, and only with: the property or partner you book, so they can host you; the providers who work for us under contract (payment processing, email, hosting, and analytics); and authorities where the law requires it. We do not sell your personal data, and we do not share it with advertising networks. Providers may use it only for the services they provide to us.
International transfers
We are a United States company and some of our providers process data in the United States or elsewhere. Where data leaves the EEA or the United Kingdom, we rely on an adequacy decision or appropriate safeguards, such as the EU Standard Contractual Clauses.
Retention
We keep booking and account records for as long as we need them to provide the service and to meet legal, tax, and accounting requirements, then delete or anonymise them. Health declarations for journeys are deleted after the journey, as described above. Marketing preferences are kept until you opt out.
Your rights
We align with the GDPR for all our guests, wherever they live. Subject to applicable law, you can ask to access, correct, delete, or receive a portable copy of your data, and to object to or restrict certain processing; where we rely on consent, you can withdraw it. Write to concierge@vrelocollection.com and we will respond within the time the law allows. If you are in the EEA or UK, you may also complain to your local data-protection authority; if you are a resident of a US state with a privacy law, you may have similar rights under that law.
Cookies
We use essential cookies to run the site and keep you signed in, and — only with your consent — limited analytics to help us improve it. You can manage non-essential cookies through your browser or our cookie controls.
This is a draft policy and may be updated; the current version and its effective date always appear at the top of this page. Nothing here limits the mandatory consumer-protection or data-protection rights you have under applicable law.