Legal

Privacy policy.

This policy explains which personal data HolidayHQ uses, why, and what your rights are. It applies to the HolidayHQ app and the website holidayhq.nl.

1. Who is responsible

The controller of your personal data is Timpact Leisure Solutions, trading as Timpact HolidayHQ, registered in the Dutch Business Register (KvK) under number 99847574, VAT NL005414201B20. For anything about your privacy, email support@holidayhq.nl. We do not have a data protection officer; we are not required to.

2. What we store

  • Your account: email address, password (stored only as a hash by our database provider), your name if you add one, and your two-step verification settings.
  • Your trips: destination, dates, itinerary, places, reservations (for example reservation numbers and traveller names), documents and memories you add, and who you share the trip with.
  • Memories: the photo, a smaller copy, its caption and when it was taken. We remove location, camera details and other photo metadata before upload.
  • Visas & ESTAs you add to your account.
  • Invitations: the email address you invite, the role and the status. The invitation link itself is never stored, only a fingerprint of it.
  • Beta waitlist: if you join the beta waitlist, your email address, first name (optional), whether you use Android or iPhone, and when you signed up and confirmed.
  • Support: the emails you send us and our replies.
  • Technical data: to deliver and protect the service, our hosting providers process your IP address and basic device and browser information in short-lived logs. We do not use it to follow you.

HolidayHQ does not support passports or ID cards. Other travel documents you choose to store are protected as described below. If you choose to store a document with health information, such as an insurance card, we use it only to keep it for you; it starts as Only me and you can delete it at any time.

3. What you have to give us

An email address and a password are needed to create an account; without them we cannot provide HolidayHQ. For the beta waitlist, only your email address is needed. Everything else, such as your name, trips, documents and memories, is your own choice.

4. Why we use it, and on what legal basis

  • To provide HolidayHQ: your account, showing and syncing your trips, sharing them with the people you invite, and sending account and invitation emails. Basis: the agreement with you (the terms of use).
  • To keep HolidayHQ and your account secure and prevent abuse, for example with two-step verification, request limits, bot protection and logs. Basis: our legitimate interest in a safe service, and the agreement with you.
  • To send invitation emails to people who do not have an account yet. Basis: the legitimate interest of the person who invites and ours in letting people share a trip.
  • To answer your questions, reports and complaints. Basis: the agreement with you, or our legitimate interest in helping you.
  • To email you about the beta if you join the waitlist. Basis: your consent, which you give by confirming your address and can withdraw at any time.
  • To meet legal obligations, for example when an authority asks for information or when we handle a report of illegal content. Basis: legal obligation.

We do not sell your data, show ads, use analytics or tracking, or make decisions about you by automated means or profiling.

5. Who can see it

  • A trip is private until its owner invites people.
  • Travellers see the itinerary, memories, reservations and Shared documents. Viewers see the itinerary and memories, not documents or reservations.
  • Documents marked Only me are visible to you alone. Health and insurance documents start as Only me.
  • Your Visas & ESTAs are never shared with a trip.

6. Security

All traffic is encrypted (TLS) and our providers encrypt stored data. Access rules in the database decide who sees what. Documents, reservations and visas open only after two-step verification. HolidayHQ does not use end-to-end encryption.

On your phone, HolidayHQ keeps your session and a short offline copy of your trips encrypted. Documents you keep on your phone for offline use are encrypted and removed the day after the trip ends, when you sign out, or when you lose access.

If a data breach is likely to put your rights at risk, we report it to the Dutch Data Protection Authority within 72 hours, and we tell you without delay if the risk is high.

7. Services we use (processors)

These companies process personal data on our behalf, only to provide their part of HolidayHQ and under an agreement with us:

  • Supabase (Supabase Inc., United States): database, sign-in and file storage. Your data is stored in the EU (Ireland).
  • Vercel (Vercel Inc., United States): hosts this website, in the EU (Dublin).
  • Resend (United States): sends account, invitation and beta emails, from the EU (Ireland). An invitation email contains the trip name and the name of the person who invites.
  • Cloudflare Turnstile (Cloudflare Inc., United States): protects the sign-up, password reset and beta forms on this website against bots.
  • ImprovMX (Reflectiv SAS, France): forwards email sent to support@holidayhq.nl.

8. Other parties

Some services are loaded directly by your phone or browser, or receive only search terms. They then see your IP address but not who you are:

  • Google Maps (Google): shows the map in the Android app.
  • Geoapify (Geoapify GmbH, Germany): finds places when you search. It receives the search text and the area, not who you are.
  • Unsplash (Canada) and Wikimedia Commons and Wikipedia (Wikimedia Foundation, United States): photos and facts about destinations and places. Your phone loads these images from their servers.
  • Nager.Date: public holidays by country and year. It receives no personal data.

We also share data with:

  • the people you share a trip with, and the people you invite, as described in section 5;
  • authorities, only when the law requires it;
  • a company that takes over HolidayHQ, if that ever happens. We tell you in advance and this policy keeps applying.

9. Data outside the European Economic Area

Some of the companies above are based outside the European Economic Area (EEA), mainly in the United States, even when they store your data in the EU. For transfers to the United States they rely on the EU–US Data Privacy Framework where the company is certified, and otherwise on the standard contractual clauses of the European Commission. Canada has an adequacy decision from the European Commission. You can ask us for more information about these safeguards.

10. How long we keep it

  • Your data stays until you delete it or your account.
  • Invitations are removed 30 days after they end or expire.
  • Beta sign-ups you don’t confirm are deleted after 7 days. The waitlist is deleted when HolidayHQ launches in the stores. Every waitlist email has a link to leave it, which deletes your address at once.
  • Expired visas stay until you remove them.
  • Files of deleted items are removed from storage within a day.
  • Support emails are kept for up to 2 years after our last contact.
  • Deleted data can remain in our database provider’s encrypted backups until those backups are replaced in the regular cycle.

11. Deleting your account

You can delete your account in the app or on this website, after confirming it is you. This deletes your account, your memories, your Only me documents and your Visas & ESTAs. Trips you own go to a traveller you choose, or are deleted when there is none. Shared documents, reservations and plans you added to a trip stay with that trip, without your name. No app? See Delete your account.

12. Children

HolidayHQ is for people aged 16 and older. Younger travellers can be part of a trip without an account, for example by name in a reservation.

13. Cookies

This website uses only the cookies needed to keep you signed in. There are no tracking or advertising cookies. The sign-up, password reset and beta pages load Cloudflare Turnstile. If you switch between light and dark, your browser remembers that choice on your device; it is not a cookie and is never sent to us.

14. Your rights

Under the GDPR (in Dutch: AVG) you have these rights:

  • Access: ask which personal data we have about you and get a copy.
  • Correction: have wrong or incomplete data corrected. You can change most of it yourself in the app.
  • Deletion: have your data deleted. You can also delete your account yourself.
  • Restriction: ask us to use your data only in a limited way for a while, for example while we check a correction.
  • Data portability: get the data you gave us in a common, machine-readable format, or have it sent to another service.
  • Withdrawing consent: where we use your data based on consent (the beta waitlist), you can withdraw it at any time. This does not affect what we did before.

Right to object. Where we use your data based on our legitimate interest (section 4), you can object to that at any time, for reasons related to your situation. We then stop, unless we have compelling legitimate grounds that outweigh your interests, or we need the data for a legal claim.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl. We would like to hear from you first, so we can try to solve it.

15. How we handle your request

  • Email your request to support@holidayhq.nl, preferably from the email address of your account.
  • We may ask you to confirm it is you, for example by replying from that address. We never ask for a copy of your passport or ID card.
  • We answer within one month. For complex or many requests this can be extended by two more months; we then tell you within the first month.
  • It is free. Only for clearly unfounded or excessive requests may we charge a reasonable fee or refuse, and we explain why.
  • If we correct or delete data at your request, we also tell the services that received it, where needed.

16. Changes

When this policy changes in a way that matters to you, we tell you in the app or by email. Last updated: 8 October 2026.