Privacy Policy

Last updated: 9 July 2026

This Privacy Policy explains, in plain language, what personal data we collect when you use our website and services, why we collect it, how we look after it, and the rights you have over it. We have written it to be read, not to be filed away. If anything here is unclear, please write to us and we will explain.

"Personal data" means any information that identifies you or can be linked to you, such as your name, your email address, or your booking details. "We", "our" and "us" mean the business named below. "You" means anyone who uses our website or services.

Who we are

The data controller (the business that decides how and why your personal data is used) is:

Cruise & Rail Travel, a sole proprietorship registered in Guyana (Guyana Commercial Registry, Certificate No. 186224), proprietor Theon Alleyne, trading online as No USA Visa Travel at nousavisatravel.com.

• Address: Lot 55, Public Road, La Grange, Region 3, Guyana
• Email: [email protected]
• Toll-free: 1-855-631-8785

You can reach us at the email above for any question about your data or to exercise any of the rights described in this policy.

The standard we hold ourselves to

We are based in Guyana and we follow the laws of Guyana, primarily the Guyana Data Protection Act 2023. Our travellers come from across the CELAC region and beyond, so we have made a deliberate choice: rather than give different people different levels of protection depending on where they live, we apply the highest common standard to everyone. In practice this means we extend to every user the fuller set of privacy rights recognised under frameworks such as the EU and UK General Data Protection Regulation (GDPR) and Brazil's General Data Protection Law (LGPD), regardless of your location. You get the strongest protection we can offer, not the weakest we can get away with.

What personal data we collect

We only collect what we genuinely need. In practice, that is:

• Contact and account data. Your name and email address when you join The Circle (our membership) or when you fill in an enquiry or interest form.
• Booking and travel details. The information needed to arrange a trip when you ask us to, such as traveller names, travel dates, destinations, and the preferences and details relevant to your flights, hotels, rail journeys, or cruises.
• Layaway Cruise interest sign-ups. Your contact details and stated interest when you sign up to hear about, or take part in, our Layaway Cruise offering.
• Website usage and technical data. Basic information such as your IP address, your device and browser type, and the pages you view. We use this to keep the site secure and running properly.

What we do not collect

We do not collect or store full payment-card numbers. When you pay for a flight or hotel, the payment is taken by the travel supplier or its payment processor acting as merchant of record. For Layaway, your instalment funds are held by a regulated third-party banking or escrow partner. Card and payment data is handled by those regulated processors under their own security and privacy obligations, not by us. We never see or keep your full card number.

Why we use your data, and our lawful basis for it

Under the frameworks we follow, we must have a valid legal reason ("lawful basis") to use your personal data. Here is what we do and why:

• To run The Circle and reply to your enquiries. Basis: your consent when you sign up or reach out, and our legitimate interest in responding to people who contact us. You can withdraw consent at any time.
• To arrange and manage your bookings. Basis: performance of a contract with you, so we can deliver the travel you have asked us to arrange.
• To contact members who have opted in with news, offers, and Layaway updates. Basis: your consent. Every marketing message includes a way to unsubscribe.
• To keep our website secure and working. Basis: our legitimate interest in protecting the site, preventing misuse, and diagnosing problems.
• To meet our legal and record-keeping obligations. Basis: compliance with a legal obligation where the law requires us to keep certain records.

Where we rely on legitimate interests, we have weighed our interest against your privacy and only proceed where your rights are not overridden.

Who we share your data with

We do not sell your personal data. We never have and we will not. We share data only with the categories of partners below, and only as far as needed to provide our service:

• Our email/CRM provider, which holds our membership and interest lists and helps us send messages to members who have opted in.
• Travel suppliers and their booking aggregators (airlines, hotels, rail operators, cruise lines, and the aggregators that connect us to them), so that a trip you ask us to arrange can actually be booked and delivered.
• Our payment and escrow partners (regulated processors and banking or escrow providers), who handle payments and hold Layaway instalment funds. As noted above, they handle card and payment data, not us.

Each of these partners receives only the data needed for their part of the job, and is expected to protect it and use it only for that purpose.

International transfers

We are in Guyana, and our travellers and some of our partners are in other countries. This means your personal data may be transferred to, or accessed from, places outside Guyana (for example, a travel supplier, aggregator, or processor located in another country). Wherever your data goes, we take steps to make sure it stays protected to the standard set out in this policy, using appropriate safeguards such as contractual protections with the partners who handle it.

How long we keep your data

We keep personal data only for as long as we have a good reason to. In general terms:

• Membership and interest data: for as long as you remain a member or interested contact, and for a reasonable period afterwards, until you ask us to remove it or you unsubscribe.
• Booking and travel data: for as long as needed to deliver your trip and to meet our record-keeping, tax, and legal obligations after it.
• Website and technical data: for a short period, for security and site operation.

When we no longer need your data, we delete it or make it anonymous so it can no longer be linked to you.

How we protect your data

We take sensible, practical measures to keep your data safe. We limit who can access it, we use secure systems and connections, and we design our sign-in so that no password is stored in your browser cookie (see our Cookie Policy). No system can promise perfect security, but we work to protect your information and to put things right quickly if something goes wrong.

Your rights over your data

We extend the following rights to every user, wherever you are:

• Access. Ask us what personal data we hold about you and get a copy.
• Rectification. Ask us to correct data that is wrong or incomplete.
• Erasure. Ask us to delete your data ("the right to be forgotten"), where we are not required to keep it.
• Restriction. Ask us to pause our use of your data in certain situations.
• Portability. Ask us to provide the data you gave us in a portable, machine-readable form, or to send it to another provider where practical.
• Objection. Object to us using your data where we rely on legitimate interests, and object at any time to marketing.
• Withdraw consent. Where we rely on your consent, withdraw it at any time. This does not affect anything we did lawfully before you withdrew it.
• Lodge a complaint. Raise a concern with a data protection authority (see below).

To exercise any of these rights, just email [email protected]. We will not charge you for a normal request, and we will respond within the time the law allows. We may need to confirm your identity first, so that we do not hand your data to the wrong person.

How to complain

If you are unhappy with how we have handled your data, please tell us first at [email protected] so we can try to make it right. You also have the right to complain to the data protection authority responsible for privacy in your own territory. If you are in Guyana, that is Guyana's data protection authority established under the Guyana Data Protection Act 2023. If you are elsewhere in the CELAC region or beyond, it is the equivalent authority where you live.

Children

Our service is for adults. We do not knowingly collect personal data from children. If you believe a child has given us their data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time, for example if our service or the law changes. When we do, we will post the new version here and update the date below. Please check back now and then.

_Last updated: 9 July 2026_