Who we are
Spark of Magic Travel is a travel agency. Our website is sparkofmagictravel.com. This page says what the site collects, what the agency keeps about the people it plans trips for, and what happens to it.
Visiting the site
The public pages set no cookies. There is no advertising, no third-party analytics and no tracking across sites — the visitor counts described below are made by our own server — and nothing on the page is loaded from another company: the social media icons are drawn by the site itself and do not contact those networks until you tap one.
Like every web server, ours keeps a log of requests: the address your connection comes from, the page asked for, the time, and the kind of browser. We use it to keep the site running and to spot abuse, and it is kept for a short period before it is discarded.
Visitor statistics
We count how the site is used — which pages are read, on which days and at what hours, from what kind of device, and which site sent you here — so we know what people find useful. The counting is done by our own server: nothing is loaded from another company, no cookie is set, and your address is never stored. To tell one visitor from another within a day, the server keeps a short code made from your address and browser together with a key that changes every day; it cannot be turned back into your address, and it cannot connect one day’s visit with the next. These counts are kept for about a year.
Our agents’ profiles
Each agent supplies their own profile: their name, photographs, a few words about themselves, links to their social media, and, if they choose, an email address. It is published because they asked for it to be, and an agent can change or remove any of it through the agency at any time.
Planning and booking a trip
When one of our agents plans a trip for you, the agency keeps a record of who you are (your name and how to reach you, and the details a booking needs, such as the names and dates of birth of the travellers) and of the trip itself (the supplier, the dates, confirmation numbers, and what was paid and what the agency earned). That record lives in the agency’s own console, which only the agency’s owners and your agent can sign in to. It is kept for as long as it takes to look after the trip, settle the agent’s commission, and meet the agency’s record-keeping obligations.
Suppliers — Disney, Universal, cruise lines, hotels, airlines and the like — receive what they need to make your booking, and handle it under their own privacy policies.
Payment cards and identity documents
Booking a trip sometimes means your agent needs a payment card, or the passport or other identity details of the people travelling, at a moment when you cannot be reached. When you give the agency those details — on a page your agent sends you a private link to, or by telephone — they are encrypted before they are stored, they can be seen only by your agent and the agency’s owners, every time they are looked at is recorded, and they are deleted automatically: a payment card within 72 hours of being given (if it is needed again, you will be asked again), identity details a set number of days after your trip ends. You can ask your agent or an owner to delete them sooner at any time, and they can do that without seeing them.
Shared itineraries
Your agent may share your itinerary with you as a web link. The page shows your first name and the plans for the trip. Anyone who has the link can open it; it is not listed anywhere and search engines are asked not to index it. Your agent can switch a link off at any time. Please do not pass it to people who should not see your plans.
The site sends email only to people who have an account on the agency console — an invitation to set a password, or a link to reset one. It sends no marketing, and it does not receive mail at all. Those messages are delivered by an email service working on our behalf, which handles the address and the message only to deliver it.
Signing in to the console
Agents and owners who sign in to the console have a username, a display name, an email address and a password; the password is stored as a one-way hash, never as itself. Signing in sets one cookie, which keeps you signed in for the visit, or for two weeks if you tick “Keep me signed in”, and goes when you sign out. Failed sign-in attempts are noted against the address they come from for a few minutes, to stop password guessing.
Where it is kept
The site and its records run on a server the agency rents from Amazon Web Services in the United States.
Your choices
To see, correct, or delete what the agency holds about you, ask your agent — their details are on their profile page — or any of the agency’s owners. We will do so unless a record has to be kept for a legal or financial reason, and we will tell you if that is the case.
Changes to this page
This page changes when the site does. It was last updated on 28 August 2026.
