Privacy Policy
Privacy Policy
Hupweg organises surprise trips. In this privacy statement you can read which personal data we use, why we do so and what rights you have. We handle your data with care and comply with the General Data Protection Regulation (GDPR).
Responsible for processing your data is Hupweg, sole proprietorship, Chamber of Commerce number 67517765. E-mail: info@unexpectifly.com. WhatsApp: +31 6 16161020. Website: hupweg.nl.
Do you have a question about your privacy? Send us an e-mail or WhatsApp message. We do not have a data protection officer; this is not required for a small business like ours.
We only process data that you give us yourself, or that is needed for the website to work.
| Situation | Data |
|---|---|
| Creating an account | Name, e-mail address, password (stored encrypted), optional profile photo |
| Signing in with Google | Name, e-mail address and profile photo that Google shares with us |
| Booking a surprise trip | E-mail address, phone number, number of adults, children and babies, travel dates, departure airports, wishes and chosen extras |
| Requesting a tailor-made trip | Your wishes, budget and contact details |
| Ordering a gift card | Name, address and e-mail address of the recipient, and your own contact details |
| Posting a review | Name, text and rating |
| Contact via form, e-mail, WhatsApp or chat | Your name, contact details and the content of your message |
| Newsletter | E-mail address and your consent |
| Visiting the website | IP address and technical data in server logs; with your consent also usage data via Google Analytics |
To book the trip itself we sometimes need extra data, such as the names of all travellers as shown in their passports. We ask for these separately. We do not ask for special categories of personal data, such as health data. If you want to tell us about a diet or disability, for example, we only use that for your trip.
Each purpose has a legal basis under the GDPR.
| Purpose | Legal basis |
|---|---|
| Putting together, booking and carrying out your trip, and helping you during the trip | Performance of the contract |
| Processing payments via the escrow account | Performance of the contract |
| Managing your account and letting you sign in | Performance of the contract |
| Delivering a gift card | Performance of the contract |
| Answering your questions | Legitimate interest (helping you well) |
| Showing reviews on the website | Consent (you post them yourself; we check them first) |
| Sending the newsletter | Consent |
| Using Google Analytics | Consent via the cookie notice |
| Securing the website and fixing faults | Legitimate interest |
| Keeping records for the tax authorities | Legal obligation |
You can always withdraw your consent. For the newsletter, use the unsubscribe link in every e-mail; for cookies, the 'Cookie settings' link at the bottom of every page. We do not make decisions about you that are taken solely by a computer.
We never sell your data. We only share it with parties that are needed for your trip or for our website.
| Party | What for |
|---|---|
| Airlines, accommodations and other travel providers | Booking your trip |
| STO Garant and Stichting Derdengelden Certo Escrow | Guarantee and secure payment via the escrow account |
| Hostinger | Hosting of the website and our e-mail |
| Sign-in with Google and, with your consent, Google Analytics | |
| Chatling | The chat function on the website |
| WhatsApp (Meta) | Contact when you reach us via WhatsApp |
| PostNL or another delivery service | Sending a gift card or surprise package |
Parties that process data on our behalf, such as Hostinger and Chatling, may only use it for us. Travel providers also use your data under their own privacy statement. If the law requires us to, we pass data on to, for example, the tax authorities.
Outside the EU: some parties, such as Google, Chatling and WhatsApp, may process data outside the European Union, for example in the United States. This only happens with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. If you book a trip outside Europe, we have to share your data with travel providers in that country; this is necessary to perform our contract with you.
We do not keep your data longer than necessary.
| Data | Retention period |
|---|---|
| Bookings, invoices and payments | 7 years (legal retention obligation) |
| Account | As long as your account exists; deleted within 1 month after you ask |
| Tailor-made trip requests without a booking | 1 year |
| Messages via e-mail, WhatsApp, form or chat | 2 years after the last contact |
| Reviews | As long as they are on the website, or until you ask us to remove them |
| Newsletter | Until you unsubscribe |
| Server logs | Up to 30 days (at Hostinger) |
| Google Analytics | 14 months |
The website uses a secure connection (https). We store passwords encrypted, so that even we cannot read them. Only we have access to the management of the website and to your data, and that access is protected with strong passwords and two-step verification. Do you think something is going wrong with your data? E-mail us right away.
We only place cookies that are needed for the website to work. We only use Google Analytics if you give permission in the cookie notice. You can read more about this in the 'Cookies' section below.
Are you under 16? Then you need permission from a parent or guardian to give us your data. A trip can only be booked by someone aged 18 or over. We receive the data of children who travel along from the parent or guardian who books.
You have the following rights over your data:
Want to use one of these rights? E-mail info@unexpectifly.com. We respond within one month. Sometimes we ask you to show that the request really comes from you.
Not happy with how we handle your data? Let us know first, and we will look for a solution together. You may also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
We may change this privacy statement, for example if our website changes. The latest version is always on this page. This version is dated 27-10-2026.
Warranty
Om te voldoen aan de verplichte garantiestelling maakt Hupweg gebruik van STO Garant, een door de Autoriteit Consument en Markt (ACM) erkende garantieregeling. U kunt dit controleren via de STO Garant deelnemerspagina (www.sto-garant.nl/deelnemers). Alle informatie over STO Garant vindt u op www.sto-garant.nl
Bij elk (reis)aanbod van Hupweg op deze website leest u of de garantie van STO Garant van toepassing is. In de garantieregeling leest u wat de garantie inhoudt en welke voorwaarden van toepassing zijn. U vindt deze garantieregeling op de website van STO Garant (www.sto-garant.nl/downloads).
De werkingIndien de garantie van STO Garant van toepassing is op uw boeking, dan betaalt u de reissom niet aan Hupweg, maar aan de derdengeldenrekening van Stichting Derdengelden Certo Escrow, een bij De Nederlandsche Bank (DNB) en de Autoriteit Financiële Markten (AFM) geregistreerde betaaldienstverlener. Deze stichting derdengelden waarborgt uw reissom tot na afloop van uw boeking. De dag na afloop wordt de reissom vrijgegeven aan Hupweg. Mocht Hupweg voor het einde van uw boeking in financieel onvermogen geraken, dan voert STO Garant de garantie uit. In de garantieregeling leest u hoe u daar in dat geval aanspraak op maakt.