OTA Insider

Privacy Policy

Last updated: April 4, 2026

1. Who We Are

OTA Insider (ota-news.com) is owned and operated by HolidayHero B.V., a company registered in the Netherlands.

  • Company: HolidayHero B.V.
  • Address: Lepelstraat 3-3, 1018XK Amsterdam, the Netherlands
  • KvK (Chamber of Commerce): 85378275
  • VAT: NL863603452B01
  • Contact: [email protected]

2. What Data We Collect

We collect the minimum data necessary to operate this website and deliver our newsletter:

  • Email address — when you voluntarily subscribe to our newsletter.
  • Usage data — anonymized analytics data such as pages visited, referral source, browser type, and device type. We do not use this data to identify individual users.
  • Cookies — see Section 6 below.

We do not collect names, payment information, or any other personal data. There are no user accounts on OTA Insider.

3. Why We Collect Data

We process your data for the following purposes:

  • Newsletter delivery: To send you OTA industry analysis and updates you have subscribed to.
  • Website analytics: To understand how our content is used and improve the reading experience.
  • Website functionality: To ensure the website operates correctly.

4. Legal Basis (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data based on:

  • Consent — for newsletter subscriptions and non-essential cookies.
  • Legitimate interest — for anonymized website analytics and security.

5. Newsletter & Email

When you subscribe to our newsletter:

  • We store your email address and the date you subscribed.
  • Every email contains an unsubscribe link. You can opt out at any time.
  • We may use a third-party email service provider to deliver emails. Your email address will be shared with this provider solely for the purpose of email delivery.
  • We do not sell, rent, or share your email address with any other third party.

6. Cookies

OTA Insider uses the following types of cookies:

  • Essential cookies: Required for the website to function (e.g., session management, CSRF protection). These cannot be disabled.
  • Analytics cookies: Used to collect anonymized usage data. These are only placed with your consent.

You can manage your cookie preferences at any time via the cookie banner or your browser settings.

7. Data Retention

  • Newsletter subscribers: Your email is retained until you unsubscribe. After unsubscribing, we retain a record of your email and unsubscribe date for up to 12 months to prevent accidental re-subscription, after which it is permanently deleted.
  • Analytics data: Anonymized analytics data is retained for up to 26 months.

8. Your Rights

Under the GDPR, you have the right to:

  • Access your personal data.
  • Rectify inaccurate data.
  • Erase your data ("right to be forgotten").
  • Restrict processing of your data.
  • Object to processing based on legitimate interest.
  • Data portability — receive your data in a machine-readable format.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

9. Third Parties & Data Processors

We share personal data with the following third-party processors, strictly for operational purposes. Each processor is bound by a Data Processing Agreement (DPA) and is GDPR-compliant:

Provider Purpose Data processed Location
MailerLite (UAB MailerLite) Newsletter delivery & subscriber management Email address, subscription status EU (Lithuania)
SendGrid (Twilio Inc.) Transactional email delivery Email address, email content USA (SCCs in place)
DigitalOcean (DigitalOcean LLC) Cloud hosting, file storage (Spaces), database All data stored on the platform EU (AMS3, Amsterdam)
Laravel Cloud / Forge (Laravel LLC) Server provisioning & deployment Application code, environment configuration USA (SCCs in place)

We do not sell, rent, or share personal data with any party not listed above. Data Processing Agreements are available upon request by emailing [email protected].

10. International Transfers

Some of our processors (SendGrid, Laravel) are based in the United States. For these transfers, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to ensure an adequate level of data protection. Our primary infrastructure (DigitalOcean) and email provider (MailerLite) are hosted within the European Union.

11. Children

OTA Insider is not directed at individuals under 16 years of age. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the website after changes constitutes acceptance.

13. Supervisory Authority

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).