Privacy Policy

This Privacy Policy explains how Pavlus Travel & Cruise, Inc. (“Pavlus,” “we,” “us”) collects, uses, shares and protects personal information. It applies to pavlus.com and its subdomains, including our My Account customer portal at my.pavlus.com, and to information you give us by phone, email, text message, live chat, or in person when we plan and book travel for you. Other Pavlus websites that link to this policy are covered too.

Your use of our websites and services is also governed by our Terms & Conditions. When we book travel for you, the cruise line, tour operator, hotel, airline or other supplier collects and uses your information under its own privacy policy, which we encourage you to read.

Information you give us

• Contact details: name, email address, phone number and mailing address.
• Trip details: destinations, dates, budgets, travel companions, preferences and the quotes and bookings we arrange for you.
• Traveler details that suppliers require: full legal name, date of birth, gender, citizenship, passport details, Known Traveler (TSA PreCheck® / Global Entry) and redress numbers, loyalty-program numbers and emergency contacts.
• Special requests: dietary restrictions and accessibility or medical-related needs (for example, a wheelchair, a CPAP machine or an accessible room) that you ask us to pass on to a supplier.
• Payment information: card details used to pay deposits and balances.
• Communications: your emails, texts, chat messages, portal messages, survey answers and reviews, and our notes of conversations with you.
• Referrals: the name and contact details of a friend you refer to us. Please only refer people who would welcome hearing from us.

Information in your My Account portal

When you use my.pavlus.com we also hold your sign-in details (your password is stored only in encrypted, hashed form), the email address or mobile number used for two-step verification codes, your traveler profile, documents you upload, messages with your Travel Planner, and your referral and rewards activity. If you choose “Remember me,” a cookie keeps you signed in on that device for up to 30 days.

Information collected automatically

When you visit our websites we and our service providers automatically collect your IP address, browser and device type, the pages you view and for how long, the site or campaign that referred you, and an approximate location (country or region) derived from your IP address. We collect this with cookies, browser storage and similar technologies (see Cookies & Analytics).

Information from others

We receive information from travel suppliers (for example, booking confirmations and schedule changes), from a family member, friend or group leader who books travel that includes you, from a person who refers you to us, and from service providers who help us verify addresses, email addresses and payments.

If you give us information about other travelers, you confirm that you have their permission to do so and that you will share this Privacy Policy with them.

• To plan, quote, book, change and service your travel, and to send you travel documents, reminders and updates.
• To run your My Account portal, verify your identity and keep your account secure.
• To process payments, refunds and supplier credits, and to prevent fraud.
• To respond to your questions by phone, email, text, chat and portal messages.
• To send you newsletters, offers and invitations to events and webinars. You can opt out at any time (see Your Privacy Choices).
• To administer referral, rewards and loyalty programs.
• To understand how our websites and portal are used, fix problems and improve our services.
• To comply with the law, keep business and tax records, enforce our terms, and protect the rights, safety and property of our customers, our staff and Pavlus.

Some information we handle is sensitive: passport and government-ID numbers, dates of birth, payment cards, and health-related requests such as dietary restrictions, mobility or accessibility needs, and medical equipment. We use sensitive information only to arrange and deliver the travel you ask for, to keep you safe while traveling, and to meet legal requirements. We never use it for advertising or to build marketing profiles, and we never sell it.

• Passport numbers are handled by your Travel Planner and stored encrypted. The My Account portal shows only whether a passport is on file and its expiration date, not the number.
• Payment cards entered in the portal are stored by our payment processor in its secure vault; Pavlus staff never see the full card number. When you pay a supplier directly or through us, card details are shared with that supplier only to process the payment.
• Health-related requests are shared only with the suppliers who need them to accommodate you (for example, a cruise line for a wheelchair-accessible cabin). By giving us this information, you consent to that use and sharing. You can withdraw consent at any time, but we may then be unable to arrange the accommodation.

Consumer health data notice (Washington, Nevada and similar laws)

Dietary, accessibility and medical-equipment requests may be “consumer health data” under laws such as Washington’s My Health My Data Act. Categories we collect: dietary restrictions, mobility and accessibility needs, medical equipment you will bring, and any health details you choose to include in messages. Sources: you, or the person booking for you. Purpose: only to arrange the accommodations you request. Who receives it: the travel suppliers delivering your trip and the service providers that host our systems. We do not sell consumer health data. To see, delete or stop our use of this data, or to withdraw consent, contact us at guestrelations@pavlustravel.com or 1-800-528-9300. If we deny your request, you may appeal by replying to our decision.

We share personal information only as described here:

• Travel suppliers — cruise lines, tour operators, hotels, airlines, rail and ground operators, travel insurers and local operators — to book and deliver your trip. Some are located outside the United States. Once they receive your information, their own privacy policies apply.
• Booking systems and industry partners through which reservations are made, ticketed and tracked, such as airline reservation systems and the travel-agency network we belong to.
• Service providers that work on our behalf under confidentiality obligations and may use your information only to provide services to us: website and portal hosting, customer-relationship and booking software, email and text-message delivery, payment processing, fraud and spam prevention (Google reCAPTCHA), website analytics (Google Analytics), IP geolocation (DB-IP), and the artificial-intelligence provider that powers our chat assistant (Anthropic).
• People you authorize, such as a travel companion or group leader on the same booking, or someone you ask us to deal with on your behalf.
• Legal and safety reasons — to comply with law, subpoenas or government requests (including passenger-information requirements of immigration and customs authorities), to enforce our terms, or to protect anyone’s rights, property or safety.
• Business transfers — as part of a merger, acquisition or sale of all or part of our business, in which case this policy will continue to apply to your information.

We use cookies and browser storage for the following purposes:

• Essential: keeping you signed in to My Account, remembering your security preferences, and protecting forms from spam with Google reCAPTCHA. reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.
• Convenience: remembering details you typed into a quote form, your cookie choice, and your live-chat session.
• Analytics: Google Analytics helps us understand how visitors use pavlus.com and my.pavlus.com, such as which pages are viewed, how visitors arrive, and which device types they use. In the My Account portal, analytics records only which portal screen was viewed (for example, “Trips” or “Details”). It does not receive your name, email, booking numbers, passport details or other profile contents.

At present we do not place third-party advertising or retargeting cookies on our websites. If that changes, we will update this policy first.

Your controls: you can block or delete cookies in your browser settings (blocking essential cookies will stop My Account sign-in from working). You can opt out of Google Analytics on all websites with the Google Analytics opt-out browser add-on. We honor the Global Privacy Control (GPC) signal: when your browser sends it, we tell Google not to use your visit for advertising personalization or Google signals. Our websites do not otherwise respond to browser “Do Not Track” signals, because there is no common standard for them.

Marketing emails and texts

Every marketing email has an unsubscribe link, or you can email guestrelations@pavlustravel.com. Reply STOP to any text message to stop texts. Even if you opt out of marketing, we will still send messages about your bookings and your account.

Access, correction, deletion and portability

You can view and update much of your information in My Account. Whatever state you live in, you may also ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct inaccurate information;
• delete your information or close your My Account;
• opt out of any sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, or profiling. We do not do any of these, but you may still record your opt-out, and we will honor it if our practices ever change;
• limit our use of sensitive information to what is needed to provide the services you request (this is already our practice).

We may keep information we are legally required to keep (for example, booking and tax records) or that we need to complete an active booking, resolve disputes or prevent fraud.

How to make a request

Email guestrelations@pavlustravel.com with “Privacy Request” in the subject line, call 1-800-528-9300, or write to Pavlus Travel & Cruise, Inc., 7510 Montgomery Blvd. NE, Albuquerque, NM 87109-1500. We will verify your identity, usually by matching information we already hold, before acting on a request. You may use an authorized agent; we may ask for proof of the agent’s authority and verify your identity directly. We respond within 45 days and will tell you if we need more time, as the law permits. We will not treat you differently for exercising your rights.

Appeals

If we decline your request, you may appeal by replying to our decision with “Privacy Appeal” in the subject line. We will respond within the time required by your state’s law. If you are not satisfied, you may contact your state attorney general.

California residents

In the past 12 months we collected the categories of information described in Information We Collect (identifiers, customer records, characteristics such as age and citizenship, commercial information, internet activity, approximate geolocation, audio and electronic communications, and sensitive information such as passport and account details). We collected them from the sources, and used and disclosed them for the business purposes, described in this policy. We have not sold or shared personal information, including that of consumers under 16. Under California’s “Shine the Light” law, you may ask whether we disclosed personal information to third parties for their direct marketing; we do not.

With your permission we may text you about your quotes, bookings, travel documents and trip updates, and we send one-time sign-in codes for My Account when you choose text for two-step verification. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help, or call 1-800-528-9300. Carriers are not liable for delayed or undelivered messages.

Our website offers a live chat service staffed by a virtual assistant and by Pavlus Travel Planners. When you use it, we keep the conversation transcript together with any name, email address or phone number you choose to give us, so that a Travel Planner can follow up with you. Providing an email address or phone number is optional. Please do not share credit card numbers, passport numbers or other sensitive information in the chat.

Messages you send to the virtual assistant, together with the first name you provide, are processed by our artificial-intelligence service provider (Anthropic) solely to generate replies. That provider does not use your messages to train its models and does not receive your email address or phone number. Automated replies may contain mistakes and are not a price quote or booking confirmation; a Travel Planner will confirm the details.

So that our Travel Planners can offer timely help, pavlus.com also records, during your visit, which pages of our site you view and for how long, your device type, and your approximate location (country, derived from your IP address). This is linked to a random identifier stored in your browser, not to your name, unless and until you provide one in the chat. A Travel Planner may use this information to offer you a chat while you browse; you are free to decline, and closing the chat ends the conversation. Browsing activity is kept for seven days; chat transcripts are kept as long as needed to assist with your enquiry and for our records.

IP geolocation is provided by DB-IP.

We use administrative, technical and physical safeguards designed to protect personal information. These include encrypted connections (HTTPS), encryption of passport numbers, tokenized storage of payment cards with our payment processor, hashed passwords, optional two-step verification for My Account, and access limited to staff who need it. No system is perfectly secure, however, and we cannot guarantee the security of information sent over the internet.

Please keep your My Account password private, use a password you do not use elsewhere, and turn on two-step verification. Never send full card or passport numbers by ordinary email or chat. If you think your account has been compromised, call us right away at 1-800-528-9300. If a security incident affects your personal information, we will notify you as required by law.

We keep personal information for as long as you are a customer and afterward as long as needed for the purposes in this policy: to service future trips and honor loyalty and referral benefits, to keep business, accounting and tax records, to resolve disputes, and to comply with legal obligations. Website browsing activity used for live chat is kept for seven days. When information is no longer needed, we delete or de-identify it. You can ask us to delete your information at any time (see Your Privacy Choices).

Our websites and the My Account portal are intended for adults and are not directed to children under 16. We do not knowingly collect personal information online from children under 13. Information about minors traveling with their families, such as names, dates of birth and passport details required by suppliers, should be provided by a parent or legal guardian, who may review or delete it by contacting us. If you believe a child has given us information without a parent’s consent, please contact us and we will delete it.

Pavlus is based in the United States, and we store and process information in the United States. If you contact us from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Arranging international travel necessarily means sharing your information with suppliers and authorities in the countries you visit.

We may update this Privacy Policy from time to time. The “Last Updated” date at the top shows when it last changed. If we make a material change to how we use or share personal information, we will notify you by email or by a notice on our websites or in My Account before the change takes effect.