Privacy Policy

How Adventure Café Ltd collects, uses, and protects your personal data.

1. Introduction

Adventure Café Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. We are a company registered in England & Wales, based in Somerset, UK. We operate the website adventurecafe.uk and provide cycling and trekking challenge events for corporates, charities, and individual adventurers.

This privacy policy explains how we collect, use, store, and share your personal data when you use our website, make an enquiry, or book a trip with us. It applies to all visitors, enquirers, and customers.

For the purposes of UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018), the data controller is Adventure Café Ltd, Somerset, United Kingdom.

2. What Data We Collect

We may collect and process the following personal data about you:

Enquiry information: When you submit an enquiry via our Formspark-powered contact forms, we collect your name, email address, telephone number, and any additional details you provide about your trip requirements (such as group size, preferred dates, and event type).

Booking and payment information: When you book a trip, we collect your full name, postal address, email address, telephone number, dietary requirements, medical information relevant to the trip (such as allergies or fitness considerations), emergency contact details, passport details (for international trips), and payment information. Payment card details are processed securely by our third-party payment provider and are not stored on our systems.

Technical data: When you visit our website, we may automatically collect your IP address, browser type and version, operating system, referral source, pages visited, and the duration of your visit. This data is collected via cookies and similar technologies — see our Cookie Policy for full details.

Communication data: Records of correspondence between you and Adventure Café, including emails, telephone call notes, and messages sent via our website or social media channels.

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiries and provide information about our trips and services.
• To process and manage your trip bookings, including arranging accommodation, transport, guides, and support vehicles.
• To send you pre-trip information, itineraries, kit lists, training plans, and logistical details relevant to your booked event.
• To process payments and manage our financial records.
• To ensure participant safety during events, including sharing relevant medical information with our trip leaders and support staff.
• To improve our website, services, and customer experience.
• To comply with legal and regulatory obligations.

We will not use your personal data for direct marketing purposes unless you have given us explicit consent to do so. You may withdraw your consent at any time by contacting us.

4. Legal Basis for Processing

Under the UK GDPR, we rely on the following lawful bases to process your personal data:

Contractual necessity (Article 6(1)(b)): Processing that is necessary to fulfil a contract with you or to take steps at your request prior to entering into a contract. This includes processing your booking, arranging trip logistics, and communicating trip-related information.

Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications or sharing medical information with trip leaders for safety purposes.

Legitimate interests (Article 6(1)(f)): Processing that is necessary for our legitimate interests, provided those interests are not overridden by your rights. This includes responding to general enquiries, improving our services, maintaining business records, and protecting our legal rights.

Legal obligation (Article 6(1)(c)): Processing that is necessary to comply with a legal obligation, such as maintaining financial records for tax and accounting purposes.

5. Data Sharing

We do not sell your personal data to any third party. We may share your personal data with the following categories of recipients, but only where it is necessary for the delivery of your trip or the operation of our business:

• Third-party trip providers: Hotels, guest houses, and accommodation providers at your trip destination who need your name and any dietary or accessibility requirements to prepare for your stay.
• Transport providers: Coach companies, ferry operators, and transfer services who require participant lists and contact details for logistics.
• Local guides and support crew: Our on-the-ground partners who need participant information (including emergency contacts and relevant medical data) to ensure your safety during the event.
• Payment processors: Our secure payment provider processes your card details on our behalf. We do not store your full payment card information.
• Professional advisers: Our accountants, legal advisers, and insurers where reasonably necessary.
• Law enforcement or regulators: Where we are legally required to do so.

Where your data is shared with third parties outside the UK (for example, accommodation providers in Europe, Morocco, or Nepal), we take appropriate steps to ensure that your data is treated securely and in accordance with this privacy policy, including using standard contractual clauses or relying on adequacy decisions where applicable.

6. Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users, improve your browsing experience, and help us understand how our website is used. Cookies are small text files placed on your device when you visit our site.

For full details about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please see our Cookie Policy.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Enquiry data: Retained for 2 years from the date of your last enquiry, after which it is securely deleted unless you have since become a customer.
• Booking and trip data: Retained for 7 years from the date of your trip, in line with our legal and accounting obligations under HMRC requirements.
• Marketing consent records: Retained for as long as you remain subscribed, plus 1 year after unsubscription for record-keeping purposes.
• Website analytics data: Retained in accordance with the periods set out in our Cookie Policy.

When personal data is no longer required, we securely delete or anonymise it.

8. Your Rights Under UK GDPR

Under UK data protection law, you have a number of rights in relation to your personal data. You have the right to:

• Access: Request a copy of the personal data we hold about you (known as a Subject Access Request). We will respond within one month of receiving your request.
• Rectification: Request correction of any inaccurate or incomplete personal data we hold about you.
• Erasure: Request deletion of your personal data where there is no compelling reason for us to continue processing it. Please note that we may not always be able to comply if there is a legal basis for retaining the data.
• Restriction of processing: Request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have asked us to correct.
• Data portability: Request a copy of your personal data in a structured, commonly used, machine-readable format, and the right to have it transferred to another data controller where technically feasible.
• Objection: Object to processing of your personal data where we are relying on legitimate interests as the legal basis, or where we are processing your data for direct marketing purposes.
• Withdraw consent: Where we are relying on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in section 9 below. We may need to verify your identity before processing your request.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by telephone on 0303 123 1113.

9. How to Contact Us

If you have any questions about this privacy policy, wish to exercise any of your data protection rights, or have a concern about how we are handling your personal data, please contact us:

Adventure Café Ltd
Somerset, United Kingdom

Email: info@adventurecafe.uk
Telephone: 01823 444246

We aim to respond to all data protection enquiries within 30 days.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. Any changes will be posted on this page with an updated "last updated" date.

We encourage you to review this policy periodically. If we make material changes that significantly affect how we use your personal data, we will take reasonable steps to notify you, such as placing a prominent notice on our website or contacting you directly where possible.