SLOW ADVENTURE LIMITED
SlowAdventure Limited, a company registered in Scotland with company no. SC632334 and registered office address of Hazelgrove,Druimandonich, Roy Bridge, Scotland, PH31 4AQ (referred to as "we", "us" or "our" in thisPrivacy Policy), respects your privacy and is committed to protecting yourpersonal data. This Privacy Policy will inform you as to how we look after yourpersonal data when you visit our website (regardless of where you visit itfrom) or when you otherwise provide personal data to us via other means (suchas over the telephone) and tell you about your privacy rights and how the lawprotects you.
ThisPrivacy Policy is provided in a layered format so that you can easily clickthrough to the specific areas set out below. Alternatively you can download apdf version of the policy here https://drive.google.com/file/d/1WxxBS_v3xCsZeLD9eIZmJuF2m1hzXg6g/view?usp=sharing.
Please also use refer to the Glossary that we have set out at the end of the Policy, if there isany terminology used in this Privacy Policy that you are unfamiliar with orthat you don’t fully understand.
1. IMPORTANT INFORMATION AND WHO WE ARE
2. THE DATA WE COLLECT ABOUT YOU
3. HOW YOUR PERSONAL DATA IS COLLECTED
4. HOW WE USE YOUR PERSONAL DATA
5. HOW WE DISCLOSE YOUR PERSONAL DATA
6. WHEN WE TRANSFER YOUR DATA OVERSEAS
7. HOW WE SECURE YOUR DATA
8. HOW LONG WE RETAIN YOUR DATA FOR
9. YOUR LEGAL RIGHTS
10. GLOSSARY
Purpose of this Privacy Policy
This Privacy Policy aims to give you information onhow we collect and process your personaldata, including any data you may provide through this website or via any othermeans (such as over the telephone) when you purchase travel services, when youmake an enquiry or set up an account through our website, when you sign up toour newsletter and when you take part in a competition etc.
This website is not intended for children and theonly circumstances in which we collect data relating to children,is where you make a booking of travel services and you have children in yourparty.
It is important that you read this Privacy Policy togetherwith any other privacy notice or fair processing notice we may provide onspecific occasions when we are collecting or processing personal data about youso that you are v fully aware ofhow and why we are using your data. This Privacy Policy supplements the othernotices and is not intended to override them.
DataController
Slow Adventure Limited (collectively referred to as"we", "us" or "our" in this Privacy Policy) isthe controller and responsible for your personal data.
We have appointed a data privacy manager who isresponsible for overseeing questions in relation to this Privacy Policy. If youhave any questions about this Privacy Policy, including any requests toexercise your legal rights, please contactthe data privacy manager using the details set out below.
Contactdetails
Our full details are:
Full name of legal entity: SlowAdventure Ltd
Name or title of data privacy manager: SaraBellshaw
Email address: info@slow-adventure.com
Postal address: Hazelgrove,Roy Bridge, PH31 4AQ
Youhave the right to make a complaint at any time to the Information Commissioner'sOffice (ICO), the UK supervisory authority for data protection issues (ico.org.uk). We would,however, appreciate the chance to deal with your concerns before you approachthe ICO so please contact us in thefirst instance.
Changes to the Privacy Policy and yourduty to inform us of changes
We keep our Privacy Policy under regular review. Thisversion was last updated on 24/02/2022 and historic versions can be obtained bycontacting us.It is important that the personal data we hold about you isaccurate and current. Please keep us informed if any of the details you provideto us should change, during the course of your relationship with us.
Third-partylinks
This website may include links to third-partywebsites, plug-ins and applications. Clicking on those links or enabling thoseconnections may allow third parties to collect or share data about you. We donot control these third-party websites and are not responsible for theirprivacy statements. When you leave our website, we encourage you to read theprivacy notice of every website you visit.
Personal data, or personalinformation, means any information about an individual from which that personcan be identified. It does not include data where the identity has been removed(anonymous data). We may collect, use, store and transfer different kinds of personaldata about you which we have grouped together follows:
(A) IdentityData
Thisincludes data relating specifically to your identity, such as your first name,maiden name, last name, username or similar identifier, marital status, title,date of birth and gender.
(B) ContactData
Thisincludes data relating to how you may be contacted, such as your billingaddress, delivery address, email address and telephone numbers.
(C) FinancialData
Thisinclude data relating to your means and methods of payment, such as your bankaccount and payment card details.
(D) TransactionData
Thisincludes data relating to the transactions you have carried out with us, suchas details about payments to and from you and other details of products andservices you have purchased from us.
(E) TechnicalData
Thisincludes more technical data that we may obtain when you make use of ourwebsite, such as your internet protocol (IP) address, your login data, browsertype and version, time zone setting and location, browser plug-in types andversions, operating system and platform and other technology on the devices youuse to access this website.
(F) ProfileData
Thisincludes the data that we receive when you create a profile on our website andmake use of that profile, such as your username and password, purchasesor orders made by you, your interests, preferences, feedback and surveyresponses.
(G) Usage Data
Thisincludes information about how you use our website, products and services.
(H) Marketingand Communications Data
Thisincludes your preferences in relation to whether or not you want to receivemarketing from us and our third parties and also your communicationpreferences.
We also collect,use and share Aggregated Data such as statistical or demographic datafor any purpose. Aggregated Data may be derived from your personal data but isnot considered personal data in law as this data does not directly or indirectly reveal your identity. For example, wemay aggregate your Usage Data to calculate the percentage of users accessing aspecific website feature. However, if we combine or connect Aggregated Datawith your personal data so that it can directly or indirectly identify you, we willtreat the combined data as personal data which will be used in accordance withthis Privacy Policy.
Special Categories of Personal Data
We collectthe following special categories of personal data about you. Details aboutyour:
· dietaryrequirements which may disclose your religious or philosophical beliefs;
· health;
· race orethnicity;
· Relevantmedical history
· Emergencycontact details and relationship
We collectand process the above data only where it is strictly necessary to do so inorder to deliver the travel service that you have purchased. Furthermore, wewill only collect and process the above special categories of sensitivepersonal data where you have provided us with your explicit consent to do so.
You are notunder any obligation to consent to us processing your sensitive personal data.However, without your consent, we won’t be able to make the necessaryarrangements to provide the travel services that you have booked or areattempting to book. As a result, if you do not provide your consent, we will beunable to proceed with your booking.
If you arehappy to consent to our use of your sensitive personal data, you will also beable to withdraw your consent at any time. However, as this will prevent usfrom providing the travel service you have booked, we will be required to treatany withdrawal of consent as a cancellation of your booking and thecancellation charges referred to in clauses 13-19 of our Booking Terms and Conditions [insertlink] will become payable.
Ifyou fail to provide personal data
Where weneed to collect personal data by law or under the terms of a contract we havewith you and you fail to provide that data when requested, we may not be ableto perform the contract we have or are trying to enter into with you.
In otherwords, where we require details from you in order to provide you with yourchosen travel services, if you do not provide us with the necessary detailsthen we will not be able to provide the services you have booked or areattempting to book.
In thiscase, depending upon when you fail to provide the necessary data, we may eithernot be able to process your booking or we may have to cancel your booking, inwhich case we will treat this as a ‘cancellation by you’ in accordance with ourBooking Terms and Conditions [insert]. We will notify you if we are unable toprocess a booking or are required to cancel a booking for this reason.
We use different methods tocollect data from and about you including through:
(A) Directinteractions
Youmay give us your Identity, Contact and Financial Data by filling in forms or bycorresponding with us by post, phone, email or otherwise. This includespersonal data you provide when you:
· make abooking of travel services;
· make andenquiry through our website
· create anaccount on our website;
· subscribeto our newsletter or other publications;
· requestmarketing to be sent to you;
· enter acompetition, promotion or survey;
· give ussome feedback.
(B) Automatedtechnologies or interactions
Asyou interact with our website, we may automatically collect Technical Dataabout your equipment, browsing actions and patterns.
Wecollect this personal data by using cookies, server logs and other similartechnologies. We may also receive Technical Data about you if you visit otherwebsites employing our cookies. Please see our cookie policy [LINK] for furtherdetails.
(C) Thirdparties
Wemay receive personal data about you from various third parties as set outbelow:
· TechnicalData from the following parties:
(i) analyticsproviders [such as Google based outside the UK];
(ii) advertisingnetworks [such as GoogleAd based outside the UK]; and
(iii) searchinformation providers [such as Algolia based outside the UK].
Pleasenote that when using our website, you may be able to share information throughsocial networks like Facebook and Twitter. For example, when you ‘like’,‘share’ or review our services. When doing this, your personal information maybe visible to the providers of those social networks and/or their other users.Please remember it is your responsibility to set appropriate privacy settingson your social network accounts so you are comfortable with how your informationis used and shared on them. This will not be the responsibility of Slow Adventure Limited.]
We will only use your personaldata when the law allows us to. Most commonly, we will use your personal datain the following circumstances:
· Where weneed to perform the contract we are about to enter into or have entered intowith you.
· Where it isnecessary for our legitimate interests (or those of a third party) and yourinterests and fundamental rights do not override those interests.
· Where we need to comply with a legalor regulatory obligation.
Generallywe do not rely on consent as a legal basis for processing your personal dataother than in relation to sending direct marketing communications to you viaemail or text message. You have the right to withdraw consent to marketing atany time by contacting us.
Purposes for which we will useyour personal data
We have set out below, in a table format, adescription of all the ways we plan to use your personal data, and which of thelegal bases we rely on to do so. We have also identified what our legitimateinterests are where appropriate.
Note that we may process your personal data formore than one lawful ground depending on the specific purpose for which we areusing your data. Please contact us ifyou need details about the specific legal ground we are relying on to processyour personal data where more than one ground has been set out in the tablebelow.
Marketing
Westrive to provide you with choices regarding certain personal data uses,particularly around marketing and advertising.
We have established the followingpersonal data control mechanisms:
Promotionaloffers from us
We may use your Identity, Contact, Technical, Usageand Profile Data to form a view on what we think you may want or need, or whatmay be of interest to you. This is how we decide which products, services andoffers may be relevant for you (we call this marketing).
You will receive marketingcommunications from us if you have requested information from us or purchased servicesfrom us and, in each case, you have not opted out of receiving that marketing.
Third-partymarketing
We will getyour express opt-in consent before we share your personal data with any companyoutside Slow Adventure Limited. for marketing purposes.
Optingout
Youcan ask us or third parties to stop sending you marketing messages at any time [bylogging into the website and checking or unchecking relevant boxes in yourcustomer area to adjust your marketing preferences] or by following the opt-outlinks on any marketing message sent to you or by contacting us at any time.
Whereyou opt out of receiving these marketing messages, this will not apply topersonal data that you have provided to us as a result of a purchase of travelservices or other such transactions.
Monitoring communications
We may monitor, record,store and use any [telephone,] email or other communication with you in orderto check any instructions given to us, for training purposes, for crimeprevention and to improve the quality of our customer service.
Cookies
You can set your browser to refuse all or somebrowser cookies, or to alert you when websites set or access cookies. If youdisable or refuse cookies, please note that some parts of this website maybecome inaccessible or not function properly. For more information about thecookies we use, please see [LINK TO COOKIE POLICY.]
Changeof purpose
Wewill only use your personal data for the purposes for which we collected it,unless we reasonably consider that we need to use it for another reason andthat reason is compatible with the original purpose. If you wish to get anexplanation as to how the processing for the new purpose is compatible with theoriginal purpose, please contact us.
Ifwe need to use your personal data for an unrelated purpose, we will notify youand we will explain the legal basis which allows us to do so.
Please note that we may process your personal datawithout your knowledge or consent, in compliance with the above rules, wherethis is required or permitted by law.
We may have to share your personaldata with the parties set out below for the purposes set out in the table inparagraph 4 above.
(A) InternalThird Parties as set out in the [Glossary].
(B) ExternalThird Parties as set out in the [Glossary].
(C) Specificthird parties, such as Local Partners.
(D) Thirdparties to whom we may choose to sell, transfer, or merge parts of our businessor our assets. Alternatively, we may seek to acquire other businesses or mergewith them. If a change happens to our business, then the new owners may useyour personal data in the same way as set out in this Privacy Policy.
Manyof our external third parties are based outside the UK so their processing ofyour personal data will involve a transfer of data outside the UK.
Where you haverequested a booking for travel arrangements which are located or otherwise dueto be fulfilled outside the UK, we will have to transfer your personal data tothe suppliers fulfilling or providing those travel arrangements outside the UKin order to make your booking and for those suppliers to be able to provide youwith the travel arrangements you have booked. Where we are unable to rely onone of the safeguards outlined below when transferring data to those suppliersoutside the UK, we will rely on the derogation under Article 49 of the UK GDPRin order to transfer your personal data to countries outside the UK (as thetransfer relates to the performance of a contract for your benefit), and youhereby permit us to do so. You also acknowledge that where your personal datais transferred outside the UK, controls on data protection may not be as wideas the legal requirements within the UK.
Wheneverwe transfer your personal data out of the UK, we ensure similar degree ofprotection is afforded to it by ensuring at least one of the followingsafeguards is implemented:
· We willonly transfer your personal data to countries that have been deemed to providean adequate level of protection for personal data.
· Where weuse certain service providers, we may use specific contracts approved for usein the UK which give personal data the same protection it has in the UK.
Please contact usif you want further information on the specific mechanism used by us whentransferring your personal data out of the UK.
We have put in place appropriate security measures toprevent your personal data from being accidentally lost, used or accessed in anunauthorised way, altered or disclosed. In addition, we limit access to yourpersonal data to those employees, agents, contractors and other third partieswho have a business need to know. They will only process your personal data onour instructions and they are subject to a duty of confidentiality.
Wehave put in place procedures to deal with any suspected personal data breachand will notify you and any applicable regulator of a breach where we arelegally required to do so.
Howlong will you use my personal data for?
We will only retain your personal data for as longas reasonably necessary to fulfil the purposes we collected it for, includingfor the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. Wemay retain your personal data for a longer period in the event of a complaintor if we reasonably believe there is a prospect of litigation in respect to ourrelationship with you.
Todetermine the appropriate retention period for personal data, we consider theamount, nature, and sensitivity of the personal data, the potential risk ofharm from unauthorised use or disclosure of your personal data, the purposesfor which we process your personal data and whether we can achieve thosepurposes through other means, and the applicable legal, regulatory, tax,accounting or other requirements.
Ourretention period for your personal data is 6 months following the completion ofyour holiday. Following that, your personal data will be removed.
By law we have to keep basic information about ourcustomers (including Contact, Identity, Financial and Transaction Data) for sixyears after they cease being customers for tax purposes.
In some circumstances you can ask us to delete yourdata: see Request erasure below forfurther information.
In some circumstances we may anonymise your personaldata (so that it can no longer be associated with you) for research orstatistical purposes in which case we may use this information indefinitelywithout further notice to you.
Under certain circumstances, you have rights underdata protection laws in relation to your personal data. Please click on thelinks below to find out more about these rights:
(A) Requestaccess to your personal data.
(B) Requestcorrection of your personal data.
(C) Requesterasure of your personal data.
(D) Object toprocessing of your personal data.
(E) Requestrestriction of processing your personal data.
(F) Requesttransfer of your personal data.
(G) Right towithdraw consent.
If you wish to exercise any of therights set out above, please contactus.
Nofee usually required
You will not have to pay a fee to access yourpersonal data (or to exercise any of the other rights). However, we may chargea reasonable fee if your request is clearly unfounded, repetitive or excessive.Alternatively, we may refuse to comply with your request in thesecircumstances.
Whatwe may need from you
We may need to request specific information fromyou to help us confirm your identity and ensure your right to access yourpersonal data (or to exercise any of your other rights). This is a securitymeasure to ensure that
personal data is not disclosed toany person who has no right to receive it. We may also contact you to ask youfor further information in relation to your request to speed up our response.
Timelimit to respond
We try to respond to all legitimate requests withinone month. Occasionally it may take us longer than a month if your request isparticularly complex or you have made a number of requests. In this case, we willnotify you and keep you updated.
LAWFULBASIS
· LegitimateInterest
means the interest of our business in conducting and managingour business to enable us to give you the best service and the best and mostsecure experience. We make sure we consider and balance any potential impact onyou (both positive and negative) and your rights before we process yourpersonal data for our legitimate interests. We do not use your personal datafor activities where our interests are overridden by the impact on you (unlesswe have your consent or are otherwise required or permitted to by law). You canobtain further information about how we assess our legitimate interests againstany potential impact on you in respect of specific activities by contacting us.
· Performanceof Contract
means processing your data where it is necessary for theperformance of a contract to which you are a party or to take steps at yourrequest before entering into such a contract.
· Comply with alegal or regulatory obligation
means processing your personal data where it is necessary forcompliance with a legal or regulatory obligation that we are subject to.
THIRD PARTIES
· ExternalThird Parties
i. Suppliers of travel services acting asprocessors based in the United Kingdom, Europe, Norway, Iceland, United Statesof America and Canada, who provide the travel services that make up any bookingof travel services that you make with us.
ii. Serviceproviders acting as processors based the United Kingdom and Europe who provideIT and system administration services.
iii. Professionaladvisers [acting as processors or joint controllers] including lawyers,bankers, auditors and insurers based in the United Kingdom who provideconsultancy, banking, legal, insurance and accounting services. These include Revolut, TavelVault Insurance,Starling Bank and TravLaw Lawyers.
iv. HM Revenue& Customs, regulators and other authorities [acting as processors or jointcontrollers] based [in the United Kingdom] who require reporting of processingactivities in certain circumstances.
YOUR LEGAL RIGHTS
You have the right to:
· Requestaccess
to your personal data (commonly known as a "data subject accessrequest"). This enables you to receive a copy of the personal data we holdabout you and to check that we are lawfully processing it.
· Requestcorrection
of the personal data that we hold about you. This enables you to haveany incomplete or inaccurate data we hold about you corrected, though we mayneed to verify the accuracy of the new data you provide to us.
· Requesterasure
of your personal data. This enables you to ask us to delete or removepersonal data where there is no good reason for us continuing to process it.You also have the right to ask us to delete or remove your personal data whereyou have successfully exercised your right to object to processing (see below),where we may have processed your information unlawfully or where we arerequired to erase your personal data to comply with local law. Note, however,that we may not always be able to comply with your request of erasure forspecific legal reasons which will be notified to you, if applicable, at thetime of your request.
· Object toprocessing
of your personal data where we are relying on a legitimate interest (orthose of a third party) and there is something about your particular situationwhich makes you want to object to processing on this ground as you feel itimpacts on your fundamental rights and freedoms. You also have the right toobject where we are processing your personal data for direct marketing purposes.In some cases, we may demonstrate that we have compelling legitimate grounds toprocess your information which override your rights and freedoms.
· Requestrestriction of processing
of your personal data. This enables you to ask us to suspend theprocessing of your personal data in the following scenarios:
(a) if you wantus to establish the data's accuracy;
(b) where ouruse of the data is unlawful but you do not want us to erase it;
(c) where youneed us to hold the data even if we no longer require it as you need it toestablish, exercise or defend legal claims; or
(d) you haveobjected to our use of your data but we need to verify whether we haveoverriding legitimate grounds to use it.
· Request thetransfer
of your personal data to you or to a third party. We will provide toyou, or a third party you have chosen, your personal data in a structured,commonly used, machine-readable format. Note that this right only applies toautomated information which you initially provided consent for us to use orwhere we used the information to perform a contract with you.
· Withdrawconsent at any time
where we are relying on consent to process your personal data. However,this will not affect the lawfulness of any processing carried out before youwithdraw your consent. If you withdraw your consent, we may not be able toprovide certain products or services to you. We will advise you if this is thecase at the time you withdraw your consent.
