Privacy Policy
At Saffron Heritage Guides, your privacy is of paramount importance to us. This Privacy Policy explains in detail how we collect, use, store, and protect your personal data when you interact with our website, services, and communications. We are committed to complying fully with data protection laws including the UK GDPR and the Data Protection Act 2018, ensuring your rights are respected throughout.
Information We Collect We collect information you provide directly when you book a tour, contact us, or subscribe to updates. This may include your name, contact details (email address, phone number), mailing address, payment information, and any additional preferences or requirements you share.
We also collect data automatically through website cookies and analytics tools such as your IP address, browser type, device information, pages visited, and time spent onsite to enhance user experience.
Purpose of Data Processing Your personal data is processed to
Facilitate bookings, reservations, and payments.
Communicate important information, updates, or promotional offers related to tours and services.
Improve and personalise our services and website experience.
Comply with legal obligations and enforce our terms of service.
Legal Basis for Processing We rely on your consent for marketing communications, contract necessity for booking and service provision, and legitimate interests for website operation and security.
Data Sharing and Third Parties We do not sell your personal information. However, we may share your data with trusted third parties such as payment processors, booking platforms, and IT service providers under strict confidentiality and security agreements. We may also disclose your data if required by law or to protect our legal rights.
Data Retention Your personal data will be retained only as long as necessary for the purpose collected, typically for the duration of our business relationship plus a reasonable period for legal compliance and dispute resolution, usually no longer than 7 years.
Data Security We implement robust technical and organisational measures to safeguard your data against unauthorised access, accidental loss, or destruction. Our systems are regularly reviewed and updated to enhance security.
International Transfers Where data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place such as Standard Contractual Clauses approved by the Information Commissioner’s Office.
Your Rights You have several rights regarding your personal data, including
Right to access and receive a copy of your data.
Right to rectification of any inaccurate or incomplete data.
Right to erasure (‘right to be forgotten’) under certain conditions.
Right to restrict or object to processing.
Right to data portability.
Right to withdraw consent at any time for marketing communications.
To exercise these rights, please contact us at [email protected]. We will respond within statutory timeframes.
Children’s Privacy Our services are not directed at children under 16. We do not knowingly collect data from minors without parental consent.
Changes to This Policy We may update this Privacy Policy periodically to reflect changes in legal requirements or our practices. Updates will be posted on this page with the revision date.
Contact Us If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact our Data Protection Officer at:
Email: [email protected] Address: The Guildhall Chambers, Market Place, Norwich, NR2 1NW Phone: +44 1603 555555
Complaints If you are dissatisfied with our data handling or response to your rights requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) via www.ico.org.uk.
Additional Legal Clauses We may use anonymised and aggregated data for statistical analysis and research to improve our services. Such data does not identify individual users.
Where required, we will obtain explicit consent for use of sensitive personal data.
We will notify affected individuals and authorities promptly in the unlikely event of a personal data breach as required by law.
We conduct privacy impact assessments for high-risk processing activities to mitigate risks to individuals.
All staff and contractors undergo data protection training to ensure compliance.
We apply privacy by design and default principles across all systems and services.
Technical measures include encryption, firewalls, secure servers, and regular security audits.
Organisational measures include access controls, confidentiality agreements, and incident response plans.
Where you have provided information about third parties (e.g. group members), you confirm that you have their consent to share their personal data with us.
Your interactions with our website may be monitored and logged for security and fraud prevention.
Where you choose to communicate with us via social media platforms, data processing may be subject to those third-party platforms’ terms and privacy policies.
We reserve the right to amend or supplement this Privacy Policy to keep pace with legal obligation and operational needs.
By using our services or website, you acknowledge acceptance of this Privacy Policy and consent to the processing of your personal data as described herein.
15. Data Breach Notification Procedures
In the unlikely event of a data breach that poses a significant risk to your rights and freedoms, we are committed to notifying you and the relevant supervisory authority (such as the Information Commissioner's Office in the UK) without undue delay, and where feasible, not later than 72 hours after having become aware of it. Our notification will describe the nature of the personal data breach, the categories and approximate number of data subjects concerned, the categories and approximate number of personal data records concerned, the name and contact details of our Data Protection Officer, the likely consequences of the personal data breach, and the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
16. Automated Decision-Making and Profiling
We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. All decisions regarding your bookings, inquiries, and interactions with our services are made by human staff members who are trained in data protection and customer service.
17. Third-Party Links and Services
Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
18. Updates to Your Information
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. You can update your information by contacting us directly using the contact details provided in this policy.
19. Consent and Withdrawal
Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
20. Governing Law and Jurisdiction
This Privacy Policy and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Privacy Policy.
Contact
Questions about this policy can be sent to [email protected] or by post to The Guildhall Chambers, Market Place, Norwich, NR2 1NW, United Kingdom.