Privacy Policy

Introduction

Adaptable Travel Limited, a company registered in England and Wales with company number 02913036 and registered office at 53 Barclay Road, Bearwood, Smethwick B67 5JY ("Adaptable Travel", "we", "our" or "us"), is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we look after personal data when you visit our website, use TourHQ (our online Teachers Dashboard), enquire about or book a trip with us, or otherwise give us personal data (for example by telephone or email), and tells you about your privacy rights and how the law protects you.

Because we organise trips for schools and colleges, we also hold personal data about people who do not deal with us directly: pupils and accompanying adults whose details are given to us by their school. Section 3 explains where we get this data from, and this Policy applies to them too.

This Privacy Policy is provided in a layered format so that you can click through to the specific areas set out below. Please also refer to the Glossary in section 12 if there is any terminology used in this Privacy Policy that you are unfamiliar with.

1. Important information and who we are
2. The data we collect about you
3. How your personal data is collected
4. How we use your personal data
5. TourHQ and our QuickBooks connection
6. Cookies and similar technologies
7. Disclosures of your personal data
8. International data transfers
9. Data security
10. Data retention
11. Your legal rights and how to complain
12. Glossary

1. Important information and who we are

Purpose of this Privacy Policy

This Privacy Policy aims to give you information on how we collect and process your personal data, including any data you may provide through our website, through TourHQ or by any other means when you request a quote, make a booking, use our resources, sign up to our mailing list, take part in a competition or campaign, or contact us.

Our website and TourHQ are designed for teachers and other school staff. They are not aimed at children and we do not knowingly collect personal data directly from children. We do process personal data about pupils under 18, which is given to us by their school or party leader for the purposes of a trip (see section 3).

It is important that you read this Privacy Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This Privacy Policy supplements the other notices and is not intended to override them.

Data controller

Adaptable Travel Limited is the controller of your personal data and is responsible for this website and for TourHQ. We are registered with the Information Commission (the ICO) as a fee payer under registration number ZA606398. Our parent company is Adaptable Travel (Holdings) Ltd (company number 16119618). Where we share personal data with our parent company for group management or reporting purposes, this Privacy Policy applies to that data too.

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights or any complaint, please contact the data privacy manager using the details set out below.

Contact details

Our full details are:

• Full name of legal entity: Adaptable Travel Limited
• Name of data privacy manager: Matt Connelly
• Email address: info@adaptabletravel.co.uk (please put "Data protection" in the subject line)
• Postal address: Adaptable Travel Limited, 53 Barclay Road, Bearwood, Smethwick B67 5JY
• Telephone number: 01451 832133

You have the right to make a complaint to us and to the Information Commission (the ICO), the UK regulator for data protection issues. Section 11 explains how to do this. We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to the Privacy Policy and your duty to inform us of changes

We keep our Privacy Policy under regular review. This version was last updated on 30 September 2026 and replaces the version dated 22 August 2024. Historic versions can be obtained by contacting us. It is important that the personal data we hold about you is accurate and current. Please keep us informed if any of the details you provide to us change during the course of your relationship with us.

Third-party links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

1. Identity Data: name, title, date of birth, gender (where needed for rooming or travel documents), nationality and passport or identity card details (where needed for travel).
2. Contact Data: the school or organisation you work for, your job title or role, your work address, email address and telephone numbers, and any personal contact details you choose to give us.
3. Profile Data: the subjects you teach, the trips you have enquired about or booked with us, your preferences, feedback, survey responses and our record of communications with you.
4. Financial Data: bank account details used to pay us or to receive refunds. We do not store payment card numbers; card payments are handled by our payment provider.
5. Transaction Data: details about payments to and from you and other details of the products and services you have purchased from us, including invoices, payments and credit notes.
6. Party Member Data: the details of pupils and accompanying adults that a school gives us so that we can organise a trip, for example names, dates of birth, gender, nationality, passport details, emergency contact details, rooming preferences and the special category data described below.
7. Safety and Incident Data: information we record if there is an accident, illness, safeguarding concern, complaint or other incident before or during a trip.
8. Technical Data: internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website or TourHQ.
9. Usage Data: information about how you use our website, TourHQ, our resources and our services.
10. Marketing and Communications Data: your preferences in relation to receiving marketing from us and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. For example, we may aggregate Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

Special categories of personal data

We collect the following special categories of personal data about party members, and about you if you are travelling:

1. health information, such as medical conditions, allergies, medication, mobility or access needs, and whether a person needs a carer or other support; and
2. dietary requirements, which may reveal religious or philosophical beliefs.

We collect and process this data only where it is necessary to deliver the trip safely and to look after party members while they are away. We rely on the explicit consent of the individual concerned, or of a parent or guardian for party members under 18, which the school obtains and confirms to us when it gives us the information. In an emergency, where it is not possible to obtain consent, we may also rely on the need to protect someone's vital interests, and where necessary to safeguard a child, on the substantial public interest condition for safeguarding children in the Data Protection Act 2018.

You are not under any obligation to consent to us processing this data. However, without it we may not be able to make the arrangements a party member needs, and in some cases we may be unable to accept that person on the trip. Consent can be withdrawn at any time by contacting us, although this will not affect the lawfulness of any processing carried out before it is withdrawn. If withdrawing consent means we can no longer provide the trip for the person concerned, the cancellation charges in clause 8 of our Booking Conditions (https://www.adaptabletravel.co.uk/downloads/booking-conditions) may apply.

We do not collect genetic or biometric data, or information about criminal convictions or offences.

If you fail to provide personal data

Where we need to collect personal data by law or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In other words, where we require details in order to provide the trip you have booked, and you do not provide them, we will not be able to provide the services you have booked or are attempting to book. In that case, depending on when the data is not provided, we may either not be able to process your booking or we may have to cancel it, in which case we will treat this as a cancellation by you in accordance with our Booking Conditions. We will notify you if we are unable to process a booking or are required to cancel a booking for this reason.

3. How your personal data is collected

We use different methods to collect personal data, including through:

Direct interactions

You may give us your Identity, Contact, Profile, Financial, Transaction and Marketing and Communications Data by filling in forms, creating a TourHQ account, or by corresponding with us by post, telephone, email or otherwise. This includes personal data you provide when you:

1. request a quote for a tour or visit (including through our quote form at quotes.adaptabletravel.co.uk);
2. make a booking, complete our booking form or accept a Tour Quotation;
3. use TourHQ, including when you add party member details or documents (see section 5);
4. join our mailing list, download resources or use tools on our website (such as our School Trip Launch Kit), or sign up at events, conferences or exhibitions;
5. fill out an enquiry or contact form on our website;
6. give us feedback, complete a survey, leave a review, or take part in a competition, prize draw or user-generated content campaign; or
7. contact us about a trip while your group is away, including through our emergency line.

Information given to us by your school or party leader

If you are a pupil, a parent or guardian, or a member of staff accompanying a trip, most of the personal data we hold about you will have been given to us by the school or organisation that booked the trip, usually by the party leader. This is Party Member Data and, where relevant, special category data (see section 2). We use it only to organise and run the trip, to keep party members safe and to meet our legal obligations. We ask schools to share this Privacy Policy (or the key information in it) with parents, guardians and pupils when they collect details for a trip, and our Booking Conditions require the school to obtain any consent that is needed before sharing information with us.

Automated technologies or interactions

As you interact with our website or TourHQ, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see section 6 for further details.

Third parties or publicly available sources

We may also receive personal data about you from third parties:

1. Technical Data and Usage Data from analytics and advertising providers such as Google (Google Analytics and Google Ads) and Microsoft (Clarity), which are based outside the UK, and from the providers of the website optimisation, form, review and video tools described in section 6;
2. Contact, Financial and Transaction Data from providers of technical, payment and accounting services, such as our customer relationship management (CRM) system provider based in the UK, our accounting software provider Intuit (QuickBooks Online) and our bank;
3. Identity and Contact Data about teachers and school staff, in their professional capacity, from education data providers such as The Education Company, based in the UK, and from publicly available sources such as school websites; and
4. information from our suppliers (for example airlines, accommodation providers and venues) about the performance of your trip, including any incident that occurs.

When using our website you may be able to share information through social networks such as Facebook, Instagram, LinkedIn and X, for example when you like, share or review our services or take part in a campaign such as #GoAdaptable. When doing this, your personal information may be visible to the providers of those social networks and their other users. It is your responsibility to set appropriate privacy settings on your social network accounts. Our User Generated Content Terms of Use (https://www.adaptabletravel.co.uk/user-generated-content-terms-of-use) explain how we use content you share with us.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

1. where we need to perform the contract we are about to enter into or have entered into with you or your school;
2. where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
3. where it is necessary for a recognised legitimate interest listed in Annex 1 to the UK GDPR, in our case safeguarding a person under 18;
4. where we need to comply with a legal or regulatory obligation;
5. where it is necessary to protect someone's vital interests, for example in a medical emergency; or
6. where you have given consent, which we rely on for special category data (section 2), for some electronic marketing (see Marketing below) and for non-essential cookies (section 6). You can withdraw consent at any time by contacting us.

See section 12 (Glossary) to find out more about the types of lawful basis that we rely on to process your personal data.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data on more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Marketing

We market our trips to teachers and schools. We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which trips, resources and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us by email if you have requested a quote or information from us, or booked with us, and you have not opted out of receiving that marketing (this is known as the "soft opt-in"), or if you have asked to receive them. Where we contact you at a school or organisation email address in your professional capacity, we rely on our legitimate interests in promoting our services to schools. We will only send marketing text messages to a personal mobile number where you have agreed to receive them, or where the soft opt-in applies. We may also contact you by telephone or post about our services unless you have asked us not to, and we check telephone numbers against the Telephone Preference Service before making marketing calls.

Third-party marketing. We will get your express opt-in consent before we share your personal data with any third party for that third party's own marketing purposes.

Opting out. You can ask us to stop sending you marketing messages at any time by following the unsubscribe link in any marketing email, by replying STOP to a marketing text message, or by contacting us using the details in section 1. Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of a booking, which we will continue to use to administer your trip.

Monitoring communications. We may monitor, record, store and use any email or other written communication with you in order to check any instructions given to us, for training purposes, for crime prevention and to improve the quality of our customer service. We only record telephone calls where we have asked you at the start of the call and you have agreed; we never record a call without your agreement.

Automated decision-making

We do not make any decisions about you based solely on automated processing which have legal or similarly significant effects on you.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. TourHQ and our QuickBooks connection

What TourHQ is

TourHQ is our online Teachers Dashboard (currently at app.adaptabletravel.co.uk), which lets the teachers organising a trip see their trip details, tasks, documents and a summary of the invoices and payments for their trip in one place. TourHQ accounts are created by us for teachers and other school staff involved in a booking, and for our own staff. Access is by a secure link sent to your email address. Use of TourHQ is governed by our TourHQ Terms of Use.

Data we process through TourHQ

1. Account data: your name, work email address, school or organisation, role, login activity and the actions you take in TourHQ.
2. Trip data: the details of the trip, itinerary, key dates and documents that we make available to you.
3. Information you add: Party Member Data and documents that you upload or enter so that we can organise the trip, which we use as described in sections 2 to 4.
4. Financial information from our accounting system, as described below.
5. Technical information collected by our error-monitoring service, as described below.

Our connection to QuickBooks Online

We keep our accounts in QuickBooks Online, an accounting service provided by Intuit. TourHQ connects to our own QuickBooks Online account so that trip organisers and our staff can see what has been invoiced and paid for a trip without us having to send separate statements. This connection:

1. is read-only. TourHQ can only read information from our accounting records. It cannot create, change or delete anything in QuickBooks Online, and it does not take payments;
2. reads only invoices, payments and credit notes issued or received by us. The information we store from these records is the invoice or credit note number, dates, amounts, balance and currency, the customer (school) name and billing email address, the send status of the invoice, and the amount, date and method of payments and which invoices they settle. We do not read or store invoice line items, notes, bank account or card details;
3. is used solely to display this financial information to the trip organisers of the school concerned and to our staff, and to help us manage your booking. A school's trip organisers can only see the financial information for their own school's trips, and only once we have linked their TourHQ account to their school's customer record. We do not use this information for any other purpose, we do not share it with anyone outside Adaptable Travel and the school concerned, and we do not sell it;
4. is secured by industry-standard measures. The credentials that allow TourHQ to read from QuickBooks Online are encrypted at rest, are never shown to users and are never written to logs. All information is encrypted in transit and at rest; and
5. can be disconnected by us at any time. If the connection is disconnected, the access credentials are deleted and TourHQ immediately stops reading from QuickBooks Online. Financial information already stored in TourHQ is kept as part of our booking and accounting records for the period set out in section 10 (the same information is also held in QuickBooks Online itself). We do not use it for any other purpose after disconnection, and we will delete it on request where we are not legally required to keep it.

Intuit is not responsible for TourHQ and we do not process any information on Intuit's behalf. Intuit processes the data held in QuickBooks Online as an independent controller under its own privacy statement. Intuit and QuickBooks are trademarks of Intuit Inc., registered in the US and other countries.

Error monitoring

TourHQ uses Sentry, an error-monitoring service provided by Functional Software, Inc. (a US company which participates in the UK Extension to the EU-US Data Privacy Framework), to detect and diagnose technical faults. When an error occurs, Sentry receives technical details of the error and a masked replay of the session in which it happened: a wireframe of clicks and page layout in which all text, typed input and images are hidden before they leave your browser. Sentry does not receive your IP address, and we do not send it your name or any passenger details. This information is used only to keep TourHQ working properly and is kept for a short period set in our Sentry account.

Where TourHQ data is hosted

TourHQ is built and operated by us. Its database is hosted by Convex in the European Union, the application is delivered by Vercel, a US company, and error monitoring is provided by Sentry, which hosts its service in the United States and Germany. All three providers act as our processors under written contracts and hold data encrypted in transit and at rest. Section 8 explains the safeguards we use where TourHQ data is processed outside the UK.

Your TourHQ account and passenger data

Your TourHQ account stays open while you are involved in trips with us, so that you can see your past and future trips. Party Member Data that you have added is removed from TourHQ 12 months after the trip ends. You can ask us to close your account at any time by emailing info@adaptabletravel.co.uk. Closing an account does not delete the trip records we are required to keep (see section 10).

6. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We and our service providers also use similar technologies, such as pixels, tags and local storage, which store or access information on your device. This section explains what we use them for and how you can control them. It applies to www.adaptabletravel.co.uk, our quote form at quotes.adaptabletravel.co.uk and TourHQ.

How we ask for your choices

When you first visit our website, a banner lets you accept all cookies, reject non-essential cookies, or choose which categories to allow. We only set cookies in the analytics, personalisation and marketing categories if you allow them. You can change your choices at any time using the "Cookie preferences" link in the footer of our website, and you can delete or block cookies through your browser settings. If you block essential cookies, some parts of our website or TourHQ may not work properly.

The categories we use

1. Essential: needed for the website, the quote form and TourHQ to work, including security, cookie preference storage, form submission, protection against automated abuse (Google reCAPTCHA on our quote form) and the secure login used by TourHQ. These do not require your consent.
2. Analytics: Google Analytics, loaded through Google Tag Manager, helps us understand how visitors use our website so that we can improve it. Because our analytics are linked to our advertising accounts, these cookies are set only with your consent.
3. Personalisation and testing: tools such as Intellimize (Webflow Optimize) which allow us to test different versions of pages and tailor content, and Microsoft Clarity, which records how visitors interact with pages (for example clicks and scrolling) to help us improve the site. These are set only with your consent.
4. Marketing: Google Ads tags used to measure whether our advertising leads to enquiries and to show relevant adverts, ClickCease click-fraud protection, and Dotdigital tracking, which links your visits to our website with the emails we send you and tells us whether an email was opened or a link clicked. These are set only with your consent. Where you allow marketing cookies and submit a form, contact details you enter may be sent to Google in a hashed (scrambled) form so that Google can match your enquiry to an advert you clicked on.
5. Embedded content: some pages include content from other companies, such as a Google reviews widget (Elfsight), embedded videos, and forms provided by Cognito Forms. These providers may collect your IP address and set their own cookies when the content loads.

TourHQ sets only the cookie needed to keep you signed in, and stores a small amount of information in your browser for error monitoring (see section 5). It does not use analytics or advertising cookies.

Third parties that set cookies or receive Technical Data through our website, including Google and Microsoft, may process that data outside the UK. Section 8 explains the safeguards that apply. For more information about how Google uses data from sites that use its services, see https://policies.google.com/technologies/partner-sites.

7. Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table in section 4.

1. The travel suppliers who provide your trip, for example airlines, ferry, rail and coach operators, accommodation providers, visit and activity providers, guides and local agents. We share only the information each supplier needs, for example passenger names and dates of birth for tickets, rooming lists and dietary or access needs for accommodation.
2. Airlines, ports, border and immigration authorities and other government bodies, where we are required to provide passenger information in advance of travel (for example Advance Passenger Information and the EU Entry/Exit System).
3. Our service providers acting as processors, who provide IT, hosting, customer relationship management, email, messaging, form, document, accounting, payment and analytics services, and who may only use your data on our instructions. These include Intuit (QuickBooks Online), Convex and Vercel (TourHQ hosting), Sentry (TourHQ error monitoring), Microsoft, Google, our CRM, email marketing and SMS providers, and our website platform.
4. Insurers, ABTA, the Civil Aviation Authority (for ATOL) and their agents, where necessary to arrange or claim under financial protection or insurance, and in the event of a claim or complaint.
5. Professional advisers, including lawyers, bankers, auditors and insurers based in the UK, who provide consultancy, banking, legal, insurance and accounting services.
6. HM Revenue & Customs, regulators, the emergency services, the police and other authorities, where the law requires us to report or disclose information, or to protect the safety of a party member.
7. Our parent company, Adaptable Travel (Holdings) Ltd, for group management and reporting purposes.
8. Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where a third party acts as our processor, we do not allow it to use your personal data for its own purposes and only permit it to process your personal data for specified purposes and in accordance with our instructions. Some recipients, such as airlines, accommodation providers, insurers and public authorities, are controllers in their own right and will process your personal data in accordance with their own privacy notices.

8. International data transfers

As part of providing our services, your personal data may be transferred to, accessed by or processed outside the United Kingdom.

Where you have booked a trip which takes place outside the UK, we have to transfer personal data to the suppliers providing that trip (such as accommodation providers, coach operators and venues) in the countries you are visiting or travelling through, so that they can provide the services you have booked. These transfers are necessary for the performance of our contract with you and to make the arrangements you have asked for.

Some of our service providers also process personal data outside the UK, in particular in the United States and the European Economic Area (EEA). Where personal data is transferred outside the UK, we ensure that at least one of the following safeguards applies:

1. UK adequacy regulations: the country or organisation receiving the data is covered by regulations made under Article 45A of the UK GDPR, which confirm that its data protection standards are not materially lower than the UK's. This covers the EEA and, for US organisations that are certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), the United States;
2. Approved transfer mechanisms: where a service provider is not covered by adequacy regulations, we use the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses approved by the ICO, together with a transfer risk assessment. These contractual obligations require the recipient to protect your data to UK standards; or
3. Additional safeguards: where appropriate we also use measures such as encryption and limiting the data shared.

Where we are unable to rely on one of the safeguards above when transferring data to a travel supplier outside the UK, we rely on the exception in Article 49 of the UK GDPR that allows a transfer which is necessary for the performance of our contract with you, or for a contract made in your interest, so that we can provide your trip. We will only do this where the transfer is necessary and proportionate. Please note that where your personal data is transferred outside the UK, the legal protections may not be as wide as in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK, or a copy of the safeguards relied on.

9. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include encryption of data in transit and at rest in our core systems, access controls and multi-factor authentication for our staff, and secure links rather than passwords for TourHQ. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and the ICO of a breach where we are legally required to do so.

10. Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, insurance or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, insurance or other requirements. Our standard retention periods are:

‍

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after the end of the financial year in which they cease being customers, for tax purposes. Records relating to the safety of party members are kept for seven years in line with our TourTrust safety management system, or longer if a claim is made or anticipated.

In some circumstances you can ask us to delete your data: see section 11 for further information. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

11. Your legal rights and how to complain

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These are explained in more detail in the Glossary (section 12):

1. request access to your personal data;
2. request correction of your personal data;
3. request erasure of your personal data;
4. object to processing of your personal data, including at any time to processing for direct marketing;
5. request restriction of processing of your personal data;
6. request the transfer of your personal data to you or a third party;
7. withdraw consent at any time where we are relying on consent; and
8. make a complaint to us and to the ICO.

If you wish to exercise any of the rights set out above, please contact our data privacy manager using the details in section 1. Parents and guardians may exercise these rights on behalf of a child, and a child may exercise them in their own right where they are able to understand them. If you are a pupil, parent or accompanying adult, you may find it quickest to contact us through your school's party leader, but you do not have to.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month of receiving them (or, if later, of receiving any identity or clarifying information we have asked for). Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests, in which case we will tell you within the first month and keep you updated. Where you ask for access to your personal data, we will carry out a reasonable and proportionate search for it.

How to complain

If you have any concerns about how we handle your personal data, please tell our data privacy manager using the details in section 1. You can complain by email, by post or by telephone, and we will provide a complaint form on request. Please give us your name, contact details, your relationship with us (for example teacher, parent or pupil), the school and trip concerned if relevant, and as much detail as you can about your concern. If you are complaining on behalf of someone else, we will ask for evidence that you are entitled to act for them.

We will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed of our progress and tell you the outcome without undue delay.

You also have the right to complain at any time to the Information Commission (the ICO), the UK regulator for data protection: online at https://ico.org.uk/make-a-complaint/, by telephone on 0303 123 1113, or by post to Information Commission's Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL. The ICO recommends that you raise your concern with us first.

12. Glossary

Lawful basis

Legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Recognised legitimate interest means one of the specific purposes listed in Annex 1 to the UK GDPR for which the law recognises that processing is necessary without a separate balancing test. The one we rely on is safeguarding a vulnerable individual, which includes anyone under 18.

Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract. Where a school books with us, the contract is with the school, and we also rely on our legitimate interests in performing that contract when we process the data of individual party members.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to, such as providing passenger information to border authorities, keeping accounting records, or meeting our obligations under the Package Travel and Linked Travel Arrangements Regulations 2018, the ATOL Regulations and the ABTA Code of Conduct.

Vital interests means processing that is necessary to protect someone's life or physical safety, for example sharing a party member's medical information with a doctor in an emergency.

Consent means a freely given, specific, informed and unambiguous indication of your wishes. Explicit consent, which we rely on for special category data, must be expressly confirmed in words. Consent can be withdrawn at any time.

Third parties

Internal third parties means our parent company, Adaptable Travel (Holdings) Ltd, based in the United Kingdom, which may receive personal data for group management and reporting purposes.

External third parties means:

1. suppliers of travel services who provide the travel services that make up your trip, based in the UK and in the countries you are visiting or travelling through, who act as controllers of the data they need to provide their services;
2. service providers acting as processors, based in the UK, the EEA and the United States, who provide IT, hosting, customer relationship management, email marketing, SMS messaging, form, document, project management, accounting, payment and analytics services;
3. professional advisers, including lawyers, bankers, auditors and insurers based in the UK, who provide consultancy, banking, legal, insurance and accounting services; and
4. HM Revenue & Customs, the Civil Aviation Authority, ABTA, border and immigration authorities, regulators and other authorities based in the UK and abroad who require reporting of processing activities in certain circumstances.

Your legal rights

Under the UK GDPR, you have the following rights regarding your personal data:

1. Right of access: you have the right to request a copy of the personal data we hold about you and to check that we are processing it lawfully.
2. Right to rectification: if any of the data we hold about you is inaccurate or incomplete, you have the right to ask us to correct or complete it.
3. Right to erasure: you may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (where applicable) and there are no other legal grounds for processing, where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with the law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
4. Right to restrict processing: you have the right to request that we limit the processing of your data in certain circumstances, such as if you want us to establish the data's accuracy; where our use of the data is unlawful but you do not want us to erase it; where you need us to hold the data even if we no longer require it because you need it to establish, exercise or defend legal claims; or where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
5. Right to object: you may object to the processing of your data where we are relying on legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground, as you feel it impacts on your fundamental rights and freedoms. You also have the right to object at any time where we are processing your personal data for direct marketing purposes, and we will stop. In other cases, we may demonstrate that we have compelling legitimate grounds to continue which override your rights and freedoms.
6. Right to request transfer of your personal data: where the processing is based on your consent or a contract with you and the data is processed by automated means, you have the right to request that we transfer your data to another organisation or directly to you in a structured, commonly used and machine-readable format.
7. Right to withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
8. Right to complain: you have the right to complain to us under section 164A of the Data Protection Act 2018 and to the Information Commission under section 165 of that Act. Section 11 explains how.