Privacy Policy

1. Who We Are

1.1 Hike Yorkshire Ltd is a company registered in England and Wales under company number 16828978. We provide guided walking tours, day hikes and outdoor skills courses across Yorkshire.

1.2 For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, Hike Yorkshire Ltd is the data controller for the personal information described in this policy.

1.3 If you have any question about this policy or about how we handle your information, contact us through the details at hikeyorkshire.com/contact.

2. What We Collect and Why

We collect the following personal information, for the purposes and on the legal bases set out below.

Name, email address and telephone number. To respond to enquiries and manage bookings. Our legal basis is contract, or legitimate interests where you have made an enquiry but not yet booked.

Booking details, including activity, date and number of participants. To deliver the activity you have booked. Our legal basis is contract.

Emergency contact name and number. So that we can contact someone on your behalf in an emergency. Our legal basis is legitimate interests, being participant safety.

Health and medical information. To assess suitability, plan appropriately and respond correctly to a medical incident. Our legal basis is explicit consent, and in an emergency the protection of vital interests.

Dietary requirements, where relevant. To arrange refreshments or venue catering. Our legal basis is contract.

Photographs and video taken during activities. For marketing and social media. Our legal basis is legitimate interests, and you may object at any time.

Website usage data collected through analytics. To understand how the site is used and improve it. Our legal basis is legitimate interests.

Correspondence with us. To handle your enquiry and keep a record of it. Our legal basis is legitimate interests.

3. Health and Medical Information

We treat health information with particular care. Under data protection law it is special category data and attracts additional protection.

3.1 We ask participants to disclose medical conditions, injuries, allergies, medication and similar information before certain activities. We do this for one reason only: so that we can plan the activity appropriately and respond correctly if something happens on the hill.

3.2 We collect and process this information on the basis of your explicit consent, which you give by completing our health declaration form. You may withdraw that consent at any time, although we may then be unable to allow you to participate where we cannot assess the risk.

3.3 In a medical emergency, we may share relevant health information with emergency services, mountain rescue or medical staff. Where you are unable to consent at that moment, we rely on protection of your vital interests as our lawful basis.

3.4 Health information is accessible only to the guides directly delivering your activity and to whoever administers the booking. It is not used for marketing, it is not shared with third parties for any other purpose, and it is not combined with any other data set.

3.5 Completed health declarations are held securely and destroyed in accordance with the retention periods set out in section 8.

4. Bookings Made Through Third-Party Platforms

4.1 Some of our activities can be booked through third-party platforms such as GetYourGuide.

4.2 Where you book in this way, the platform collects your information under its own privacy policy and acts as an independent data controller in respect of that collection. It then passes to us the information we need to deliver your activity.

4.3 From the point at which we receive your information, this policy applies to how we handle it. If you want to know how the platform itself handles your data, please refer to its own privacy policy.

5. Cookies and Website Analytics

5.1 Our website uses cookies. A cookie is a small text file placed on your device which allows a website to recognise it on subsequent visits.

5.2 We use cookies in two ways. Some are strictly necessary for the website to function. Others are analytics cookies, set by Google Analytics, which help us understand how visitors use our site, which pages are read and where people arrive from.

5.3 We use analytics to improve the website. We do not use it to identify individual visitors, and we do not use it for advertising or remarketing.

5.4 You can control cookies through your browser settings. Most browsers allow you to refuse cookies entirely, to accept only certain types, or to be notified before one is set. You can also delete cookies already stored on your device. Please note that blocking cookies may affect how parts of our website function.

5.5 Analytics data is processed by Google. Google may transfer data outside the United Kingdom. Where it does so, appropriate safeguards apply under the UK extension to the EU-US Data Privacy Framework. Google's own privacy policy explains how it handles this data.

5.6 Google Analytics 4 does not store IP addresses. We have not enabled any advertising or user-ID features within it.

6. Marketing

6.1 If you have booked with us, we may occasionally email you about similar activities that may interest you. This is on the basis of our legitimate interests, and you can opt out at any time using the unsubscribe link in any email or by contacting us.

6.2 If you have not booked with us, we will only send you marketing email where you have specifically asked us to.

6.3 We do not sell your information to anyone, and we do not share it with third parties for their own marketing purposes.

7. Photography

7.1 We take photographs and video during activities and use them in our marketing and on social media.

7.2 If you would prefer not to appear in published images, tell your guide at the start of the activity and we will accommodate that. You can also ask us at any later point to remove an image in which you appear, and we will do so.

7.3 We do not tag or name individuals in published images without their agreement.

8. How Long We Keep Your Information

We keep personal information only for as long as we need it, and then delete or destroy it securely.

Enquiries that do not result in a booking. Twelve months.

Booking and customer records. Six years from the end of the tax year in which the activity took place, in line with HMRC requirements.

Health declaration forms. Three years from the date of the activity, so that we can respond to any claim arising.

Incident and accident records. Three years, or until the individual reaches the age of 21 where a child was involved.

Marketing contacts. Until you unsubscribe, after which we keep a suppression record so that we do not contact you again.

Website analytics data. Twenty-six months, being the standard Google Analytics retention period.

Photographs used in marketing. Until they are withdrawn from use, or on request.

9. Who We Share Your Information With

9.1 We share personal information only where it is necessary. Specifically:

• Emergency services, mountain rescue and medical staff, where there is a medical incident during an activity
• Our accountant and, where relevant, our insurers
• Service providers who process data on our behalf, including our website host and email provider, under written agreements requiring them to protect it
• Third-party booking platforms, in respect of bookings made through them
• Regulatory or law enforcement bodies, where we are legally required to do so

9.2 We do not sell your information. We do not share it for the marketing purposes of any other organisation.

9.3 Where a service provider processes data outside the United Kingdom, we satisfy ourselves that appropriate safeguards are in place, whether through an adequacy decision, the UK International Data Transfer Agreement, or an approved certification framework.

10. Where Your Information Is Held

10.1 Our website and its associated database are hosted by Hostinger on servers within the United Kingdom or European Economic Area.

10.2 Paper records, including completed health declaration forms, are held securely and destroyed by shredding once the retention period has passed.

10.3 We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss or damage. No system is perfect, and we do not claim otherwise, but we take this seriously.

11. Your Rights

Under data protection law you have the following rights. All of them are free to exercise and we will respond within one month.

• The right to be told what personal information we hold about you, and to receive a copy of it
• The right to have inaccurate information corrected
• The right to have your information deleted, where we have no continuing lawful reason to keep it
• The right to restrict how we use your information while a query is resolved
• The right to receive your information in a portable, machine-readable format
• The right to object to processing carried out on the basis of legitimate interests, including marketing
• The right to withdraw consent at any time, where consent is our lawful basis

11.1 To exercise any of these rights, contact us through hikeyorkshire.com/contact. We may ask you to confirm your identity before we act on a request, which is a protection for you rather than an obstacle.

12. Automated Decision-Making

12.1 We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Every decision about whether an activity is suitable for you is made by a person.

13. Children

13.1 Participants under the age of 18 must be accompanied by a parent or guardian, and we collect their information from that accompanying adult.

13.2 Our website is not directed at children and we do not knowingly collect information from children through it.

14. Complaints

14.1 If you are unhappy with how we have handled your personal information, please tell us first. We would rather have the opportunity to put it right.

14.2 You also have the right to complain to the Information Commissioner's Office, which is the UK data protection regulator. The ICO can be contacted at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Changes to This Policy

15.1 We may update this policy from time to time. The current version is always available at hikeyorkshire.com/privacy, and the date it was last updated appears at the top.

15.2 Where a change materially affects how we use your information, we will tell you directly.