Privacy Policy

 

Our legitimate interests include operating and growing a responsible outdoor, coaching and travel-related business; communicating with customers; improving our services; maintaining records; keeping our website secure; preventing fraud; managing operational risk; protecting our legal rights; and delivering activities safely. We balance these interests against your rights and freedoms.

​

We will not use your personal data for a purpose that is incompatible with the reason it was originally collected without providing further information or obtaining consent where required.

​

5. Health, safety and special-category data

Outdoor activities, travel, camps, residentials and coaching programmes can involve practical, physical, environmental and welfare considerations. We may need limited information about a participant’s health, injury, disability, medication, allergies, dietary requirements, access needs, emergency contact, experience, fitness or other relevant circumstances.

Information about health is special-category personal data. We only collect it when reasonably necessary for safe delivery, participant welfare, reasonable adjustments, emergency planning, safeguarding, insurance or legal compliance.

We process relevant health and safety information under an Article 6 UK GDPR lawful basis, normally because it is necessary to perform our contract with you, comply with legal duties, pursue legitimate interests in operating safe activities, or protect someone’s vital interests in an emergency. Where required, we also rely on an applicable additional condition for special-category data, such as explicit consent, protection of vital interests, compliance with relevant health-and-safety or safeguarding obligations, substantial public interest, or the establishment, exercise or defence of legal claims.

​

We will:

• Limit access to relevant staff, instructors, trip leaders, coaches, first aiders and emergency responders who need the information.

• Ask for only the information reasonably necessary for the relevant service or activity.

• Use secure methods for collecting and storing sensitive information where reasonably practicable.

• Share information with medical professionals or emergency services where necessary to protect a participant’s health or safety.

• Ask you to update us if relevant information changes before the activity or programme begins.\

​

We do not provide medical, psychiatric, psychotherapy, crisis or emergency services unless we expressly agree otherwise in writing. Coaching, mentoring and resilience-oriented support are not a substitute for medical or mental-health care. If we believe there is an immediate risk to someone’s safety, we may contact emergency services, a parent or guardian, or another appropriate person.

​

6. Children, young people and safeguarding

Grit Pursuits may provide activities, camps, residentials, mentoring, coaching or educational programmes for children and young people.

​

Where a participant is under 18, we normally collect booking, emergency, medical, consent and safeguarding information from a parent or legal guardian. The adult making a booking confirms that they have parental responsibility or authority to provide the relevant information and make decisions for the child or young person.

​

We use children’s personal data only where necessary for booking administration, activity delivery, communication with parents or guardians, welfare, safeguarding, legal compliance, insurance, reasonable adjustments and participant safety.

We take particular care when processing children’s information. Where we communicate directly with a child or young person about their information, we will aim to provide information in clear, age-appropriate language.

​

We do not use a child’s personal data for direct marketing unless we have an appropriate lawful basis and, where required, valid consent. Marketing to a parent or guardian is separate from a child’s participation in an activity.

​

We may share relevant information with staff, volunteers, instructors, venues, accommodation providers, transport providers, medical professionals, emergency services, insurers, regulators, police and statutory safeguarding agencies where necessary for safety, welfare, safeguarding, legal compliance or incident management.

​

If we have a safeguarding concern, we may share information without consent where necessary to protect a child, young person or vulnerable adult, comply with a legal obligation, or respond to a serious risk of harm.

​

7. Marketing and newsletters

We may send information about Grit Pursuits activities, guided adventures, camps, coaching, self-guided routes, route resources, events, articles, offers and related news where permitted by law.

​

For newsletter sign-ups and new marketing contacts, we will normally rely on your consent. We use a clear, separate and unticked opt-in mechanism. You do not need to agree to marketing in order to make a booking, submit an enquiry or receive a service.

​

Where permitted by law, we may use the soft opt-in to send existing customers information about our own similar services, provided that we gave you a clear opportunity to opt out when we collected your details and in every subsequent message.

​

You may withdraw consent or object to marketing at any time by:

• Selecting the unsubscribe link in a marketing email; or

• Contacting us at office@gritpursuits.com.

​

We keep a limited suppression record of unsubscribe or objection requests so that we can respect your request and avoid sending further marketing.

​

8. Photography, video, testimonials and social media

We may take photographs or video at activities, events and programmes for operational, training, safeguarding, record-keeping or promotional purposes. We will tell participants where photography or filming is planned.

​

We will seek separate, clear permission before using identifiable photographs, video, testimonials or participant stories for marketing, our website, social media, printed materials, advertising or other promotional activity. We take particular care with images of children and young people and will obtain appropriate parent or guardian permission before using identifiable promotional images.

​

You can withdraw permission for future promotional use by contacting us. Withdrawal will not normally affect material already printed, published, distributed or shared before we receive and can act on your request.

​

Participants must not take, publish or share images of other participants, especially children or young people, in breach of our event rules, safeguarding procedures, the law or another person’s privacy.

​

9. Bookings, trips and third-party suppliers

To arrange and deliver a booking, we may share only the information necessary with relevant third parties. Depending on the service, these may include instructors, guides, coaches, venues, accommodation providers, transport providers, activity providers, local partners, travel suppliers, emergency-support providers and insurers.

​

This may include a participant’s name, contact details, booking details, age, dietary or accessibility requirements, relevant medical or safety information, emergency contact details and other requirements necessary to deliver the service safely.

​

Where Grit Pursuits acts as organiser of a trip or package, we use personal data to arrange and administer the travel services included in your booking. Where we act as an agent, consultant, introducer or referral partner for another provider, that provider may be an independent controller of personal data and its own privacy notice will apply. We will explain our role in the relevant booking terms or service information.

​

For international trips or services, we may need to share information with suppliers outside the UK. If travel documentation is required, we will collect only the information necessary to arrange the service.

​

10. Who we share information with

We may share personal data with carefully selected organisations where this is necessary to operate our services, comply with law, protect participants, or manage our business. These may include:

• Website and form provider: Wix, where used for website hosting, forms, website administration and related services.

• Payment provider: Payment-card data is normally processed directly by the payment provider under its own security arrangements.

• Email and marketing provider: Including but not limited to Mailchimp.

• Website analytics and advertising providers: Only where you have consented to optional cookies where consent is required.

• Cloud storage and business administration providers

• Professional advisers: accountants, insurers, insurance brokers, legal advisers, auditors and other professional advisers.

• Delivery partners: instructors, guides, coaches, venues, accommodation providers, transport providers, activity operators, local partners and travel suppliers.

• Authorities and emergency services: medical professionals, emergency services, police, regulators, safeguarding agencies, courts and public authorities where required by law or necessary to protect safety, welfare or legal rights.

​

Some organisations process personal data on our behalf as processors. We require them to protect personal data and use it only in accordance with our instructions where they act in that role. Other organisations, such as payment providers, insurers, emergency services, travel suppliers and public authorities, may act as independent controllers and apply their own privacy notices.

​

We do not sell your personal data or provide it to third parties for their own direct-marketing purposes.

​

11. International transfers

Some of our suppliers may store, access or process personal data outside the United Kingdom. This may occur, for example, where we use internationally hosted website, email, booking, analytics, payment, cloud-storage or travel-supplier services.

​

Where personal data is transferred outside the UK, we will use appropriate safeguards required by UK data-protection law. These may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism with appropriate additional protections where necessary.

​

12. How long we keep information

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal, tax, accounting, safeguarding, insurance, limitation and claims-handling requirements. We periodically review information and securely delete or anonymise it when it is no longer needed.

​

Our usual retention periods are:

• General enquiries that do not result in a booking: up to 24 months after the last meaningful contact.

• Marketing records and consent evidence: until you unsubscribe, withdraw consent or object to marketing, plus a limited suppression record where needed to ensure that you are not contacted again.

• Booking, payment, contract and accounting records: normally 6 years after the end of the relevant financial year, unless a longer period is required.

• Medical, activity screening and emergency information: normally until the activity, trip, camp or programme has ended, unless retention is necessary because of an incident, insurance requirement, safeguarding concern, complaint or legal claim.

• Risk assessments, participant declarations, incident reports, accident records, insurance correspondence and claim-related records: for the period required by our insurers, legal obligations and applicable limitation periods. This may be substantially longer for incidents involving children or potential personal-injury claims.

• Safeguarding records: in accordance with our Safeguarding Policy and applicable legal, regulatory and insurer requirements.

• Coaching records: normally 2 years after the final session, unless a longer period is necessary because of safeguarding, a complaint, insurance, legal claims or another legal requirement.

​

If a complaint, safeguarding issue, legal claim or investigation is ongoing or reasonably anticipated, we may retain relevant information until it has been resolved and any applicable retention period has expired.

​

13. Your rights

Subject to applicable law, you have the right to:

• Request access to the personal data we hold about you.

• Request correction of inaccurate or incomplete personal data.

• Request deletion of personal data in certain circumstances.

• Request restriction of processing in certain circumstances.

• Object to processing based on legitimate interests, including direct marketing.

• Withdraw consent at any time where we rely on consent. This will not affect processing already carried out before withdrawal.

• Request a portable copy of information you provided to us where this right applies.

• Complain to the UK Information Commissioner’s Office (ICO).

​

To exercise your rights, contact us at office@gritpursuits.com. We may ask for information to verify your identity before responding. We will respond within the timescales required by law.

​

If you are unhappy with how we handle your information, please contact us first so that we can try to resolve the matter. You also have the right to complain to the ICO. Information about making a complaint is available at ico.org.uk, or you can call the ICO on 0303 123 1113.

​

ICO registration reference: TO ADD

​

14. Security

We use reasonable organisational and technical measures to protect personal data appropriate to the nature of the information we hold. These measures may include access controls, role-based permissions, secure passwords, multi-factor authentication where available, secure devices, encrypted connections, supplier due diligence, confidentiality obligations, secure deletion practices and procedures for responding to suspected data breaches.

​

Only people who need access to personal data for an authorised purpose should be able to access it.

​

No method of internet transmission or electronic storage is completely secure. Although we take reasonable steps to protect information, we cannot guarantee absolute security.

​

If a personal-data breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals and the ICO where legally required.

​

15. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects.

​

If we introduce automated suitability screening, profiling or decision-making that has a significant effect on individuals, we will update this policy and provide the information required by law.

​

16. Third-party websites and services

Our website may contain links to third-party websites, booking systems, social-media platforms, partner organisations, accommodation providers, activity suppliers or travel services. These services operate under their own privacy policies and terms. We are not responsible for their content, privacy practices or security arrangements.

​

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, suppliers, technology, legal obligations or how we process personal data.

​

The current version will always be available on our website and will show the date it was last updated. Where a change is material, we will take appropriate steps to notify affected individuals where required.

​

18. Contact us

If you have questions about this Privacy Policy or how Grit Pursuits handles personal data, please contact:

Grit Pursuits Ltd
office@gritpursuits.com