Our commitment to protecting your data rights under UK GDPR regulations.
Last updated: January 2024
Ash-wren is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations and how you can exercise your rights.
For the purposes of data protection legislation, Ash-wren acts as the data controller for personal information collected through our website and services.
Contact details:
We process personal data under the following lawful bases:
Processing necessary to fulfil tour bookings and provide our services. This includes collecting contact details, tour preferences, and managing your booking.
Processing for our legitimate business interests, including improving our services, website functionality, and understanding how visitors use our site. We balance these interests against your rights and freedoms.
Where required, we obtain your explicit consent before processing. You may withdraw consent at any time by contacting us or using opt-out mechanisms provided.
Processing necessary to comply with legal requirements, such as maintaining financial records and responding to lawful requests from authorities.
You have the following rights regarding your personal data:
You can request a copy of the personal data we hold about you. We will provide this within one month of receiving your request.
If your personal data is inaccurate or incomplete, you have the right to request correction. We will make amendments within one month.
You can request deletion of your personal data in certain circumstances, including when it is no longer necessary for the purpose it was collected. Some data may be retained where legal obligations apply.
You can request that we limit how we use your data while concerns are being investigated or resolved.
Where processing is based on consent or contract, you can request your data in a structured, commonly used format to transfer to another service provider.
You can object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
To exercise any of these rights, contact us via:
We may request verification of your identity before processing requests. We aim to respond within one month, though complex requests may require an extension of up to two additional months.
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. Where the breach is likely to result in high risk to you, we will also notify you directly without undue delay.
Your personal data is primarily processed within the United Kingdom. Should any transfer to third countries be necessary, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK authorities.
If you are not satisfied with how we handle your data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We review and update this notice periodically to reflect changes in our practices or legal requirements. The date at the top indicates when this notice was last revised.