Privacy Policy

Last updated: 27th August 2026

Cotswolds Expeditions Ltd ("we", "our", "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, make an enquiry, book an experience, become a partner or otherwise interact with us.

1. Who We Are

Cotswolds Expeditions Ltd is the controller of the personal information we collect and use for the purposes described in this policy.

Company registration number: 17032474

Registered office: 43 Main Street, Bretforton, Evesham, England, WR11 7JH

Privacy email: privacy@cotswoldsexpeditions.co.uk

ICO registration number: TBC

2. What Personal Information We Collect

Depending on how you interact with us, we may collect:

  • Name

  • Email address

  • Telephone number

  • Booking and enquiry details

  • Pickup or meeting point information

  • Group size and guest information

  • Information relating to children participating in a booking

  • Emergency contact details, where voluntarily provided

  • Dietary requirements and allergy information

  • Accessibility or mobility requirements

  • Limited health information voluntarily provided where relevant to safe participation or reasonable adjustments

  • Payment and transaction information

  • Website usage and technical information

  • Communications and correspondence

  • Complaints, incident and insurance information

  • Reviews and feedback

  • Photographs or video where appropriate

  • ‍Marketing preferences

  • Partner or corporate enquiry information

We aim to collect only information that is relevant and reasonably necessary for the purpose for which it is required.

3. Children's Information

We do not knowingly collect personal information directly from children for the purpose of managing bookings. Where a child participates in a booking, information about that child is provided by a parent, guardian or the person making the booking. We ask booking customers not to provide more information about a child than is reasonably necessary for the experience.

4. How We Collect Your Information

We may collect personal information when you visit our website; complete a contact, enquiry or booking form; make a booking; contact us by email, telephone or social media; subscribe to marketing; apply to become a partner; participate in an experience; provide emergency or accessibility information; leave feedback; or interact with a third-party system connected with our service.

We may also receive information from authorised booking platforms, travel marketplaces, payment processors, corporate booking organisers, partner organisations or other providers where this is necessary to manage the booking or enquiry.

5. Where Information Is Stored and How We Access It

Customer information may be held across several systems used to operate Cotswolds Expeditions Ltd. Access is restricted to authorised users through the relevant secure administrator account or business inbox.

Bókun
Holds core booking, passenger, contact and booking-management information for direct and connected-channel reservations. Authorised staff can access this through the Cotswolds Expeditions Ltd Bókun account.

Stripe
Holds payment and transaction information for direct website payments. Authorised staff can access transaction records through the Stripe dashboard. Cotswolds Expeditions Ltd does not normally receive or store full payment-card numbers.

Squarespace
Provides the Cotswolds Expeditions Ltd website. Customer personal information is not stored within the Squarespace website. Where a visitor submits a website contact or enquiry form, the information entered is sent directly to Cotswolds Expeditions Ltd by email and is then held within the company’s Microsoft business email system.

Microsoft
Enquiries, correspondence and booking communications will be held in the Cotswolds Expeditions Ltd business email system provided by Microsoft. Authorised staff can access this information through the company’s secure Microsoft email accounts.

STQRY
Used only to provide the digital/audio-tour experience. No customer personal data is stored in STQRY by Cotswolds Expeditions Ltd.

Third-party booking marketplaces
Where a booking is made through an authorised distributor, that provider may separately retain booking information in its own systems and may act as an independent controller for some processing.

This section must be checked against the live system configuration before publication and updated whenever a material system is added or removed.

6. How We Use Personal Information

We may use personal information to:

  • Respond to enquiries

  • Process and manage bookings

  • Provide tours, expeditions and experiences

  • Confirm pickup arrangements, guest requirements and booking information

  • Manage private, corporate and partner enquiries

  • Communicate before, during and after a booking

  • Process payments, cancellations and refunds

  • Request feedback or invite guests to leave a review after their experience, including on platforms such as Google or TripAdvisor

  • Manage customer support and complaints

  • Make reasonable accessibility arrangements

  • Investigate accidents or incidents and manage insurance claims

  • Comply with health and safety responsibilities

  • Maintain business, accounting and tax records

  • Protect customers, staff, systems and the business

  • ‍Improve our website and services

  • Send marketing communications where permitted

  • Meet legal and regulatory obligations

7. Our Lawful Bases

We must have an appropriate lawful basis whenever we use personal information. Depending on the processing activity, we may rely on:

Contract
Where processing is necessary to provide a service you have requested or to take steps at your request before entering into a contract.

Legitimate interests
Where processing is reasonably necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights. This may include customer service, reasonable post-experience review requests, business administration, fraud prevention and service improvement.

Consent
Where you have actively agreed to a specific use of your information, for example certain marketing or the use of an identifiable photograph for promotional purposes. You can withdraw consent where consent is the basis relied upon.

Legal obligation
Where processing is required to comply with a legal or regulatory obligation.

Vital interests
In a genuine emergency, where processing is necessary to protect someone's life and the legal conditions for relying on this basis are met.

8. Dietary, Accessibility and Health Information

Some information about health, allergies or medical conditions may be special category personal data. Where we process special category information, we will identify both an appropriate lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9.

For voluntarily supplied health information used to assess suitability, support safe participation or make requested adjustments, Cotswolds Expeditions Ltd expects to rely on explicit consent where that is the appropriate Article 9 condition. Explicit consent will be requested separately and clearly where required, and customers should only provide information that is reasonably necessary for the booking.

In an emergency, another legal condition may apply where the law permits processing without consent. We will not treat ordinary contractual necessity by itself as sufficient authority to process special category health information.

9. Photography and Video

We may occasionally take photographs or video during tours for promotional or marketing purposes. We will seek permission before using an image in which a guest can be identified for our marketing. Guests are free to decline marketing photography without affecting their booking.

Where photographs are taken for another purpose, such as documenting an incident or damage, we will use them only where an appropriate lawful basis applies and only for that purpose or another compatible lawful purpose.

10. Customer Reviews and Feedback

Following an experience, we may contact the booking customer to request feedback or invite them to leave a review on a platform such as Google or TripAdvisor. We may do this as part of our legitimate interest in understanding and improving customer experience, subject to applicable electronic-marketing rules where relevant.

If we wish to reproduce an identifiable customer's review, photograph or other content in our own promotional materials beyond the original review platform, we will ensure that we have an appropriate lawful basis and permission where required.

11. Who We Share Information With

We may share only the information reasonably needed with trusted organisations involved in providing our services or running the business, which may include:

  • Bókun and authorised booking/distribution platforms

  • Stripe or other payment processors

  • Squarespace and website-service providers

  • Drivers, staff and contractors involved in delivering the experience

  • Partner venues, activity providers or hospitality businesses where relevant

  • Microsoft – business email and communications provider

  • Accountants, insurers, legal advisers and other professional advisers

  • Analytics or advertising providers where enabled and lawful

  • Public authorities, regulators or law enforcement where required by law

We do not sell personal information to third parties.

12. Payments

Payments may be processed through secure third-party payment providers, including Stripe for direct website bookings. We do not normally store full payment-card details ourselves. Payment providers process information in accordance with their own privacy and security arrangements.

13. Third-Party Websites

Our website may contain links to third-party websites or services. Those organisations are responsible for their own privacy practices and content. We encourage visitors to read the relevant privacy information before providing personal information to an external website or service.

14. Marketing Communications

We may send marketing communications where you have consented or where another lawful electronic-marketing basis applies. You can unsubscribe at any time using the unsubscribe mechanism provided or by contacting us. We do not sell personal information for third-party marketing.

15. Cookies and Website Analytics

Our website uses or may use cookies and similar technologies. Some are necessary for operation; others may support analytics, functionality or marketing. Where consent is required, non-essential technologies will only be used in accordance with the visitor's cookie choices. Please see our Cookie Policy.

16. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of tax, accounting, insurance, contractual, safety and dispute-resolution requirements. Our current working retention periods are:

Booking and transaction records
6 years from the end of the relevant company financial year, or longer where required for a tax enquiry, dispute, insurance matter or other legal reason.

General enquiries that do not become bookings
Up to 24 months after the last meaningful contact, unless there is a reason to retain them longer.

Marketing contact information
Until consent is withdrawn or an objection is made, plus a minimal suppression record where needed to ensure the person is not contacted again.

Complaints
Normally up to 6 years after closure where reasonably required for legal or dispute purposes.

Accident, incident and insurance records
For the period required by applicable legal, insurance and limitation requirements.

Health/accessibility information supplied for an individual booking
Deleted or anonymised when no longer reasonably required for the booking, safety follow-up or a related incident/claim, unless a longer period is legally justified.

Photography used for marketing
Until consent is withdrawn or the material is no longer used, subject to reasonable time needed to remove it from future controlled use.

Cookie/consent records
For the period reasonably required to demonstrate the consent or preference recorded.

17. International Transfers

Some service providers may process information outside the United Kingdom. Where a restricted international transfer occurs, we will use an appropriate legal mechanism or safeguard required by UK data-protection law. Details will depend on the providers used and will be reviewed as part of our supplier management.

18. Automated Decision-Making and Profiling

Cotswolds Expeditions Ltd does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on customers, and we do not carry out profiling of customers for such decisions. If this changes, this Privacy Policy will be updated and the additional legal requirements will be addressed before the processing begins.

19. Your Data-Protection Rights

Depending on the circumstances and the lawful basis relied upon, you may have rights to request access to your personal information, correct inaccurate or incomplete information, request erasure, request restriction of processing, object to certain processing, request data portability and withdraw consent where processing relies on consent.

To exercise a right, contact privacy@cotswoldsexpeditions.co.uk. Some rights only apply in particular circumstances.

20. Security

We take reasonable organisational and technical steps to protect personal information against loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction. Measures may include secure systems, access controls, password protection, multi-factor authentication where available and restricting access to authorised users. ‍

21. Complaints

If you are unhappy with how we handle your personal information, please contact us first so that we can investigate. You also have the right to complain to the Information Commissioner's Office (ICO).

Tel: 0303 123 1113

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business, systems, services or legal obligations. The latest version will be published on our website.