Last updated: September 2024
Our Commitment to Data Protection
ash-saga Heritage Tours is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides detailed information about your rights and how we fulfil our obligations under these regulations.
Data Controller Information
ash-saga Heritage Tours acts as the data controller for personal information collected through this website and in connection with our tour services.
Contact details:
ash-saga Heritage Tours
14 Heritage Lane
Bath, BA1 2QR
United Kingdom
Email: [email protected]
Your Rights Under UK GDPR
Right to Be Informed
You have the right to be informed about how we collect and use your personal data. Our Privacy Policy and this GDPR page provide this information clearly and transparently.
Right of Access
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.
Right to Rectification
If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will rectify the data within one month of receiving your request.
Right to Erasure
Also known as the right to be forgotten, you may request deletion of your personal data in certain circumstances, including:
- The data is no longer necessary for its original purpose
- You withdraw consent and there is no other legal basis for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
Right to Restrict Processing
You may request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of disputed data.
Right to Data Portability
Where processing is based on consent or contract performance and carried out by automated means, you have the right to receive your personal data in a structured, commonly used format.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop processing immediately.
Rights Related to Automated Decision Making
You have rights related to automated decision making and profiling. We do not currently engage in automated decision making that produces legal effects concerning you.
How to Exercise Your Rights
To exercise any of your rights, please contact us at [email protected] with the following information:
- Your full name
- The specific right you wish to exercise
- Any information that will help us identify your data
We may need to verify your identity before processing your request. We do not charge a fee for most requests, though we may charge a reasonable fee for manifestly unfounded or excessive requests.
Lawful Bases for Processing
We process personal data under the following lawful bases:
- Consent: Where you have given clear consent for us to process your personal data for specific purposes
- Contract: Where processing is necessary for a contract with you or to take steps at your request before entering into a contract
- Legal Obligation: Where processing is necessary to comply with the law
- Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, unless overridden by your rights
Data Retention Periods
We retain personal data only for as long as necessary:
- Booking enquiries: 2 years from date of enquiry
- Completed tour records: 7 years for accounting purposes
- Marketing preferences: Until you withdraw consent
- Website analytics: 26 months
Data Security Measures
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit
- Regular security assessments
- Staff training on data protection
- Access controls and authentication
- Regular backup procedures
Data Breach Procedures
In the event of a personal data breach, we will:
- Assess the risk to individuals' rights and freedoms
- Notify the Information Commissioner's Office within 72 hours if required
- Notify affected individuals without undue delay if there is high risk to their rights and freedoms
- Document all breaches and our response
Complaints
If you are dissatisfied with how we handle your personal data, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Information
We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.