privacy policy

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1.1 We are Always Outdoors Ltd (referred to as we, us or our in this policy), a company registered in England and Wales under company number 14463017, with registered office at Low Wood, Brockhill Road, Malvern WR14 4DL. We trade as Life Changing Activities and Gorge Walking Wales.

1.2 We take your privacy seriously. This policy explains what personal data we collect about you, what we do with it, how long we keep it, who we share it with and what rights you have. It applies to personal data we collect through our websites at lifechangingactivities.com and gorgewalkingwales.com, when you contact us, when you book one of our Activities, and when you take part in an Activity as a Participant.

1.3 We are the data controller in respect of the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO).

1.4 If you have any questions about this policy or about how we handle your personal data, please contact us at nathan@lifechangingactivities.com or nathan@gorgewalkingwales.com, or write to us at 18 Ryall Meadow, Ryall, Upton upon Severn, Worcestershire WR8 0PJ.

1.5 Words used in this policy with the same meaning as in our Terms and Conditions (such as Activity, Booker, Booking and Participant) have the meaning given in those Terms.

2. PERSONAL DATA WE COLLECT

2.1 The personal data we collect depends on how you interact with us. The categories below cover everything we typically hold.

2.2 About Bookers and individual Participants:

(a) name and contact details (email, phone, postal address);

(b) date of birth or age, particularly for Participants under 18;

(d) medical conditions, allergies, medications, dietary requirements and other information relevant to safe participation in the Activity;

(e) height and clothing size (so we can issue properly fitting kit);

(f) booking history and preferences;

(g) photographs and video footage taken during Activities;

(h) correspondence with us, including emails, contact-form submissions and notes of phone calls.

2.3 About school, youth-group, corporate and other organisational Bookers, we also collect:

(a) the name and contact details of the organisation, and of the individual making the Booking;

(b) details of teachers, leaders or accompanying adults;

2.4 About website visitors, we collect technical information including IP address, device and browser information, pages visited, and similar information collected through cookies and analytics. This is covered in more detail in section 10.

2.5 We do not hold card payment details. Payments are made by bank transfer (BACS) or cash, so card numbers, expiry dates and security codes never come into our hands.

3. HOW WE COLLECT YOUR PERSONAL DATA

3.1 We collect personal data:

(a) directly from you, when you enquire, book, complete a consent form, take part in an Activity, sign up to our marketing list, or otherwise communicate with us;

(b) from the person who books on your behalf, for example, the Booker who organises your stag, hen, corporate or school Activity, who may give us your name, age, emergency contact and medical declaration so that we can run the Activity safely;

(c) from schools and youth groups, who may provide us with class rosters, participant lists, individual care plans and copies of parental or guardian consents in advance of an Activity;

(d) from your parent or guardian, if you are under 18, via the consent form they complete for your Activity;

(e) automatically, when you visit our websites (see section 10).

3.2 Where someone else provides your personal data to us, we expect them to have the authority to do so. If you would like to know what we hold about you, please get in touch using the contact details in clause 1.4.

4. WHAT WE USE YOUR PERSONAL DATA FOR, AND OUR LEGAL BASIS

4.1 Under UK GDPR we must have a lawful basis for processing your personal data. The table below sets out what we use your data for and which lawful basis applies.

4.2 Performance of a contract with you (or steps to enter into one):

(a) responding to your booking enquiry and providing you with a quote;

(b) taking and managing your Booking, including issuing Booking Confirmations and invoices;

(d) handling rescheduling, cancellation, refunds and complaints.

4.3 Our legitimate interests (and, where relevant, the legitimate interests of a third party):

(a) ensuring the safety of Participants, our staff and the public during Activities (including operational photographs and video, and incident records);

(b) keeping accurate records of our Bookings and customers for business management, audit and dispute-resolution purposes;

(c) marketing similar services to people who have previously booked with us (“soft opt-in” under regulation 22 of the Privacy and Electronic Communications Regulations 2003);

(d) using photographs and video footage featuring Participants aged 18 or over in our marketing materials, including on our websites, on social media and in printed materials (subject to the right to object set out in section 13);

(e) investigating and defending claims or complaints;

(f) improving our service, including analysing booking patterns and customer feedback.

4.4 Where we rely on our legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You have the right to object to processing on this basis at any time, see section 8.

4.5 Consent:

(a) sending marketing communications to people who are not existing customers and who have opted in to receive them;

(b) using photographs and video footage featuring Participants under 18 in our marketing materials, where their parent or guardian has given specific opt-in consent;

4.6 Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.7 Legal obligation:

(a) keeping financial and tax records for the period required by HM Revenue & Customs;

(b) reporting accidents and incidents to the Health and Safety Executive or other regulator where this is required;

(d) responding to lawful requests from law-enforcement bodies and courts.

4.8 Vital interests: in a genuine emergency, we may process your medical or emergency-contact information to protect your life or someone else’s life (for example, by sharing it with paramedics or hospital staff).

5. WHO WE SHARE YOUR PERSONAL DATA WITH

5.1 We do not sell your personal data, ever. We share it only as described below.

5.2 Service providers (our processors). We use a small number of third-party services to run our business. They process personal data on our instructions and under written contracts that require them to keep your data secure and confidential. They are:

WordPress for hosting our websites.

Our website developer an independent contractor who supports our websites. Their access to live customer data is limited to what is necessary for that support.

IT support technician an independent contractor who provides IT and technical support to our business. Where their work involves accessing systems that hold personal data (for example, troubleshooting our email, cloud storage or website, or recovering data), they act as a processor and are bound by confidentiality and data-protection obligations under their engagement with us.

MailerLite for our marketing emails and newsletters (where you have opted in).

Google Workspace for our day-to-day email, calendar and document storage.

Microsoft 365 for some email and document storage, alongside Google Workspace.

FreeAgent for our invoicing and accounting records.

Google Analytics for understanding how our websites are used (see section 10).

5.3 Freelance instructors. We use freelance instructors to deliver some of our Activities. We share with them the information they need to do so safely, typically Participant names, ages, medical declarations and emergency contacts. Freelance instructors are bound by confidentiality and data-protection obligations under their engagement with us.

5.4 Insurer. We share personal data with our insurer only where there has been an incident, an accident or a claim. We do not routinely share Participant data with them.

5.5 Schools, youth groups and Bookers. Where you have taken part in an Activity organised by a school, youth group, employer or other Booker, we may share information back with that Booker (such as a participation list, kit returned, or feedback) for purposes connected to the Activity.

5.6 Emergency services and healthcare professionals. In a medical emergency we will share relevant information about you (including medical declarations and emergency contacts) with paramedics, hospital staff and similar.

5.7 Regulators and authorities. We will share personal data with regulators, the police or other authorities where we are legally required to do so, or where it is reasonably necessary to investigate or prevent a serious incident.

5.8 Professional advisers. We may share personal data with our lawyers, accountants and other professional advisers where reasonably necessary for them to advise us.

5.9 Successor businesses. If our business is sold or restructured, your personal data may be transferred to the buyer or successor, subject to the same protections under this policy or an equivalent privacy notice.

6. INTERNATIONAL TRANSFERS

6.1 Some of the service providers listed in section 5 are based in, or process personal data in, countries outside the United Kingdom, typically the United States. This is the case for Google Workspace, Google Analytics, MailerLite and Microsoft 365.

6.2 Where personal data is transferred outside the UK, we make sure it is protected to a standard recognised by UK data protection law. We rely on:

(a) the UK’s adequacy decisions, where the destination country has one;

(b) the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, where the country does not have an adequacy decision; or

6.3 If you would like more information about the transfer mechanisms we rely on for a particular provider, please contact us using the details in clause 1.4.

7. HOW LONG WE KEEP YOUR PERSONAL DATA

7.1 We keep your personal data for as long as we need it for the purposes described in this policy, and as long as the law requires us to keep it. The table below sets out our standard retention periods.

Booking records (adults) 6 years from the end of the Booking, in line with our legal obligation to keep accounting records and the standard limitation period for contract claims.

Booking records (under-18s) until the Participant reaches the age of 21 as a minimum, and longer where required (for example, where an incident is on file). This reflects the fact that the limitation period for personal-injury claims does not start to run against a young person until they reach 18.

Medical and emergency-contact information retained alongside the relevant Booking record, then deleted on the same timetable.

Consent forms retained alongside the relevant Booking record for the period applicable to that Booker or Participant.

Marketing Photographs and video (adult Participants) 3 years from the date of collection, or until consent is withdrawn, whichever is sooner. We may retain images beyond this period where we have confirmed you do not object to continued use.

Marketing Photographs and video (Participants under 18). 3 years from the date of collection or until consent is withdrawn, whichever is sooner. Continued use beyond this period requires renewed opt-in consent from the parent or guardian.

Photographs and video – operational/safety retained alongside the relevant Booking record.

Marketing list retained until you unsubscribe, or until you have been inactive (i.e. have not opened one of our marketing emails or booked an Activity) for 24 months, whichever is sooner.

Financial and tax records 6 years from the end of the relevant tax year, in line with HMRC requirements.

Incident and accident records the longer of 3 years from the date of the incident, the limitation period for any related claim, and (for under-18s) the period required under our under-18 retention policy above.

Website analytics as set out in section 10.

7.2 We may keep personal data for longer than the periods above where we need to in connection with a legal claim, dispute or regulatory investigation, or where we are otherwise required to by law.

8. YOUR RIGHTS

8.1 You have the following rights under UK data protection law:

(a) Access. You can ask us for a copy of the personal data we hold about you.

(b) Rectification. You can ask us to correct personal data that is inaccurate or incomplete.

(c) Erasure. In some circumstances you can ask us to delete personal data we hold about you (sometimes called the “right to be forgotten”). This right is not absolute — for example, we may need to keep some data to meet legal obligations or to defend a claim.

(d) Restriction. You can ask us to stop using your personal data in certain circumstances, for example while we look into your concerns.

(e) Portability. Where we are processing your data on the basis of consent or contract, and by automated means, you can ask us to provide it to you (or to another controller) in a structured, commonly used and machine-readable format.

(f) Objection. You can object at any time to us processing your data on the basis of our legitimate interests. You can object at any time to receiving marketing from us.

(g) Withdrawal of consent. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

(h) Automated decision-making. You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. We do not make any such decisions.

(i) Complaint to us, or to the ICO. You have a statutory right under the Data Protection Act 2018 to complain directly to us about how we have handled your personal data. You also have the right to complain to the Information Commissioner’s Office. How to do both is set out in section 9.

8.2 To exercise any of these rights, please contact us using the details in clause 1.4. We will respond within one month. We may need to ask for proof of identity before we can act on your request.

8.3 There is normally no charge for exercising your rights. We may, however, charge a reasonable fee or refuse a request that is manifestly unfounded, excessive or repetitive.

9. HOW TO COMPLAIN ABOUT HOW WE HANDLE YOUR PERSONAL DATA

9.1 You have a statutory right under section 164A of the Data Protection Act 2018 to complain directly to us if you consider that we have infringed UK data protection law in connection with your personal data. A complaint can relate to any aspect of our processing, for example, how we have responded to one of your rights requests, how long we have kept your data, how we have used it, our marketing or cookies practices, or a security incident.

9.2 How to make a complaint to us. You can contact us using any of the routes in section 16 (Contacting us). You do not need to use a particular form or wording, and we will accept your complaint however you choose to send it. It helps if you can tell us:

(a) what your complaint is about;

(b) when the events you are complaining about happened;

(d) how you would like us to contact you.

9.3 What we will do. On receipt of your complaint, we will:

(a) acknowledge your complaint within 30 days of receiving it;

(b) take appropriate steps to investigate, including making any enquiries we reasonably need to make;

(d) inform you of the outcome of your complaint, in plain English, without undue delay.

9.4 Complaining to the Information Commissioner’s Office (ICO). You also have the right to complain to the ICO. The ICO will normally expect you to have raised your concern with us first, but your right to complain to the ICO is not removed by anything in this section, you can complain to the ICO at any time, whether or not you have complained to us.

9.5 The ICO’s contact details are: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.

10. COOKIES AND WEBSITE TRACKING

10.1 Our websites use a small number of cookies and similar technologies. Most are essential to the site working properly (for example, remembering what you have selected as you move between pages). Others are optional, in particular, those used for analytics.

10.2 We use Google Analytics to understand how visitors use our websites, which pages are most read, where visitors come from, how long they stay, and similar. We use this information to improve the websites. Google Analytics sets its own cookies and processes some data on our behalf in the United States; see section 6 on international transfers.

10.3 We do not use any other tracking pixels or third-party advertising cookies on our websites.

10.4 Where required, you will be asked to agree to optional cookies (including Google Analytics) the first time you visit our websites, and you can change your preferences at any time using the cookie controls on the site.

11. CHILDREN AND YOUNG PEOPLE

11.1 We do not direct our marketing at children. Where a young person (under 18) takes part in one of our Activities, their personal data is collected and managed through their parent or guardian, or through the school or youth group acting in loco parentis.

11.2 Where consent is required for processing involving a Participant under 18, for example, marketing photography, we will only accept consent given by a parent or guardian.

11.3 Our retention periods for under-18s’ personal data are set out in section 7.

12. MARKETING

12.1 We send occasional marketing emails through MailerLite letting our customers know about upcoming Activities, special offers and news. We send these only where:

(a) you have specifically opted in to receive marketing from us (for example, by ticking a box when you booked or signed up to our list); or

(b) you have previously booked an Activity with us and we are marketing similar services. This is known as the “soft opt-in” under regulation 22 of the Privacy and Electronic Communications Regulations 2003.

12.2 Every marketing email we send includes an unsubscribe link. You can also withdraw consent or object to marketing at any time by contacting us using the details in clause 1.4.

12.3 Unsubscribing from marketing does not stop us from sending you essential service messages relating to a Booking (for example, confirmations, kit lists, reschedule notices and incident follow-up).

13. PHOTOGRAPHY AND IMAGE USE

13.1 We may take photographs and video during Activities. The legal basis on which we use them and what you can do, depends on how the images are used and who is in them:

(a) Operational and safety purposes. We may use these images internally, for example to evidence safe practice, to support an incident investigation, or for instructor training. We process these images on the basis of our legitimate interests and you can object to this processing at any time.

(b) Marketing. Participants aged 18 or over. We may use images featuring adult Participants in our marketing (including on our websites, on social media and in printed materials) on the basis of our legitimate interest, subject to the right to object.

(c) Marketing. Participants under 18. We will only use images featuring a Participant under 18 in our marketing where the Participant’s parent or guardian has given us specific opt-in consent on our consent form. That consent can be withdrawn at any time.

13.2 Where you object to marketing use of your image under clause 13.1(b) or withdraw consent for marketing use of an under-18s image under clause 13.1(c) we will remove the image from any marketing material under our direct control as soon as reasonably practicable. We are not required to recall historic uses (such as printed materials already in circulation) or content reposted by third parties.

13.3 On request and at our discretion, we may share event photographs with the Booker for personal use by Participants. Participants may not use those images commercially without our written consent.

13.4 Photography retention periods are in section 7.

14. HOW WE KEEP YOUR PERSONAL DATA SECURE

14.1 We take appropriate technical and organisational steps to protect your personal data against accidental loss, unauthorised access and misuse. These include:

(a) limiting access to personal data to people who need it to do their job;

(b) using reputable, security-tested third-party services as our processors;

(d) keeping software and devices up to date;

(e) training the people who handle personal data on their responsibilities.

14.2 No system is completely secure. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO without undue delay, in line with our obligations under UK GDPR.

15. CHANGES TO THIS POLICY

15.1 We may update this policy from time to time.

15.2 The current version of this policy will always be available on our websites.

16. CONTACTING US

16.1 If you have any questions about this policy or about how we handle your personal data, or if you would like to exercise any of your rights, please contact us using the details below.

Always Outdoors Ltd

By email: nathan@lifechangingactivities.com or nathan@gorgewalkingwales.com

By post: 18 Ryall Meadow, Ryall, Upton upon Severn, Worcestershire WR8 0PJ

ICO complaint route: ico.org.uk / 0303 123 1113

End of Privacy Policy

Always Outdoors Ltd • Company number 14463017

find out more

If you want to experience the best gorge walking that Wales and the Brecon Beacons can offer then contact us for a quote for you and your party.

We offer discounts for large groups and can arrange transport and accommodation if you have not already got it organised.