Tribal Tracks Limited respects your privacy and is committed to protecting your personal information. This privacy policy explains how we collect, use, store and share personal information when you: visit our website; enquire about or book one of our trips, expeditions or fundraising challenges; take part in a Tribal Tracks trip; communicate with us; subscribe to our marketing; work with us as a charity, corporate client, supplier, contractor, expedition leader or other business contact; or are named as an emergency contact or otherwise provide information to us.
It also explains your rights under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and applicable electronic marketing and cookie laws, including the Privacy and Electronic Communications Regulations 2003 (“PECR”).
This policy applies to the website at https://www.tribaltracks.co.uk... to personal information collected through our booking forms, emails, telephone calls, documents, events and expedition operations.
Tribal Tracks Limited is the controller responsible for deciding how and why your personal information is used.
Our details are:
Legal name: Tribal Tracks Limited
Trading name: Tribal Tracks
Company number: 11059176
Registered office: Star Lodge, Montpellier Drive, Cheltenham, GL50 1TY
Principal business address: As above
ICO registration number: ZB092605
Email: info@tribaltracks.co.uk
Telephone: 01242 895272
Privacy contact: Charlotte Richards
Privacy contact email: charlotte@tribaltracks.co.uk
We are not legally required to appoint a Data Protection Officer. Responsibility for data protection is managed by our Privacy Contact, whose details are given above.
The information we collect depends on your relationship with us and the trip or service involved.
Identity and contact information
This may include: your name, title, date of birth and gender; postal address, email address and telephone number; nationality; photographs or other identification information; participant or booking reference numbers; and the name and contact details of your next of kin.
Booking and travel information
This may include: the trip you have selected; travel dates, itinerary and accommodation requirements; departure point, transport arrangements and flight information; room-sharing or group preferences; dietary, accessibility and equipment requirements; previous trekking, swimming, travel or expedition experience; passport and visa information; travel insurance information; permits, licences and other destination-specific documentation; and records of changes, cancellations, refunds and complaints.
Passport and identification information
Where required to arrange your travel or participation, we may collect: your passport number; passport issue and expiry dates; issuing country; nationality; a copy of the identification page of your passport; and visa or immigration information.
Passport information is particularly sensitive identity information, although it is not normally classed as special category data under the UK GDPR. We restrict access to it and share it only where reasonably necessary for travel, permits, accommodation, security, insurance, or expedition operations.
Health and medical information
Tribal Tracks trips may take place in remote, physically demanding or higher-risk environments. We may therefore need information about: medical conditions and medical history; allergies; medication; disabilities, mobility or accessibility needs; dietary requirements that reveal health or religious information; vaccinations or immunisations; fitness to participate; injuries or illnesses occurring before or during a trip; medical assessments or professional advice; and treatment or emergency assistance provided during a trip.
Health information is “special category data” and receives additional legal protection. Section 7 explains how we use it.
Emergency-contact information
We may ask you to provide the name, relationship, and contact details of one or more emergency contacts.
If you provide another person’s information, you should tell them: that you have given their information to Tribal Tracks, that we may contact them in connection with your welfare or an emergency; and where they can find this privacy policy. Please do not provide more information about an emergency contact than is necessary.
Payment and financial information
All client payments for our trips are made through the Protected Trust Services (“PTS”) trust-account arrangement. Customer funds are paid directly into the PTS trust account and held and administered in accordance with that arrangement.
Tribal Tracks does not receive or store your complete payment-card number or card security code. PTS, its merchant services provider, and the relevant banks or payment networks process the payment information needed to complete the transaction.
We receive and retain information needed to administer your booking and maintain our financial records, which may include: your name and billing details; the amount, date and status of a payment; payment and booking references; the payment method used, such as card or bank transfer; limited card information, such as the card type and final four digits, if supplied to us; deposits, instalments and outstanding balances; refunds, cancellations and chargebacks; and accounting and reconciliation records.
PTS and any payment or banking providers involved may process your information under their own privacy policies.
Charity and fundraising information
For charity fundraising trips, we may collect: the charity or cause you are supporting; fundraising targets and progress; fundraising-page information; communications about fundraising activities; information required by a partner charity; and confirmation that participation or fundraising conditions have been met.
A partner charity may be a separate controller of information it collects or receives. Its own privacy policy will explain how it uses that information.
Communications and service records
This may include: enquiries and correspondence; records of telephone calls or meetings; feedback, surveys, testimonials and reviews; complaints, incidents and insurance claims; consent and preference records; and notes needed to manage our relationship with you. We will tell you if we intend to record a telephone or video call.
Website and technical information
When you use our website, we may collect: IP address; browser and device information; approximate location derived from your IP address; pages visited and links selected; referral source; date, time and duration of visits; form submissions; cookie identifiers; and diagnostic, security and error-log information.
See section 14 of this policy for more information about cookies.
Photographs, video and promotional material
We may take or receive photographs, video recordings or participant stories relating to a trip or event. We will explain how we intend to use identifiable promotional material and, where required, ask for permission.
Operational photography, such as an image needed to document an incident or demonstrate compliance with safety procedures, may be handled on a different lawful basis.
Business and supplier information
If you represent a charity, corporate client, school, supplier, ground handler or other organisation, we may collect your: name, role and employer; business contact details; communications and contractual records; payment information; and professional qualifications, insurance or compliance documentation.
Information obtained from other sources
We may receive personal information from: another person making a group or family booking; your employer, school, charity or trip organiser; travel agents or booking partners; payment providers; airlines, accommodation providers and ground handlers; expedition leaders, medics or emergency-assistance providers; insurers and insurance intermediaries; public authorities or border agencies; publicly available sources; and professional advisers.
Where another organisation collects information for its own purposes, it may be a separate controller and its own privacy notice will apply.
Some information is necessary to enter into or perform our contract with you, comply with the law, arrange travel, assess whether a trip can be operated safely or respond to an emergency.
If you do not provide information that we reasonably require, we may be unable to: accept or administer your booking; arrange flights, accommodation, trekking permits; assess your suitability for a particular activity; make reasonable adjustments; manage foreseeable health and safety risks; provide appropriate emergency assistance; or allow you to participate safely.
We will explain which information is required when we collect it. We will not require you to agree to unrelated marketing as a condition of booking.
5. How and why we use personal information
The table below summarises our main purposes and lawful bases.
Purpose | Information typically used | UK GDPR lawful basis |
Responding to enquiries and preparing quotations | Identity, contact, trip and communications information | Steps requested before entering into a contract; legitimate interests in responding to enquiries and developing our services |
Creating and administering bookings | Identity, contact, booking, travel, payment and communications information | Contract; legitimate interests where we are managing a group or organisational booking |
Arranging flights, accommodation, transport, visas, permits, insurance support and ground services | Identity, contact, passport, travel insurance, booking and travel information | Contract; legal obligation where applicable; legitimate interests in delivering and coordinating the trip |
Managing charity fundraising challenges and relationships with partner charities | Identity, contact, booking and fundraising information | Contract; legitimate interests in administering the challenge and working with charity partners; legal obligation where applicable |
Assessing participant requirements and managing expedition safety | Booking, accessibility, emergency-contact and relevant dietary and health information | Contract; legitimate interests in operating safe and suitable trips; vital interests in genuine emergencies. Special category conditions are explained in section 7 |
Responding to accidents, illness, emergencies or safeguarding concerns | Identity, location, emergency-contact information, travel and health information | Vital interests; legal obligation; legitimate interests in protecting participants and managing incidents. Special category conditions are explained in section 7 |
Administering trust-account transactions, refunds, chargebacks and outstanding balances | Identity, booking, transaction and financial information | Contract; legal obligation; and our legitimate interests in maintaining accurate financial records and preventing fraud. |
Maintaining tax, accounting and business records | Identity, booking, transaction and contractual information | Legal obligation; legitimate interests in managing our business and demonstrating compliance |
Handling complaints, claims and disputes | Identity, booking, communications, incident, financial and relevant health information | Contract; legal obligation; legitimate interests in resolving disputes and establishing, exercising or defending legal claims |
Preventing fraud and protecting our website, systems, participants and staff | Identity, transaction, device, log and security information | Legitimate interests in security, fraud prevention and protecting our organisation and users; legal obligation where applicable |
Managing suppliers, charities and corporate relationships | Business contact, contractual and communications information | Contract; legitimate interests in managing professional relationships |
Improving our trips, website and customer service | Feedback, booking, usage and aggregated information | Legitimate interests in improving our services; consent where required for cookies or similar technologies |
Sending direct marketing | Contact details, preferences and engagement information | Consent or, where legally permitted, legitimate interests and the PECR “soft opt-in” for our similar services |
Publishing testimonials, participant stories or promotional images | Identity, image, voice and trip information | Consent where appropriate; legitimate interests where the use is reasonable, proportionate and expected |
Complying with laws and requests from authorities | Information relevant to the request | Legal obligation; legitimate interests in cooperating with lawful requests and protecting our rights |
Where we rely on legitimate interests, those interests may include: operating and improving our business; providing safe and well-organised trips; communicating with participants and business contacts; protecting participants, staff and suppliers; preventing fraud and securing our systems; maintaining appropriate business and legal records; and establishing, exercising or defending legal rights.
We consider whether our interests are necessary and proportionate and balance them against your rights and reasonable expectations.
Information requested during a booking may be necessary for our contract with you. Other information may be required by law or by airlines, border authorities, permit-issuing bodies or similar organisations.
We will aim to distinguish mandatory information from optional information. If required information is not provided, it may not be possible to complete the booking or provide the trip.
Medical and health information is special category data under the UK GDPR. Some dietary, accessibility, religious or biometric information may also be special category data, depending on what it reveals.
We will process special category data only where we have both an appropriate lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.
Depending on the circumstances, we may rely on: explicit consent: where you have given a specific, informed and express agreement to our use of identified health or other special category information for participant assessment, trip preparation, reasonable adjustments, risk management and delivery of the expedition; vital interests: where processing is necessary to protect someone’s life and the individual is physically or legally incapable of giving consent; legal claims: where information is necessary to establish, exercise or defend a legal claim; or another condition permitted by law, where relevant and properly documented.
When we rely on explicit consent, you can withdraw it by contacting us. Withdrawal will not make earlier processing unlawful. However, if the information is genuinely necessary to assess or manage the safety of your participation, withdrawing consent may mean that we cannot allow you to join or continue with the trip. We will explain the practical consequences before acting on a withdrawal.
Vital interests is an emergency condition. We will not treat it as a routine substitute for explicit consent.
We will: collect only health information reasonably relevant to the trip; limit access to Tribal Tracks staff, expedition leaders, medical personnel and in-country suppliers who need it; share only the information reasonably required for safety, care or emergency response; use appropriate security measures; and delete or anonymise it in line with our retention schedule unless it is needed for an incident, claim or legal obligation.
Participants must provide accurate and sufficiently complete information about matters that may affect their safety or the safety of others. This policy does not replace any medical declaration, consent form or participant terms that apply to a particular trip.
We use emergency-contact information to: contact someone if we are concerned about your welfare; coordinate assistance during a serious incident; communicate important information if you cannot do so yourself; and manage post-incident communications where appropriate.
Our lawful basis is normally our legitimate interests in protecting participants and managing emergencies. It may also be necessary to protect vital interests.
We generally retain emergency contact information only for as long as it remains necessary for the booking, the trip, and any related incident or claim.
We may share personal information, where necessary, with: Protected Trust Services, its Trustees, merchant-services providers, payment processors, banks and fraud-prevention providers; airlines, transport operators and travel agents; hotels, camps, lodges and other accommodation providers; overseas ground handlers, guides, porters and expedition staff; expedition leaders, medical personnel and emergency-response providers; visa, immigration, border-control and permit authorities; insurers, brokers and claims handlers; partner charities and fundraising providers; corporate clients, schools or group organisers; website, hosting, email, document-storage and IT support providers; Craft CMS-related website and form-service providers; customer relationship, booking and communications platforms; analytics and cookie-service providers, where permitted; accountants, auditors, lawyers and other professional advisers; regulators, police, courts, government departments and public authorities; and a purchaser, investor or adviser involved in a proposed sale, merger or reorganisation of our business.
We share only information reasonably necessary for the relevant purpose.
Some recipients, such as airlines, insurers, charities, border authorities and overseas accommodation providers may use information as independent controllers under their own privacy policies. Other suppliers process information only in accordance with our documented instructions. Where required, we put written data-processing terms in place with our processors.
We do not sell personal information.
Our website is built and managed using Craft CMS and may use additional plugins, hosting services and integrations to process form submissions.
When you submit an enquiry, booking request, medical form, or other online form, the information is transmitted to us and may be stored on our website, in our hosting environment, in our email system, or in connected business systems. Technical logs may record information such as the time of submission, IP address, browser and outcome of the submission. Spam-prevention and security services may also assess the submission. Authorised Tribal Tracks staff and relevant service providers may access the information where reasonably necessary to operate our website, administer your booking or deliver our services.
We configure our forms to collect only information reasonably required for their stated purpose. Information entered into a form may be transmitted when you select “submit”. You should not assume that an incomplete form has been saved unless the form explains that drafts or partial entries are retained.
Information submitted through our forms is handled in accordance with the lawful bases, special category data requirements, sharing arrangements, retention periods and security measures described elsewhere in this policy.
Organising and operating overseas trips may require us to send personal information to, or make it accessible by, organisations and individuals outside the United Kingdom.
For example, we may need to share limited information about identity, contact, passport, travel, dietary, accessibility, insurance, or medical needs with airlines, accommodation providers, overseas ground handlers, expedition leaders, guides, permit authorities, medical providers or emergency services.
We share only the information reasonably necessary to arrange and operate the trip, protect participants, meet destination requirements or respond to an emergency. Where possible, we use secure communication methods and limit access to those who need the information for the relevant purpose.
Some countries may not provide the same level of legal protection for personal information as the United Kingdom. Where the UK rules on international transfers apply, we will ensure that the transfer is covered by an appropriate legal mechanism. Depending on the destination, recipient and circumstances, this may include:
We will not routinely rely on an exception for regular or systematic transfers where an appropriate safeguard should reasonably be put in place.
Some small local operators, medical providers and public authorities may not accept standard UK contractual terms. Before sharing information in these circumstances, we will consider whether the disclosure is necessary, what information is required, the risks involved and whether a permitted exception applies. We will not make the transfer if there is no valid legal mechanism.
Medical and other special category information will receive the additional protection described in section 7. In an emergency, relevant information may be disclosed to local medical teams, hospitals, rescue services, insurers, assistance providers, authorities, or emergency contacts where necessary to protect someone’s life or welfare.
You may contact us for more information about the legal mechanism used for a particular type of international transfer and, where applicable, how to obtain a copy of the relevant safeguards. Certain confidential or commercially sensitive information may be removed from any copy provided.
We use appropriate organisational and technical measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.
Depending on the information and systems involved, these measures may include: access controls based on job responsibilities; strong passwords and multi-factor authentication; encryption in transit and, where appropriate, at rest; secure website connections; restricted access to passport and medical information; secure document and device management; backups, software updates and malware protection; supplier due diligence and contractual safeguards; staff confidentiality requirements and training; processes for securely deleting information; incident-response and personal-data-breach procedures; and periodic reviews of access and security arrangements.
No internet transmission or storage system can be guaranteed completely secure. You should contact us promptly if you believe information you have supplied to us has been lost, misused or compromised.
Where required by law, we will notify the Information Commissioner’s Office and affected individuals of a personal data breach.
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, insurance, safeguarding and reporting requirements.
Our expected retention periods are set out below. These periods must be read alongside any legal hold, complaint, accident, insurance claim or investigation that requires information to be retained for longer.
Information | Indicative retention period |
General enquiries that do not result in a booking | 24 months after the last meaningful contact |
Booking and contract records | 6 years after completion or cancellation of the trip |
Financial, invoice and tax records | Normally 6 years after the end of the relevant financial year, or longer if required by law |
Passport copies | Until 90 days after completion of the trip, unless needed for a dispute, claim or legal requirement |
Passport details required in booking records | Until 90 days after completion of the trip, unless needed for a dispute, claim or legal requirement |
Routine medical and dietary information | Until 90 days after completion of the trip, unless needed for a dispute, claim or legal requirement |
Medical, accident and incident records | Normally 6 years after resolution, or longer where necessary |
Emergency-contact information | Until 90 days after completion of the trip, unless needed for a dispute, claim or legal requirement |
Insurance and claims information | For the life of the claim and 6 years after its conclusion, or as advised by insurers or lawyers |
Complaints and legal disputes | Normally 6 years after resolution, or longer where necessary |
Marketing records | Until consent is withdrawn, an objection is received, or the information becomes inactive under our review policy |
Marketing suppression list | As long as reasonably necessary to ensure we respect the opt-out |
Cookie and analytics information | As stated in our cookie settings or cookie table |
Website and security logs | 90 days unless required to investigate an incident |
Supplier and business-contact records | For the relationship and normally 6 years afterwards |
We may keep anonymised information that can no longer identify you for statistical and business-planning purposes.
Our website uses cookies and similar technologies. Cookies are small data files stored on your device or accessed through your browser.
We may use: strictly necessary cookies, which are required for security, navigation, forms, bookings, cookie preferences or other essential website functions; analytics cookies, which help us understand how visitors use the website; functionality cookies, which remember choices or provide enhanced features; and advertising or marketing cookies, which may measure campaigns or support personalised advertising.
We do not set non-essential cookies unless we have obtained the consent required by law. You can accept, reject or manage non-essential cookies. Withdrawing consent will not affect cookies that were set lawfully before withdrawal.
Strictly necessary cookies cannot generally be disabled through our consent tool because the website may not function properly without them. You may still be able to block them through your browser.
We may send information about trips, expeditions, events and related Tribal Tracks services where: you have consented; you have asked us to send it; or the law permits us to contact an existing customer about our own similar services and we gave that person a clear opportunity to opt out when collecting their details and in every subsequent message.
You can stop direct marketing at any time by contacting us using the details in section 2.
We may retain limited information on a suppression list so that we do not contact you again against your wishes.
Stopping marketing will not prevent us from sending essential service messages about a current enquiry, booking, payment, safety matter or trip.
We will not share your information with another organisation for its own electronic marketing unless we have the necessary permission or another valid legal basis and the disclosure complies with PECR.
Many of our trips are intended for adults. Where a participant is under 18, we may collect information from or about the child through their parent, guardian, school or group organiser. We will use age-appropriate explanations where appropriate and obtain parental or guardian authorisation where required.
Information about children will be subject to additional care, restricted access and data-minimisation measures.
We may invite participants to provide a testimonial or agree to the use of an identifiable photograph, video or story for our website, brochures or social media. Where we rely on consent: participation is optional; refusing will not affect your booking; we will explain the intended uses; and you may withdraw consent for future use.
It may not be possible to recall printed materials already distributed or content already independently copied or shared by others. We will nevertheless stop new uses within our reasonable control after a valid withdrawal.
If you post information publicly and tag or mention Tribal Tracks, we may view or respond to it, depending on the platform’s features and your settings. The social-media platform is responsible for its own processing under its privacy policy.
Depending on the circumstances and the lawful basis used, you may have the right to: be informed about how we use your information; request access to your personal information and receive a copy; request correction of inaccurate or incomplete information; request deletion of your information; request restriction of its use; object to processing based on legitimate interests; object at any time to direct marketing; request data portability for certain information processed by automated means on the basis of consent or contract; withdraw consent at any time where we rely on consent; and seek safeguards in relation to certain decisions made solely by automated processing.
These rights are not absolute. For example, we may need to keep information to meet a legal obligation or establish, exercise or defend a legal claim. To exercise a right, contact us using the details in section 2. Please describe your request clearly. We may ask for information needed to verify your identity, but we will not ask for more than is reasonable.
We normally respond within one month. The law allows this period to be extended for complex requests, in which case we will explain the reason and expected timescale. We do not normally charge a fee. A reasonable fee may be charged, or a request refused, where the law permits this because a request is manifestly unfounded or excessive.
We do not currently make decisions about participants based solely on automated processing where the decision produces legal or similarly significant effects. Trip suitability and safety decisions involving health or experience information are reviewed by an appropriately authorised person. If this changes, we will update this policy and provide the information and safeguards required by law.
We would appreciate the opportunity to address your concern first. Please contact:
Privacy contact: Charlotte Richards
Email: charlotte@tribaltracks.co.uk
You also have the right to complain to the UK Information Commissioner’s Office (“ICO”).
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: https://ico.org.uk/make-a-comp...
You may contact the ICO at any time, although it will normally ask whether you have first raised the issue with us.
Our website may contain links to charities, fundraising platforms, insurers, airlines, travel providers, social media services, and other third-party websites.
Those organisations may collect and use information for their own purposes. We do not control their privacy practices. You should read the privacy policy of the relevant third party before providing information.
We may update this policy to reflect changes in our services, suppliers, technology, operations or legal obligations.
The current version will be published on this page with its effective date. If a change is significant, we may also provide a prominent notice on the website or contact affected individuals, where appropriate.
Have a question? Get in touch, our small team will be delighted to help.