Legal
UK Photography Tours Ltd is committed to protecting your personal data. This policy explains what we collect, why we collect it, and how you can control it. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: April 2026.
1
UK Photography Tours Ltd (Company Registration No. 17020308, England and Wales), trading as UK Photo Tours, is the data controller for the personal data described in this policy.
If you have questions about how we handle your data, contact us at dion@uk-photo-tours.com. As a small business, we do not have a Data Protection Officer, but Dion Hitchcock (founder) handles all data-related enquiries directly.
2
We collect personal data only when you provide it to us, or when you interact with our website. The categories of data we may collect are:
| Category | Examples | When collected |
|---|---|---|
| Identity | First name, last name | Booking, enquiry, newsletter |
| Contact | Email address, phone number | Booking, enquiry, newsletter |
| Booking details | Tour selected, dates, dietary requirements, medical notes | Booking |
| Financial | Payment records (processed by Stripe - we do not store card data) | Booking |
| Technical | IP address, browser type, pages visited, cookies | Automatically on website visit |
| Communications | Emails, enquiries, feedback you send us | When you contact us |
We do not collect any special category data (health data, etc.) except where you voluntarily provide it for safety or dietary reasons in connection with a booking. Such data is used only for the purpose for which it was provided and is not shared or retained after your tour has taken place.
3
We use your data only for the purposes set out below, and only where we have a lawful basis for doing so.
| Purpose | Lawful basis |
|---|---|
| Processing and managing your booking | Contract (performing our agreement with you) |
| Issuing your financial protection certificate | Legal obligation (Package Travel Regulations 2018) |
| Responding to enquiries and contact form submissions | Legitimate interests |
| Sending tour-related communications (pre-departure information, kit lists) | Contract |
| Sending our newsletter and marketing emails | Consent (you can withdraw at any time) |
| Analysing website usage to improve our site | Legitimate interests |
| Complying with our legal and regulatory obligations | Legal obligation |
4
We do not sell your personal data. We do not share it with third parties for marketing purposes. We may share data with trusted service providers who help us operate our business, strictly on a need-to-know basis:
Evolution Insurance Solutions Limited - to issue your financial protection certificate (name, email, booking details, payment amount)
Mailchimp - to send our newsletter, if you have subscribed (name, email)
Formspree / Contact Form 7 - to receive enquiries from our contact form (name, email, message)
Google Analytics - anonymised website usage data (no personally identifiable data is shared)
All third-party processors are required to handle your data securely and in accordance with UK GDPR. We do not transfer your data outside the UK/EEA unless appropriate safeguards are in place.
5
We keep your data only for as long as necessary for the purposes for which it was collected:
Booking records - 7 years (to comply with financial record-keeping requirements)
Enquiries and contact messages - 2 years from date of enquiry
Newsletter subscribers - until you unsubscribe
Website analytics data - 26 months (anonymised)
6
Our website uses cookies, small text files stored on your device, to help the site function and to understand how it's used. We use:
Essential cookies: required for the site to function (e.g. session management). These cannot be disabled.
Analytics cookies: Google Analytics, used to understand page views, traffic sources, and usage patterns. Data is anonymised. You can opt out via your browser settings or the Google Analytics opt-out browser add-on.
We do not use advertising or tracking cookies. You can control cookies via your browser settings at any time.
7
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access
You can request a copy of the personal data we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete data.
Right to erasure
You can ask us to delete your data where there is no compelling reason to continue holding it.
Right to restrict processing
You can ask us to pause processing your data in certain circumstances.
Right to portability
You can request your data in a machine-readable format to transfer elsewhere.
Right to object
You can object to processing based on legitimate interests, or withdraw consent for marketing at any time.
To exercise any of these rights, email dion@uk-photo-tours.com. We will respond within 30 days. There is no charge for most requests.
If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
8
We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, or destruction. These include secure email communications, limited access to booking records, and the use of trusted, reputable third-party processors.
We do not store payment card data. All card transactions are processed by Stripe, which is PCI DSS compliant.
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.
9
We may update this policy from time to time to reflect changes in the law or how we operate. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
For any questions about this privacy policy or how we use your data, contact us at dion@uk-photo-tours.com.