This Privacy & Data Protection Policy ("Privacy Policy") explains how Actiontrails Ltd ("Company", "Platform", "we", "us", or "our") collects, uses, shares, and protects the personal data of travelers ("Users") and tour operators/guides ("Providers").
This policy is designed in compliance with the UK GDPR, the EU General Data Protection Regulation (GDPR), and applicable data protection legislation.
1. DATA CONTROLLER & COMPANY IDENTIFICATION
1.1 Data Controller Identification:
Actiontrails Ltd acts as the primary Data Controller for personal data processed through our marketplace website, mobile applications, and booking systems.
- Company Registration Number: 633311
- Registered Office Address: 51 Bracken Road, Dublin, Co Dublin, Ireland, D18 CV48
- VAT / Tax Registration Number: [Insert GB/IE VAT No]
- Supervisory Authority / Official Register: Companies Registration Office, Ireland.
1.2 Data Protection Contact:
For questions regarding this policy, Data Subject Access Requests (DSARs), or privacy inquiries, contact our Data Protection Officer at:
- Email: info@actiontrails.com
2. PERSONAL DATA WE COLLECT
We collect personal data directly from you, automatically through platform usage, and from third-party payment processors:
- Account & Identity Data: Full name, email address, phone number, physical address, profile picture, and account credentials.
- Provider Compliance Data: Business registration details, government identification, guide certifications, commercial insurance documents, and payout bank account details.
- Financial & Payment Data: Payment card tokens, transaction history, billing address, and payout records (processed securely via PCI-DSS compliant payment gateways such as Stripe or PayPal; full card numbers are never stored on our servers).
- Technical & Usage Data: IP address, device type, browser characteristics, operating system, access timestamps, and interactions with listings.
3. LEGAL BASES & PURPOSES OF DATA PROCESSING
Under UK/EU GDPR, we process personal data based on the following legal grounds:
| Purpose of Processing | Categories of Data | Legal Basis (GDPR) |
|---|---|---|
| Account setup, booking management, and transaction execution | Account, Booking, Financial | Contractual Necessity (Art. 6(1)(b)) |
| Sharing traveler details with the booked Provider for tour logistics | Account, Booking, Emergency Contacts | Contractual Necessity (Art. 6(1)(b)) |
| Fraud prevention, platform security, and marketplace integrity | Technical, Account, Usage | Legitimate Interests (Art. 6(1)(f)) |
| Direct marketing communications and news updates | Account, Technical | Consent (Art. 6(1)(a)) / Soft Opt-in |
| Tax reporting, legal compliance, and accounting obligations | Financial, Provider Compliance | Legal Obligation (Art. 6(1)(c)) |
4. DATA SHARING & THIRD-PARTY RECIPIENTS
4.1 Sharing with Providers (Two-Sided Marketplace Mechanism): When a User books an Event, necessary personal details (traveler name, phone number are shared directly with the designated Provider to facilitate booking. Providers act as independent data controllers regarding their operational use of this data.
4.2 Service Providers & Processors: We share data with trusted third-party service providers acting under strict data processing agreements:
- Payment Processors: Stripe Connect, PayPal Marketplace.
- Infrastructure & Hosting: AWS / European cloud data centers.
- Customer Support & Communications: Transactional email and SMS gateways.
4.3 Legal & Regulatory Disclosure: We may disclose personal data to law enforcement, statutory authorities, or search-and-rescue agencies if required by law or in emergency situations to protect physical safety.
5. INTERNATIONAL DATA TRANSFERS
Because Providers and travelers are located globally, personal data may be transferred outside the United Kingdom or European Economic Area (EEA) to facilitate international bookings.
Where data is transferred to non-adequate jurisdictions, we rely on appropriate legal safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- International Data Transfer Agreements (IDTAs) approved by the UK Information Commissioner's Office (ICO);
- Direct Contractual Necessity (Art. 49(1)(b) GDPR) for executing international travel arrangements.
6. DATA RETENTION & SECURITY
- Security Safeguards: We employ end-to-end SSL/TLS encryption for data in transit, strict access control mechanisms, regular security audits, and PCI-DSS compliant payment routing.
- Retention Periods: Personal data is retained only as long as necessary to fulfill the purposes outlined in this policy. Booking and tax-related financial records are retained for 7 years to satisfy statutory UK/EU accounting requirements. Account data is deleted or anonymized upon account closure, subject to dispute resolution holds.
7. YOUR DATA PROTECTION RIGHTS
Under applicable UK and EU data protection laws, you possess the following rights regarding your personal data:
- Right of Access: Request copies of your personal data held by us.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data when it is no longer necessary for processing, subject to statutory retention limits.
- Right to Restrict or Object: Object to processing based on legitimate interests or direct marketing.
- Right to Data Portability: Request transfer of your data in a structured, machine-readable format.
- Right to Lodge a Complaint: File a complaint with a supervisory authority, such as the UK Information Commissioner’s Office (ICO) or the relevant European Data Protection Authority (DPA).
To exercise any of these rights, please contact info@actiontrails.com.