Abbey CreedWestminster · Tours of London · Est. 2014Privacy Policy
How we collect, use, and protect your personal data, in accordance with the UK GDPR and the Data Protection Act 2018.
1. Data Controller
The data controller for this site and our services is:
Abbey Creed Tours Ltd
42 Vincent Square, London SW1P 2NB, United Kingdom
Email: bookings@abbey-creed.com
Telephone: +44 20 7802 4391
We are not currently required to register with the Information Commissioner's Office (ICO) under the data-protection fee regulations because we operate as a small business processing limited categories of personal data; we will register and update this policy if our processing changes such that registration becomes required.
2. Categories of Personal Data We Collect
2.1 From walkers and enquirers: name, email address, telephone number, postal address (for invoicing), preferred tour and date, group size, accessibility requirements you choose to disclose, and the content of any messages you send us.
2.2 From payments: card-payment details are processed directly by Stripe Payments UK, Limited; we do not see or store full card numbers. We retain only a transaction reference, the amount, and the masked last four digits.
2.3 From our website: if you accept analytics cookies, anonymised usage data such as pages viewed, approximate region (city-level), browser type, and time spent on each page.
2.4 Photographs from walks: only where you have given written consent. We do not photograph minors. See §7 below.
2.5 We do not collect special category data (health, religious belief, etc.) unless you choose to disclose it (for example, an accessibility requirement). Where you do, we treat such data with additional care and rely on your explicit consent as our lawful basis.
3. Purposes of Processing & Lawful Bases
| Purpose | Categories of data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Reply to your enquiry, manage your booking, deliver your walk | Name, contact details, booking details | Contract (Art. 6(1)(b)) |
| Process payments & keep accounting records | Transaction reference, amount, name, address | Legal obligation (Art. 6(1)(c)) |
| Send the pre-walk reading list and joining instructions | Email, walk booked | Contract (Art. 6(1)(b)) |
| Send occasional newsletters about new walks | Email, name | Consent (Art. 6(1)(a)) — opt-in only |
| Use anonymised analytics to improve the website | IP-derived city, page paths, dwell time | Consent (Art. 6(1)(a)) — via cookie banner |
| Publish photographs of walkers in our gallery | Photograph, first name, walk taken | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
4. Sharing With Third Parties
We share personal data only with the following processors, each bound by data-processing agreements that meet UK GDPR Art. 28 requirements:
- Stripe Payments UK, Limited — payment processing.
- Fastmail Pty Ltd — email hosting (the bookings@ inbox).
- Hetzner Online GmbH — website hosting (servers in Falkenstein, Germany).
- Plausible Insights OÜ — cookieless website analytics (Estonia).
We do not sell, rent or trade personal data. We do not engage in profiling or automated decision-making.
5. International Data Transfers
The processors above are located in the United Kingdom, the European Economic Area, or jurisdictions covered by a UK adequacy regulation. Where any transfer falls outside an adequacy regulation, we rely on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum.
6. Retention Periods
- Booking records (name, email, walk taken): retained for 6 years from the end of the financial year of the booking, to meet HMRC record-keeping requirements.
- Enquiry messages where no booking results: retained for 12 months, then deleted.
- Newsletter subscribers: retained until you unsubscribe; quarterly re-confirmation if you have not opened any of our emails for 24 months.
- Analytics data: anonymised at collection; retained for up to 14 months in aggregated form.
- Photographs of walkers: retained until you withdraw consent; we will remove a photograph within 30 days of receiving your request.
7. Photography & Image Rights
We photograph walks only with the explicit, written consent of those pictured. Consent is captured on a paper form before the walk begins and may be withdrawn at any time by writing to us. We do not photograph minors. We do not use stock imagery on this site.
8. Your Rights Under UK GDPR
You have the following rights in respect of your personal data:
- Right of access — ask for a copy of the personal data we hold about you.
- Right to rectification — correct any inaccurate personal data.
- Right to erasure (“right to be forgotten”) — ask us to delete your personal data, subject to our retention obligations under tax law.
- Right to restrict processing — ask us to pause processing while we resolve a query.
- Right to data portability — receive your personal data in a structured, commonly used format.
- Right to object — object to processing based on legitimate interests, or to direct marketing.
- Right to withdraw consent — withdraw consent at any time where consent is the lawful basis (newsletters, analytics, photography).
To exercise any of these rights, write to bookings@abbey-creed.com. We will respond within one calendar month, free of charge in almost all cases.
9. Complaints to the ICO
If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
We would, however, appreciate the chance to address your concern first — please write to us before contacting the ICO.
10. Children's Data
Our published walks are not marketed to children. We do not knowingly collect personal data from anyone under 13. Where a parent or guardian books a walk that includes a child, we collect only the information necessary to deliver that walk safely and we do not retain it after the walk except as required for accounting purposes.
11. Security
We take reasonable technical and organisational measures to protect personal data: encrypted email-in-transit (TLS), hashed website backups, access on a need-to-know basis among the four guides, and an annual review of our processors' security postures. The website is served over HTTPS only.
12. Changes to This Policy
We may update this policy from time to time. The version number and Last Updated date above will reflect any change. Material changes will be notified to active enquirers and walkers by email.
13. Contact
For any privacy question or to exercise your rights, write to bookings@abbey-creed.com, marking your message “Privacy”, or post to Abbey Creed Tours Ltd, 42 Vincent Square, London SW1P 2NB, United Kingdom.
See also our Terms of Use and Cookie Policy.