Privacy Policy

01 Introduction

Northern Chalk Travel Co. ("we", "our", "us") is committed to protecting and respecting your privacy. This policy explains what personal data we collect from you, how we use it, and the rights you have regarding your information.

This policy applies to all users of our website, our customer service channels, and anyone who interacts with us in connection with our travel services. By using our services, you acknowledge that you have read and understood this policy.

02 Data We Collect

We collect personal data only where it is necessary to provide our services or meet a legal obligation. The types of data we may collect include:

• Identity Data: full name, title, date of birth, gender, and passport information (required for bookings).
• Contact Data: email address, telephone number, and postal address.
• Financial Data: payment card details and billing address, processed securely through our payment provider.
• Booking Data: travel preferences, special requirements (dietary, accessibility), itinerary details, and booking history.
• Technical Data: IP address, browser type and version, time zone, browser plug-in types, operating system, and platform.
• Usage Data: information about how you use our website, products, and services.
• Marketing Data: your preferences in receiving marketing from us and your communication preferences.

We do not collect any special categories of personal data (such as health information) unless you voluntarily provide it for specific accommodation or accessibility requirements.

03 How We Use Your Data

We use your personal data for the following purposes, each supported by a lawful basis under UK GDPR:

• Processing bookings and payments — necessary for the performance of a contract with you.
• Providing customer support — legitimate interests in operating our business efficiently.
• Communicating service updates — contract performance, including sending confirmations, changes, and travel documentation.
• Personalising your experience — legitimate interests in providing a tailored service.
• Sending marketing communications — with your explicit consent; you may withdraw consent at any time.
• Analysing website usage — legitimate interests in improving our website and services.
• Complying with legal obligations — legal compliance, including tax, financial, and data protection law.

04 Sharing Your Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your data in the following limited circumstances:

• Service Providers: travel suppliers (hotels, airlines, tour operators) to whom we must pass your details to complete your booking.
• Payment Processors: secure third-party services who process payment transactions on our behalf.
• Technology Partners: IT systems, website analytics providers, and email service providers acting as data processors under strict contractual obligations.
• Legal Authorities: where required to do so by law, court order, or governmental authority.

05 Cookies & Tracking

Our website uses cookies and similar tracking technologies to distinguish you from other users, improve your experience, and analyse how our website is used. You can control cookie preferences via our cookie banner when you first visit the site.

• Strictly Necessary Cookies: essential for the website to function correctly. These cannot be disabled.
• Analytics Cookies: help us understand how visitors interact with the site (e.g. Google Analytics). These are set only with your consent.
• Marketing Cookies: used to deliver relevant advertising. Set only with your explicit consent.
• Preference Cookies: remember your choices such as language or region to personalise your visit.

You may refuse or withdraw consent to non-essential cookies at any time by adjusting your browser settings or revisiting our cookie preferences tool.

06 Data Security

We have implemented appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include SSL/TLS encryption for data in transit, access controls, secure server environments, and regular security assessments.

While we take every precaution, no transmission of data over the internet is entirely secure. We cannot guarantee the security of data you transmit to us, although we will do our utmost to protect it once received.

07 Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: to receive a copy of the personal data we hold about you.
• Right to Rectification: to have inaccurate data corrected or incomplete data completed.
• Right to Erasure: to request deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to Restriction: to request we restrict processing of your data in certain circumstances.
• Right to Data Portability: to receive your data in a structured, commonly used, machine-readable format.
• Right to Object: to object to processing of your data where we rely on legitimate interests or for direct marketing.
• Rights related to automated decision-making: to not be subject to a decision based solely on automated processing, where it produces significant effects concerning you.

To exercise any of these rights, please contact our Data Protection Officer at dpo@northernchalk.com. We will respond to all legitimate requests within one month. You also have the right to lodge a complaint with the ICO at ico.org.uk.

08 Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes we collected it for, including legal, accounting, or reporting requirements. Generally:

• Booking records are retained for 7 years following your travel date for financial and legal compliance.
• Customer support records are retained for 3 years from your last interaction.
• Marketing preferences are retained until you withdraw consent or request deletion.
• Website analytics data is retained for 26 months in aggregated, anonymised form.

09 Third-Party Links

Our website may contain links to external websites, including travel suppliers, review platforms, and social media pages. We have no responsibility for the privacy practices or content of these sites. We encourage you to read the privacy policy of every website you visit.

10 Children's Privacy

Our services are directed at adults. We do not knowingly collect personal data from children under the age of 16 without verified parental or guardian consent. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take prompt action to delete it.

11 Policy Changes

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. We will notify you of any material changes by posting the revised policy on this page with an updated effective date. Where changes are significant, we may also notify you by email. We encourage you to review this policy periodically.

12 Contact Us

If you have questions, concerns, or requests regarding this privacy policy or our data practices, please contact us: