Privacy Policy & Data Security

1. Who we are

Who is responsible for your information?

Northern Secrets Ltd is the data controller responsible for the personal information described in this policy.

Northern Secrets Ltd
Clavering House, Clavering Place
Newcastle upon Tyne, NE1 3NG
United Kingdom

Email: info@northernsecrets.co.uk

Northern Secrets Ltd is registered with the Information Commissioner’s Office (ICO), registration reference ZA835602.

2. Information we collect

The information we may hold about you

Depending on how you interact with us, we may collect information including:

• your name and contact details;
• address and country of residence;
• travel dates and itinerary preferences;
• details of other people included in your booking;
• accommodation and transport requirements;
• dietary, accessibility or other requirements you choose to provide;
• correspondence and enquiries;
• payment and transaction information;
• website and cookie information; and
• marketing preferences.

For ancestry journeys, there is potentially another category we should explicitly cover: family-history and genealogical information provided to Northern Secrets or Ancestry Concierge. I would add that because your privacy policy should reflect what the business actually does.

3. Why we use your information

How and why we use your information

We use personal information where necessary to:

Plan and deliver your journey
To prepare proposals, make reservations, manage bookings and provide the travel arrangements you have requested.

Communicate with you
To respond to enquiries, provide booking information and keep you informed before, during and after your journey.

Work with our suppliers
To provide hotels, guides, transport providers, attractions and other partners with the information reasonably necessary to deliver your arrangements.

Operate our business
For accounting, administration, record keeping, security and compliance with our legal obligations.

Marketing
Where you have given consent, or where otherwise permitted by law, we may send relevant news and travel inspiration. You can unsubscribe at any time.

This section should also state the applicable lawful bases — contract, legitimate interests, consent and legal obligation as appropriate.

4. Sensitive information

Pre-header
When additional information is needed

Special category personal data

Some journeys may require information concerning dietary requirements, accessibility or health-related needs. We only request this information where it is relevant to your arrangements and handle it with additional care.

Where necessary, we may share relevant information with a supplier involved in delivering your journey, for example an accommodation provider dealing with a dietary requirement.

This is one area where I’d improve the old policy considerably. Saying sensitive information is “never passed on” except when necessary is contradictory. Better to explain transparently when and why it may need to be shared.

5. Who we share information with

Trusted partners and service providers

To arrange and operate your journey, we may need to share relevant personal information with organisations such as:

• accommodation providers;
• transport companies and drivers;
• professional guides and tour managers;
• attractions and experience providers;
• booking and itinerary technology providers;
• payment processors;
• professional advisers and administrative service providers.

We only provide information reasonably required for the relevant purpose.

Then separately mention your principal systems where appropriate — Stripe, Travefy and your email/marketing systems, for example.

I wouldn’t turn this into a giant vendor directory unless legally necessary.

6. Payments & data security

Pre-header
Protecting your information

Data security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration or disclosure.

Payments made online are processed through specialist payment providers. Northern Secrets does not retain complete payment-card details where payments are handled directly by our payment processor.

Our website uses encrypted connections, and access to business systems containing personal information is restricted appropriately.

One correction from the old policy: I would remove references to “168-bit encryption” and “the latest security”. Both are unnecessary and potentially become inaccurate as technology changes.

7. International transfers

This is important for Northern Secrets because you have international travellers and technology providers.

Information outside the UK

Some service providers or travel suppliers may process personal information outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, appropriate measures are used.

For an actual travel booking, information may also need to be provided to suppliers in the country in which the relevant travel service is being provided.

8. How long we keep information

Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including fulfilling bookings and meeting accounting, tax, legal and regulatory requirements.

Different categories of information may therefore be retained for different periods.

I’d avoid giving arbitrary retention periods unless you’ve established an actual internal retention schedule.

9. Your rights

Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to:

• access personal information we hold about you;
• correct inaccurate information;
• request deletion of information;
• restrict or object to certain processing;
• request transfer of certain information;
• withdraw consent where processing relies on consent; and
• complain to the Information Commissioner’s Office.

To exercise your rights, contact info@northernsecrets.co.uk.

10. Cookies

Cookies & website analytics

Our website uses cookies and similar technologies for essential website functions and, where permitted, analytics and other purposes.

Read our Cookie Policy →

Where non-essential cookies require consent, they should not be placed until the visitor has made the appropriate choice through your cookie-consent system.

11. Marketing

Keeping in touch

If you choose to receive marketing communications from Northern Secrets, we may use your contact details to send travel inspiration, news and relevant updates.

You can change your preferences or unsubscribe at any time using the link provided in our marketing emails or by contacting us.

12. Questions or concerns

Pre-header
We’re here to help

Questions about your information?

If you have questions about this policy, the information we hold about you or how your personal information is used, please contact:

Northern Secrets Ltd
Email: info@northernsecrets.co.uk

You also have the right to raise a concern with the Information Commissioner’s Office (ICO).