City Tours UK Ltd, a registered company in England and Wales (company no. 11678982) with its registered office at 20-22 Wenlock Road, London, N1 7GU (referred to as "we", "us" or "our" in this Privacy Policy), is committed to protecting your privacy and personal data. This Privacy Policy explains how we handle your personal data when you visit our website or provide us with personal data through other means. We also provide a Glossary at the end of this Policy to help you understand any unfamiliar terminology.
IMPORTANT INFORMATION AND WHO WE ARE
The aim of this Privacy Policy is to provide you with details about how your personal data is collected and processed by City Tours UK. This includes any data that you may provide to us through this website or other means, such as over the phone, when you purchase travel services, sign up for our mailing list, take part in a competition or loyalty scheme, etc.
Please note that our website is not designed for children, and we will only collect data related to children if you book travel services that include children.
It is important to read this Privacy Policy in conjunction with any other privacy notice or fair processing notice that we may provide when we collect or process personal data about you, so you fully understand how and why we are using your data. This Privacy Policy does not supersede any other notices.
City Tours UK is the data controller for your personal data and is responsible for handling it in accordance with this Privacy Policy. We have a data privacy manager who can answer any questions you may have about this policy.
If you have any questions or would like to exercise your legal rights, please contact the data privacy manager using the details below.
Contact Details:
Full name of legal entity: City Tours UK
Email address: info@citytoursuk.com
Postal address: 20-22 Wenlock Road, London, N1 7GU
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk). We would, however, appreciate the opportunity to address your concerns before you approach the ICO.
We regularly review and update this Privacy Policy, with the current version last updated in March 2023. If you require previous versions, please contact us. It is essential that the personal data we hold about you is accurate and up-to-date, so please inform us of any changes to your details during your relationship with us.
Please be aware that our website may contain links to third-party websites, plug-ins, and applications, which may collect or share data about you. We have no control over these third-party sites and are not responsible for their privacy policies. If you leave our website, please read the privacy notice of any site you visit.
DATA WE COLLECT ABOUT YOU
Personal data, also known as personal information, refers to any information that can identify an individual. Anonymous data, on the other hand, does not include any information that can identify a person. City Tours UK may collect, use, store and transfer various types of personal data about you, which we have categorized as follows:
Identity Data
This category includes information specifically related to your identity, such as your first name, last name, username or similar identifier, marital status, title, date of birth and gender.
Contact Data
This category includes information related to how you may be contacted, such as your billing address, delivery address, email address and telephone numbers.
Financial Data
This category includes information related to your means and methods of payment, such as your bank account and payment card details.
Transaction Data
This category includes information related to the transactions you have carried out with City Tours UK, such as details about payments to and from you, and other details of products and services you have purchased from us.
Technical Data
This category includes more technical data that we may obtain when you make use of our website, such as your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
Profile Data
This category includes the data that we receive when you create a profile on our website and make use of that profile, such as your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
Usage Data
This category includes information about how you use our website, products, and services.
Marketing and Communications Data
This category includes your preferences in relation to whether or not you want to receive marketing from City Tours UK and our third parties, and also your communication preferences.
We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we will treat the combined data as personal data, which will be used in accordance with this Privacy Policy.
Special Categories of Personal Data
City Tours UK may collect the following special categories of personal data about you. Details about your:
dietary requirements which may disclose your religious or philosophical beliefs;
health; sex life and/or your sexual orientation; genetic and biometric data.
We collect and process the above data only where it is strictly necessary to do so in order to deliver the travel service that you have purchased. Furthermore, we will only collect and process the above special categories of sensitive personal data where you have provided us with your explicit consent to do so.
You are not under any obligation to consent to us processing your sensitive personal data. However, without your consent, we won’t be able to make the necessary arrangements to provide the travel services that you have booked or are attempting to book. As a result, if you do not provide your consent, we will be unable to proceed with your booking.
If you are happy to consent to our use of your sensitive personal data, you will also be able to withdraw your consent at any time. However, as this will prevent us from providing the travel service you have booked, we will be required to treat any withdrawal of consent as a cancellation of your booking and the cancellation charges referred to in clause of our Booking Terms and Conditions will become payable.
If you do not provide us with the personal data we need in order to provide you with your desired travel services, we may not be able to fulfill our contractual obligations with you. This means that we may not be able to process your booking or may have to cancel your booking, and this will be treated as a "cancellation by you" according to our Booking Terms and Conditions. We will inform you if we are unable to process or cancel a booking due to lack of personal data.
How your data is collected
We collect your personal data in various ways, including:
- Direct interactions: You may provide us with your personal data by filling out forms, corresponding with us, making bookings, subscribing to newsletters, entering competitions, or giving feedback.
- Automated technologies: We may automatically collect Technical Data about your equipment and browsing actions when you interact with our website.
- Third parties: We may receive personal data from various third parties, including analytics providers, advertising networks, search information providers, and providers of technical, payment, and delivery services.
Please note that when you share information on social networks like Facebook and Twitter while using our website, your personal information may be visible to other users. You are responsible for setting appropriate privacy settings on your social network accounts. This is not the responsibility of City Tours UK.
How we use your data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
Where we need to perform the contract we are about to enter into or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.
Generally we do not rely on consent as a legal basis for processing your personal data other than in relation to sending direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.
We respect your choices in how we use your personal data for marketing and advertising. If you've requested information or purchased services from City Tours UK Marketing, you may receive marketing communications from us, but only if you've opted in to receive them. We may use your personal data to determine what products, services, and offers may interest you, but we'll always ask for your express opt-in consent before sharing your personal data with any third parties for marketing purposes. You can opt out of receiving marketing messages at any time, but please note that this won't apply to personal data provided to us as a result of a service purchase or other transactions. We may monitor and record communications with you for various purposes, and you can adjust your cookie settings to control how websites access cookies. We'll only use your personal data for the purposes for which we collected it, unless we have a good reason to use it for another purpose and that purpose is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we'll let you know and explain why we need to do so. Please be aware that we may process your personal data without your knowledge or consent in compliance with the law.
Disclosure of your personal data
Your personal data may be shared with the following parties:
- Internal Third Parties
- External Third Parties
- Third parties to whom we may sell, transfer, or merge parts of our business or assets, or with whom we may seek to acquire or merge.
We require all third parties to treat your personal data in accordance with the law and to respect its security. We only permit third-party service providers to process your personal data for specific purposes and in accordance with our instructions, and we do not allow them to use your data for their own purposes.
Data security
To keep your personal data secure, we have implemented suitable security measures to prevent unauthorized access, alteration, disclosure, or accidental loss. Only authorized personnel, including employees, agents, and contractors, will have access to your personal data, and they are obligated to process it according to our instructions and confidentiality requirements.
We have established protocols to manage any suspected personal data breaches, and we will inform you and relevant authorities of any breaches as required by law.
How long is your personal data stored
We will keep your personal data only for as long as necessary to fulfil the purposes we collected it for. This includes legal, regulatory, tax, accounting or reporting requirements. If there is a complaint or prospect of litigation related to our relationship with you, we may retain your personal data for a longer period. Additionally, if you opt-in and consent to our loyalty scheme, we may retain your personal data to offer future travel discounts.
We consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve those purposes through other means, when determining the appropriate retention period.
By law, we must keep basic customer information (including Contact, Identity, Financial and Transaction Data) for 7 years after they cease being customers for tax purposes.
You may request the deletion of your data in certain circumstances. We may also anonymise your personal data for research or statistical purposes, in which case we may use it indefinitely without further notice to you.
What are my legal right?
You have certain rights under data protection laws related to your personal data. These include the right to access, correct, delete, object to processing, restrict processing, transfer your data, and withdraw consent. You can exercise these rights by contacting us, and we will not charge you a fee unless your request is unfounded, repetitive, or excessive. To protect your data, we may need to verify your identity before fulfilling your request, and we will respond within one month, except for complex or multiple requests. We will keep you informed in such cases.
City Tours UK lawfully processes personal data based on Legitimate Interest, Performance of Contract, and Complying with a Legal or Regulatory Obligation. Personal data is processed to provide unique travel services with external third parties located globally, including EEA, Americas, Africa, Australia, and Asia. These third parties include suppliers of travel services, service providers for IT and system administration, and professional advisers like lawyers, bankers, auditors, and insurers. HM Revenue & Customs, regulators, and other authorities in the UK may also act as processors or joint controllers. You have the right to access, correct, and request the erasure of your personal data. You may also object to processing or request restriction of processing or transfer of your personal data. You can withdraw your consent at any time, but this will not affect any lawful processing already carried out.