Privacy Policy

1. Who we are

Highwayman Tours is a York-based business offering private driven tours. For the purposes of data protection law, Highwayman Tours is the data controller of the personal information you provide to us.

2. What personal data we may collect

We may collect and process the following categories of personal data:

• Name
• Email address
• Phone number
• Booking details and tour preferences
• Messages sent by website form, email, WhatsApp, social media or phone
• Payment-related information where relevant
• Technical website data such as IP address, browser type and pages visited

3. How we collect your data

We may collect your personal data when you:

• contact us through the website
• email, call or message us
• make a booking or booking enquiry
• interact with our website
• engage with us through social media or third-party platforms

4. How we use your data

We use personal data to:

• respond to enquiries
• arrange and manage bookings
• provide private driven tours and customer support
• process payments where applicable
• keep records of bookings and customer communications
• improve our website, services and customer experience
• meet legal, tax or regulatory obligations
• send marketing communications where permitted by law

5. Lawful bases for processing

Depending on the circumstances, we process personal data on the basis of contract, legitimate interests, legal obligation, or consent where consent is required.

6. Sharing your personal data

We do not sell your personal data. We may share information with trusted third parties where necessary to operate our business, such as website hosting providers, booking systems, payment providers, analytics providers, or professional advisers.

7. Payments

Where payments are processed through third-party providers, your payment information may be handled in accordance with their own privacy policies and terms. We do not store full card details unless this is done through a secure system specifically designed for that purpose.

8. Cookies and website tracking

Our website may use cookies and similar technologies to help the site function properly, analyse traffic and improve user experience. Where required, we will request consent before using non-essential cookies.

9. Marketing communications

We may send marketing communications where you have asked to receive them or where we are otherwise allowed to do so by law. You can opt out at any time by contacting us directly.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, tax, complaint-handling and record-keeping requirements.

11. Data security

We take appropriate technical and organisational measures to protect personal data from unauthorised access, misuse, loss, alteration or disclosure.

12. Your rights

Under applicable data protection law, you may have rights including the right to access, correct, erase, restrict or object to certain processing of your personal data, and the right to lodge a complaint with the Information Commissioner’s Office.

13. Third-party links

Our website may include links to third-party websites or services. Those websites have their own privacy policies and we are not responsible for their content or privacy practices.

14. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with the latest revision date.