Privacy Policy

Introduction

This privacy policy explains how Witty-atoll collects, uses, stores, and protects personal information provided by visitors and customers of our urban tour services. We are committed to protecting your privacy and handling your data responsibly in accordance with applicable United Kingdom data protection regulations.

Information We Collect

Information You Provide Directly

When you book a tour or contact us, we collect:

• Full name
• Email address
• Booking preferences and dates
• Number of participants
• Any special requirements or accessibility needs you share
• Payment information processed through secure third-party payment processors

Information Collected Automatically

When you visit our website, we may automatically collect:

• Browser type and version
• Operating system
• IP address
• Pages visited and time spent on pages
• Referring website addresses

How We Use Your Information

We use collected information for the following purposes:

• Processing and confirming tour bookings
• Communicating with you about your booking, including meeting locations and schedule changes
• Responding to inquiries and providing customer support
• Improving our services and website functionality
• Sending relevant information about tour updates or changes that may affect your booking
• Complying with legal obligations

We do not use your information for unsolicited marketing purposes without your explicit consent.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contract Performance: Processing necessary to fulfill our service agreement with you
• Legitimate Interests: Operating and improving our business while protecting customer interests
• Legal Obligation: Compliance with applicable laws and regulations
• Consent: Where explicitly provided for specific purposes

Data Retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy:

• Booking information is retained for seven years to comply with financial record-keeping requirements
• General inquiry information is deleted within two years of last contact
• Website analytics data is retained in aggregated, anonymized form indefinitely

Data Sharing and Disclosure

We do not sell or rent personal information to third parties. We may share information only in the following circumstances:

• Service Providers: With trusted partners who assist in operating our business, such as payment processors, email service providers, or booking management systems
• Legal Requirements: When required by law, court order, or government regulation
• Business Transfers: In the event of a merger, acquisition, or sale of assets, with advance notice to affected individuals

All third-party service providers are contractually obligated to maintain data confidentiality and security.

Data Security

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission using SSL/TLS protocols
• Secure server infrastructure with regular security updates
• Access controls limiting employee access to personal data
• Regular security assessments and monitoring

Despite our efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but commit to promptly addressing any identified vulnerabilities.

Your Rights

Under UK data protection law, you have the following rights:

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Erasure: Request deletion of your personal data in certain circumstances
• Restriction: Request limitation of processing in specific situations
• Portability: Receive your data in a structured, commonly used format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw previously given consent at any time

To exercise these rights, contact us at [email protected]. We will respond within one month of receiving a valid request.

Cookies and Tracking Technologies

Our website uses cookies to enhance user experience and analyze site usage. For detailed information about cookies we use and how to manage them, please refer to our Cookies Policy.

International Data Transfers

Personal data is primarily stored and processed within the United Kingdom. If data is transferred internationally, we ensure appropriate safeguards are in place, including adequacy decisions or standard contractual clauses approved by relevant authorities.

Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

Changes to This Policy

We may update this privacy policy periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated through website notice or direct email to active customers. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact Information

For questions, concerns, or requests regarding this privacy policy or our data practices, contact:

Witty-atoll
45 Camden Passage
London, N1 8EA
United Kingdom
Email: [email protected]

Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters.