Legal
Privacy Policy
Last updated — 7 September 2026
This page explains what we ask for, why we ask for it, and what happens to it afterwards. If anything here is unclear, write to us and we will answer plainly.
01
Who we are
Onward is operated by [Registered company name], registered at [registered address, country]. We are the data controller for everything described on this page. Questions go to [privacy@yourdomain.com].
01
Who we are
Onward is operated by [Registered company name], registered at [registered address, country]. We are the data controller for everything described on this page. Questions go to [privacy@yourdomain.com].
02
What we collect
When you enquire: your name, your email address, the dates you have in mind and whatever you choose to put in the message field. When you book: what we need to run the journey — emergency contact, dietary needs, relevant medical information, and passport details where a permit requires them. When you visit: standard server logs, and analytics only if you accept them.
02
What we collect
When you enquire: your name, your email address, the dates you have in mind and whatever you choose to put in the message field. When you book: what we need to run the journey — emergency contact, dietary needs, relevant medical information, and passport details where a permit requires them. When you visit: standard server logs, and analytics only if you accept them.
03
Why we hold it
To answer your enquiry. To plan and run the journey you booked. To meet the accounting and insurance obligations that come with selling travel. We do not build profiles and we do not use your information to advertise to you.
03
Why we hold it
To answer your enquiry. To plan and run the journey you booked. To meet the accounting and insurance obligations that come with selling travel. We do not build profiles and we do not use your information to advertise to you.
04
Who else sees it
The guide leading your journey. Local partners — lodges, drivers, permit offices — who need a name and a date to do their job. Our payment processor, [Stripe], which handles card details directly, so we never see or store them. Our email and analytics providers. Nobody else. We do not sell your information.
04
Who else sees it
The guide leading your journey. Local partners — lodges, drivers, permit offices — who need a name and a date to do their job. Our payment processor, [Stripe], which handles card details directly, so we never see or store them. Our email and analytics providers. Nobody else. We do not sell your information.
05
How long we keep it
Enquiries that do not become bookings: [24 months]. Booking records: [seven years], because tax law says so. Medical and dietary notes: deleted [90 days] after the journey ends. Ask us to delete anything sooner and we will, unless the law requires us to keep it.
05
How long we keep it
Enquiries that do not become bookings: [24 months]. Booking records: [seven years], because tax law says so. Medical and dietary notes: deleted [90 days] after the journey ends. Ask us to delete anything sooner and we will, unless the law requires us to keep it.
06
Cookies
The site sets the cookies it needs to work. Analytics cookies run only if you accept them, and you can change your mind at any time from [the cookie settings link]. We use no advertising cookies.
06
Cookies
The site sets the cookies it needs to work. Analytics cookies run only if you accept them, and you can change your mind at any time from [the cookie settings link]. We use no advertising cookies.
07
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to send it elsewhere, or object to how we use it. Write to [privacy@yourdomain.com] and we answer within [30 days]. If our answer does not satisfy you, you can complain to [your national data protection authority].
07
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to send it elsewhere, or object to how we use it. Write to [privacy@yourdomain.com] and we answer within [30 days]. If our answer does not satisfy you, you can complain to [your national data protection authority].
08
Where it travels
Running a journey abroad means giving a name and a date to partners in the destination country, which may sit outside [your jurisdiction]. Where that happens we rely on [standard contractual clauses] and share the minimum required to get you there.
08
Where it travels
Running a journey abroad means giving a name and a date to partners in the destination country, which may sit outside [your jurisdiction]. Where that happens we rely on [standard contractual clauses] and share the minimum required to get you there.
09
Keeping it safe
Information sits on [access-controlled systems] and is encrypted in transit. Only the people running your journey can reach it. No system is perfect. If something goes wrong we tell you and the relevant authority within [72 hours].
09
Keeping it safe
Information sits on [access-controlled systems] and is encrypted in transit. Only the people running your journey can reach it. No system is perfect. If something goes wrong we tell you and the relevant authority within [72 hours].
10
Changes to this page
When this policy changes we update the date at the top. If the change is material, we email everyone holding a live booking.
10
Changes to this page
When this policy changes we update the date at the top. If the change is material, we email everyone holding a live booking.
This template ships with a policy structure, not legal advice. Replace the bracketed details with your own and have a qualified adviser read it before you publish.