The SHAC Privacy Notice

Version date: October 2026

The Surrey Hills Adventure Company Limited (“The SHAC”, “we”, “us” or “our”) respects your privacy. This notice explains how we collect, use, store and protect personal information when you visit our website, make a booking, attend one of our activitie
s, contact us or interact with us online.

We aim to handle your information carefully, transparently and only when we have a lawful reason to do so.

1. Who we are

The data controller responsible for your personal data is:

The Surrey Hills Adventure Company Limited
Company number: 09049780
Registered office: Buckland Park Lake, Park Lake Drive, Buckland, Betchworth, Surrey RH3 7FE
VAT number: 307 1184 32
Email: info@theshac.co.uk
Website: www.theshac.co.uk

The SHAC is registered, or is required to be registered, with the Information Commissioner’s Office (“ICO”) as a data controller.

If you have any questions about this notice, how we use your information or your data-protection rights, please contact us at info@theshac.co.uk.

Our website is moving from WordPress to Squarespace. This notice applies to our website, booking arrangements and activities regardless of which website platform or booking system is being used.

2. The personal information we collect

Depending on how you interact with us, we may collect the following information.

Identity and contact information

This may include:

  • your name;

  • postal address;

  • email address;

  • telephone number;

  • date of birth or age;

  • account or customer reference details; and

  • information needed to identify you when responding to a request.

Booking and attendance information

This may include:

  • the activity, session or event booked;

  • booking date and time;

  • attendance and participation records;

  • membership, voucher or account information;

  • the names and details of other people in your booking party;

  • cancellation, refund and rescheduling information; and

  • information about your requirements or preferences.

Children and dependants

Where a child or dependant attends an activity, we may collect:

  • their name;

  • age and date of birth;

  • parent or guardian details;

  • swimming ability and activity experience;

  • medical, accessibility and safeguarding information; and

  • emergency contact information.

A parent or guardian must make a booking for a child or dependant and must provide accurate information.

Health, medical and accessibility information

Where necessary to deliver an activity safely, we may collect information such as:

  • medical conditions;

  • allergies;

  • medication or relevant treatment;

  • injuries or physical limitations;

  • accessibility requirements;

  • pregnancy-related information; and

  • information about swimming ability or other safety requirements.

This is special category data under UK data-protection law. Further information is provided in section 5.

Emergency information

We may collect:

  • the name and contact details of an emergency contact;

  • relevant information needed to respond to an incident; and

  • information supplied by you or someone acting on your behalf during an emergency.

Payment information

Payments are generally processed by our payment provider or booking platform.

We do not normally see or store complete payment-card details. Card payments made online are handled through the relevant payment provider in accordance with applicable security and PCI-DSS requirements.

Where card details are taken by telephone, they are used for the immediate transaction and destroyed afterwards. We do not retain full card details.

Correspondence and complaints

We may keep records of:

  • emails, letters and messages;

  • telephone conversations;

  • enquiries and requests;

  • complaints and their resolution;

  • feedback and reviews; and

  • information needed to respond to legal, insurance or safeguarding matters.

Photographs and video

We may take photographs or video at our site and during activities. Identifiable photographs or film used for publicity, marketing or social media will be handled in accordance with section 8.

Technical and website information

When you use our website, we may collect:

  • IP address;

  • browser and device type;

  • operating system;

  • approximate location derived from your IP address;

  • pages viewed and links followed;

  • website preferences;

  • cookie and similar technology information; and

  • information about how you interact with our website.

Non-essential analytics and similar technologies will only be used where you have given the required consent. Further information will be provided in our separate Cookie Policy.

3. How we use your information

We use personal information to:

  • take and manage bookings;

  • process payments, refunds, vouchers and rescheduling requests;

  • provide activities, events and wellbeing sessions;

  • manage customer accounts;

  • communicate booking confirmations, changes, safety information and operational updates;

  • check whether participants meet relevant age, swimming, health, accessibility and safety requirements;

  • respond to enquiries and complaints;

  • provide appropriate assistance and reasonable adjustments;

  • protect the health and safety of participants, staff and visitors;

  • manage accidents, incidents and near misses;

  • administer insurance matters and legal claims;

  • maintain business, financial and tax records;

  • improve our activities, customer service and website;

  • send newsletters and marketing where permitted;

  • monitor and improve website security and performance;

  • use CCTV where installed for safety, security and incident investigation;

  • take and use photographs or video where permission has been given;

  • comply with legal and regulatory obligations; and

  • establish, exercise or defend legal claims.

We do not sell personal data to third parties for their own marketing.

4. Our lawful bases for processing

We process personal data only where we have a lawful basis under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Health information, safety and safeguarding

Health and medical information is special category data. We only ask for information that is relevant to the activity or necessary to keep participants, staff and others safe.

For routine activity bookings, we will ask for separate and explicit consent before processing health information. A general acceptance of our booking Terms and Conditions is not, by itself, explicit consent to process health data.

We may need information about:

  • medical conditions;

  • allergies;

  • medication;

  • injuries;

  • accessibility needs;

  • pregnancy;

  • swimming ability; and

  • any other matter that may affect safe participation.

If you do not provide information that is necessary for us to assess whether an activity is safe, we may be unable to accept the booking or allow participation. This is a safety decision, not a penalty.

Health and medical information:

  • is kept separate from marketing information;

  • is accessible only to staff, instructors or first-aiders who need it for safety or emergency purposes;

  • is not used to send marketing;

  • is not sold or disclosed for unrelated purposes; and

  • is retained only for the periods described in section 10, unless an incident, complaint, insurance matter or legal claim requires longer retention.

In an emergency, we may share relevant information without waiting for consent where this is necessary to protect someone’s vital interests or comply with a legal or safeguarding obligation.

We will treat disclosures confidentially wherever possible. However, we cannot guarantee complete confidentiality where we are required to act to protect someone’s safety, protect another person or comply with the law.

6. Children and young people

Our activities may include open water swimming, stand-up paddleboarding (“SUP”), SUP Yoga, wellbeing sessions including floating sound baths, children’s outdoor activities and, subject to confirmation, Wet and Wild Days.

We no longer offer Woodlands Adventure Days.

Where a child or dependant attends:

  • the booking must be made by a parent or person with parental responsibility;

  • the responsible adult must provide accurate information about age, swimming ability, medical conditions and accessibility needs;

  • we collect only the information reasonably needed for booking, safety and safeguarding;

  • the responsible adult must ensure that the child meets the relevant activity requirements;

  • we may need written permission from a responsible adult before a child participates; and

  • we will seek written permission from a parent or guardian before using identifiable photographs or film of anyone under 16.

Children and young people may have their own data-protection rights. We will consider their age, understanding and circumstances when responding to a request.

We do not knowingly use children’s information for direct marketing without appropriate consent and safeguards.

7. Marketing communications

We may send information about activities, events, offers and news by email or other electronic means.

If you have not bought from us, we will only send electronic marketing where you have given valid consent or another lawful route under PECR applies.

If you have bought from us, we may send information about similar activities under the “soft opt-in” rules, provided that:

  • we obtained your details during a sale or negotiations for a sale;

  • the marketing relates to similar services;

  • you were given a clear opportunity to refuse marketing when your details were collected; and

  • every message gives you a simple way to unsubscribe.

You can unsubscribe at any time by:

We will keep a record of marketing preferences and withdrawals so that we can respect your choice.

8. Photographs, film and social media

We may sometimes take photographs or film at our site or during activities.

We will ask for permission before taking or using an identifiable photograph or film for publicity, marketing or social media. Permission is optional. Refusing permission will not affect your booking, attendance or access to our activities.

For anyone under 18, we will obtain written permission from a parent or guardian before using an identifiable image.

We will provide a simple way to opt out, including through:

  • booking confirmations;

  • notices at the venue; and

  • direct contact with our team.

You may withdraw permission for future use by emailing info@theshac.co.uk. Withdrawal will not normally require us to recall printed material or remove material already distributed, but we will stop using the image in future campaigns where reasonably practicable.

If you tag The SHAC or post publicly about us, we may be able to see or share that public post through the relevant social-media platform. This is subject to that platform’s own terms and privacy settings. You can ask us to stop sharing a post by emailing info@theshac.co.uk.

We will not claim ownership of your social-media content or require you to grant us an irrevocable, worldwide or transferable licence merely because you attend an activity.

9. Cookies and similar technologies

Our website uses cookies and similar technologies.

Strictly necessary cookies

These support core website functions, security, booking processes and cookie preferences. They do not usually require consent where they are strictly necessary for a service you have requested.

Optional cookies

Subject to your consent, we may use:

  • analytics cookies;

  • preference and functionality cookies;

  • performance cookies;

  • embedded-content cookies; and

  • other technologies used to understand website use or improve our services.

Non-essential cookies will not be set unless you have provided the required consent. You can change your preferences through our cookie settings or your browser.

Please read our separate Cookie Policy for details of the cookies used by our website, the booking platform and any analytics or embedded-content providers.

10. How long we keep information

We do not keep personal data indefinitely. We use the following retention periods unless a longer period is necessary because of an incident, complaint, insurance matter, legal claim, safeguarding issue or legal requirement.

We may retain information for longer if a legal claim is anticipated or ongoing, if an insurer requires it, or if we are required to do so by law.

When information is no longer needed, we will securely delete it or anonymise it.

11. Who we share information with

We may share relevant personal information with trusted service providers who help us operate our business. Where they process information on our behalf, we require appropriate written contractual protections.

These providers may include:

  • Squarespace, which hosts and supports our website;

  • [booking platform name to be inserted before publication], which manages reservations, customer accounts and booking information;

  • payment providers;

  • email, communications and customer-support providers;

  • cloud-storage, IT and security providers;

  • website analytics or cookie-management providers, where you have consented;

  • professional advisers and insurers;

  • instructors, first-aiders and staff who need information for safety or service delivery;

  • emergency services; and

  • venues, landowners or operational partners where relevant to delivering a booking safely.

We may also disclose information:

  • where required by law, court order or a regulator;

  • to prevent or investigate fraud, crime or misuse of our systems;

  • to protect the safety, rights or property of participants, staff or others;

  • in connection with the sale, restructuring or transfer of all or part of our business; or

  • where necessary to establish, exercise or defend legal claims.

We do not sell personal information to third parties for their own marketing.

12. International transfers

Some of our service providers, including website, booking, payment, email or technology providers, may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will use an appropriate lawful transfer mechanism. This may include:

  • a UK adequacy regulation;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to the EU Standard Contractual Clauses;

  • the provider’s certification under the UK Extension to the EU-US Data Privacy Framework, where applicable; or

  • another lawful safeguard recognised under UK data-protection law.

We will assess relevant transfers and the safeguards provided before they take place. Further information about a particular transfer can be requested from info@theshac.co.uk, subject to confidentiality and security considerations.

13. Security

We use appropriate technical and organisational measures to protect personal data from accidental loss, unauthorised access, alteration, disclosure or destruction.

These measures may include:

  • access controls and account permissions;

  • secure passwords and authentication;

  • encryption in transit where supported;

  • secure payment processing;

  • staff training and confidentiality requirements;

  • separating health information from marketing information;

  • secure deletion and disposal;

  • supplier due diligence; and

  • monitoring for suspicious activity.

No internet-based system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess the risk and take appropriate action. Where required by law, we will notify the ICO within 72 hours of becoming aware of a reportable breach and notify affected individuals without undue delay where there is a high risk to their rights and freedoms.

14. Telephone calls

Telephone calls may be recorded or monitored for training, quality-control, complaint-handling and dispute-resolution purposes.

We will tell you at the start of a call if it is being recorded. You may ask not to be recorded, and we will provide a reasonable alternative where possible.

Call recordings are retained only for the period described in section 10 unless a longer period is required for a complaint, safeguarding matter, insurance issue or legal claim.

15. Your rights

Depending on the circumstances, you have the following rights under UK data-protection law:

  • Access: to request a copy of the personal data we hold about you;

  • Rectification: to ask us to correct inaccurate or incomplete information;

  • Erasure: to ask us to delete your information where there is no good reason for us to continue processing it;

  • Restriction: to ask us to limit how we use your information in certain circumstances;

  • Objection: to object to processing based on legitimate interests, including direct marketing;

  • Portability: to receive certain information in a structured, commonly used and machine-readable format, or ask us to send it to another provider;

  • Withdrawal of consent: to withdraw consent where we rely on consent;

  • Marketing choices: to unsubscribe from marketing at any time; and

  • Rights relating to automated decision-making: to ask for safeguards where applicable.

We do not currently carry out automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

These rights are not absolute. For example, we may need to retain some information to comply with the law, establish or defend legal claims, protect health and safety, or keep accurate financial records.

To exercise a right, please email info@theshac.co.uk. We may need to verify your identity before responding.

We will normally respond within one month of receiving your request. If a request is complex or we receive several requests, we may extend this by up to a further two months. If we do so, we will tell you within the first month and explain why.

16. Complaints to the ICO

We hope you will contact us first so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office:

Website: www.ico.org.uk
Telephone: 0303 123 1113

The ICO is the UK supervisory authority for data-protection matters.

17. Links to other websites

Our website may contain links to third-party websites, booking services, social media platforms or other online services.

Those organisations operate their own privacy notices and terms. We are not responsible for their privacy practices. Please review their policies before providing personal information.

18. Changes to this notice

We may update this notice from time to time to reflect changes in our activities, website, booking platform, suppliers or legal obligations.

Material changes will be notified to customers where appropriate and posted on this page. The current version date appears at the top of this notice.

This latest dated version replaces the previous Privacy and Data Protection Policy. The previous version governed data collected and processing carried out before this version took effect, subject to any continuing legal obligations and the rights available under applicable data-protection law.