Last updated: 30th September 2026
This policy explains what personal information Alexander Adventures collects, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to our website, our booking system and our guest portal.
Who we are
Alexander Adventures Ltd is the data controller for the information described here. We are registered in England, company number 12302708, at 14a Murray Holdings, Hobson Industrial Estate, Front Street, Burnopfield, NE16 6EA.
We are registered with the Information Commissioner's Office, registration number ZB119617.
For anything to do with your information, email info@alexanderadventures.co.uk or call 0191 903 9936.
Where we get your information
Most of it comes from you, through our enquiry form, the booking process, your guest portal, email or the phone. Some comes from other people: a lead traveller who books on your behalf, a group organiser such as a school or a company, or a parent or guardian booking for someone under 18.
Where someone books for you, we contact you directly for your own medical and passport details, and we give you this policy at that point. We do this within a month of receiving your details, or sooner if we contact you first.
What we collect, why, and our lawful basis
Enquiries. Your name, email, phone number, the trip you asked about, preferred dates, number of people and anything you write in the message. We use this to reply and to prepare a quote. Lawful basis: legitimate interests, being our interest in answering people who contact us.
Bookings. Your name, address, email, phone number, date of birth, the trip and departure, the names of others in your party, and your booking and payment history. We use this to form and perform your contract with us. Lawful basis: performance of a contract, and legal obligation for the records we must keep.
Pre-departure details, through your guest portal. Passport details, emergency contact details and travel insurance policy details. We use these to run your trip and to brief the people looking after you. Lawful basis: performance of a contract. Some of it is also necessary to protect someone's vital interests in an emergency.
Health and dietary information, through your guest portal. Dietary requirements, medical information, mobility needs and your readiness check answers. These are special category data and are covered in their own section below.
Payments. The record of what you have paid, what is outstanding, the payment method, and the last four digits and type of your card. We use this to take payment and to keep proper accounts. Lawful basis: performance of a contract, and legal obligation.
Marketing emails. Your name and email address. Lawful basis: your consent, which you can withdraw at any time. If you have booked with us, or asked us for a quote, we may send you occasional emails about similar trips without asking again. We may do this because we took your address in the course of that booking or enquiry, we gave you a way to refuse marketing at the time, and every email since has carried a one-click unsubscribe. Our lawful basis for this is legitimate interests. You can stop it at any time and we will not ask you why.
Website use. Covered in the cookies section below.
Enquiries about jobs, and supplier contacts. Whatever you send us, used only to deal with that enquiry or to work with you. Lawful basis: legitimate interests, or steps taken before entering a contract.
If you choose not to give us information we need to run your trip safely, we will tell you what the consequence is. In some cases we may not be able to take you on a particular trip.
Health, dietary and other special category information
Medical conditions, medication, allergies, dietary requirements, mobility needs and your readiness check answers are special category data under UK data protection law, and we treat them accordingly.
We ask for them because on a remote expedition your leader needs to know. We collect them with your explicit consent, given in your guest portal. We share them only with the people who need them to keep you safe: your expedition leader, our operations team and, where it matters, the ground agent, accommodation or medical provider on your trip. In a genuine emergency we may share what is needed to protect your life or someone else's, which the law allows without consent.
You can withdraw your consent at any time by emailing us. If you do, we may have to tell you honestly that we cannot safely take you on a particular trip.
How we handle payments
Card payments are taken by Stripe, our payment provider. Your card details go straight to Stripe over an encrypted connection. We never see or store your full card number. We hold only the last four digits, the card type and the record of what you have paid.
If you pay with Apple Pay or Google Pay, those services handle the payment in the same way, and your card details are not shared with us.
Where you set up a payment plan, Stripe securely stores your card so that it can take each instalment on the agreed date. The card is held by Stripe, not by us, and you can ask us to change or remove it at any time.
Stripe uses your information to process payments, prevent fraud and meet its own legal obligations, acting as a controller in its own right. Its privacy policy is at stripe.com/gb/privacy.
You can pay in full, or pay a deposit and spread the balance over fixed monthly payments. We store the schedule, the amount outstanding and the date of each payment so that we can collect it and so that you can see where you are. If you pay by bank transfer or over the phone, we record the reference and the amount received, nothing more. We never write your card details down.
Who we share your information with
We share only what is needed, and only with:
- The ground agents, guides, lodges, hotels, transport operators and activity providers running your trip.
- Stripe, to take payment and check it is not fraudulent.
- The companies that host our website, run our booking and admin system and send our email, who act as our processors under written contract and may only use your information as we instruct.
- Airlines, embassies, park authorities or permit offices where a trip requires it.
- Our insurers, accountants and professional advisers, where necessary.
- Emergency services, medical providers or your emergency contact, if something happens on a trip.
- The police, courts or other authorities, where the law requires it.
We do not sell your information. We do not share it with anyone for their own marketing.
Sending information outside the UK
Our trips are mostly overseas, so to run your booking we send some of your details to providers outside the UK, for example in Nepal, Uganda, Mexico or Mozambique. We send only what that provider needs.
Where the UK government has not made regulations recognising a country's protection as not materially lower than our own, we rely on the safeguards UK law allows, normally the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses. In some cases, such as arranging a permit or dealing with an emergency abroad, a transfer is necessary to perform your contract or to protect someone's vital interests. Stripe and our technology suppliers may also transfer information outside the UK under the same kinds of safeguards. You can ask us for details of the safeguards that apply to you.
How long we keep it
- Enquiries that do not lead to a booking: 24 months.
- Booking and payment records: seven years after the end of the trip, as required for tax and accounting.
- Passport details: 12 months after your trip.
- Medical, dietary, readiness check and emergency contact details: 12 months after your trip. Where an accident or incident happened on that trip, we keep them for as long as we keep the incident record, because they may be needed to answer a claim.
- Marketing list: until you unsubscribe, reviewed every 24 months.
- Accident, incident and insurance records: as long as a claim could be brought, which for personal injury is normally at least three years, and longer where a child is involved.
When a period ends we delete the information or make it anonymous, so it can no longer identify you.
How we protect it
Access to our booking system and guest portal is restricted to the people who need it, and each has their own account. Information is transmitted over encrypted connections. Our suppliers are contracted to keep it secure. If a breach happens that puts your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay.
Automated decisions and our website assistant
We do not make decisions about you by automated means alone. Readiness check answers are read by a person, and no one is refused a trip by a computer.
Your rights
You have the right to:
- Be told what we hold about you, and to get a copy.
- Have inaccurate information corrected.
- Have information deleted where we no longer need it.
- Restrict how we use your information while a question is resolved.
- Object to us using your information for legitimate interests, and to stop marketing at any time.
- Receive information you gave us in a portable format, or have it sent to another provider.
- Withdraw consent at any time, where we rely on consent, without affecting what we did before you withdrew it.
Email info@alexanderadventures.co.uk. There is no charge. We will respond within one month. If your request is complex, or you have made several, we may take up to two further months, and we will tell you why within the first month. We may need to check who you are before we release information, or ask you what your request covers, and where we do the time runs from your answer.
Cookies and similar technologies
When you use our website, cookies and similar technologies are set by us and by the companies whose services we use. The tables below list all of them: what each one does, who sets it and how long it lasts. A name ending in an asterisk covers several cookies sharing that prefix.
Cookies we set without asking
These are strictly necessary: the website cannot do what you have asked it to do without them, so no permission is needed.
| Cookie | What it does | Set by | How long it lasts |
|---|---|---|---|
| __stripe_mid | Fraud checks on card payments | Stripe | 1 year |
| __stripe_sid | Fraud checks on card payments | Stripe | 30 minutes |
| woocommerce_cart_hash | Remembers what is in your basket | Us | Until you close your browser |
| woocommerce_items_in_cart | Remembers what is in your basket | Us | Until you close your browser |
| wp_woocommerce_session_* | Keeps your checkout session going between pages | Us | 2 days |
| wordpress_logged_in_* wordpress_sec_* | Keeps our own staff signed in. Not set for ordinary visitors | Us | Until sign-out, or 14 days where the sign-in is remembered |
| aa_consent | Remembers whether you accepted or rejected the cookies in the next table, so we do not ask on every page | Us | 6 months |
Cookies we set only if you agree
None of these are needed for the website to work. They record where our visitors come from.
| Cookie | What it does | Set by | How long it lasts |
|---|---|---|---|
| sbjs_* | Records which advert, search or website brought you to us, so we can tell which of our marketing works | Us, through WooCommerce order attribution | 30 minutes, or until you close your browser |
We do not use advertising cookies, we run no Meta, LinkedIn or Google advertising pixels, and we do not sell what we learn from cookies.
When you first visit we show you a banner where you can accept or reject the cookies in the second table. Rejecting is as easy as accepting. Nothing in the second table is set unless you agree to it. You can change your mind at any time using the cookie settings link at the foot of every page, and your choice is remembered.
Children and young people
We run trips for schools, youth groups and families. Where a guest is under 18 we take their details from a parent, guardian or group leader, we use them only to run the trip and keep that young person safe, and we do not market to them.
Because young people use our site and guest portal, we design them to collect the least we need, we do not profile them, and we do not use their information for anything beyond running their trip.
Complaints
If you are unhappy with how we have handled your information you can complain to us directly. Email info@alexanderadventures.co.uk with "Data protection complaint" in the subject line, or write to us at the address above. We will acknowledge your complaint within 30 days of receiving it, look into it, and tell you the outcome and our reasons as soon as we can.
You can also complain to the Information Commissioner's Office at any time, whether or not you have come to us first. You can reach them at ico.org.uk, by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or on 0303 123 1113.
Changes to this policy
We update this policy when the way we work changes. The date at the top shows when it last changed, and material changes will be notified to anyone with a live booking.