Privacy Policy
GDPR compliance & Data protection
Introduction
Outspark Ltd takes your privacy very seriously, and abides by the relevant provisions of UK GDPR and the UK’s Data Protection Act 2018. This Privacy Notice tells you the different ways in which we gather, store and use data, sets out your rights and hopefully answers any queries you may have about your personal data.
We don’t have an external data protection officer as we don’t fall under any of the ICO provisions requiring that, and our use of data is pretty straightforward. So, if you need more information after reading it, please contact our Operations Manager, Alex Bryant. alex@outspark.co.uk
Email Bulletin
If you have signed up to receive advice and updates for expedition leaders via our website, you will have consented to receive such emails via double-opt in. We use a third party provider, Aweber, to store and send out these emails. You can view their Privacy Policy here. You can unsubscribe from these emails at any time by clicking the link in the emails or emailing Alex Bryant, above.
Website Cookies
Our website which is hosted on Squarespace employs cookies. You can see details on their website here. At present, we do not ourselves make any use of cookies and this policy will be updated if we do. We don’t track anyone’s web activity on other websites or anything complicated like that.
Participant and School Staff Information
If you are taking part in an expedition or other outdoor adventure or training programme, or if you are a member of staff or volunteer from a school or other organisation, the controller of your data will be Outspark Ltd.
1. What information do we collect?
We collect and process personal contact and medical information from participants on our expeditions, as well as contact and medical information from school teachers/adult volunteers. This personal data is usually provided by parents/carers via a Google form. In some cases, schools may gather this information and pass it on to us.
The personal data we process includes:
● name, and sometimes age or date of birth if that is significant for eligibility for a programme
● home address, email address and phone number.
● medical and dietary information.
● emergency contact details for next of kin in case of incident.
● pedagogical and other information to help us care for participants and keep them safe
● photographs (usually of teams of participants) with names, a requirement of doing expeditions with us
● photographs with opt-in parent/carer consent for use in publicity and training, along with the names of those featuring in photographs (the latter for internal purposes such as managing any subsequent withdrawal of consent)
2. How do we use this information and what is the legal basis for this use?
We process the personal data listed above for the following purposes:
● In accordance with our legitimate interests in keeping participants safe whilst they take part in adventurous activities, we produce participant medical summaries for our trips, so our instructors can run expeditions safely and respond to medical issues appropriately.
● as required to establish a booking with the school, for example, if as a teacher you make a booking for an expedition programme. This may include communicating with you, providing customer services and arranging the delivery or other provision of products or services. We require this information in order to enter into a contract with the school and are unable to do so without it;
● to comply with applicable law and regulation;
● in accordance with our legitimate interests in protecting Outspark Ltd’s legitimate business interests and legal rights, including but not limited to, use in connection with legal claims, compliance, regulatory and investigative purposes (including disclosure of such information in connection with legal process or litigation);
● to respond to any comments or complaints we may receive from you, and/or in accordance with our legitimate interests including to investigate any complaints received from you or from others, about our website or our products or services;
● we may use information you provide to personalise our communications to you;
● in the case of photographs and video obtained with the relevant explicit consent, for publicity and training purposes
3. With whom and where will we share your personal data? Your personal information is shared with your instructors and with other supervisory and administrative staff at Outspark Ltd, as is required by our safety systems in line with Health and Safety Executive regulations. Personal data may be shared with government authorities and/or law enforcement officials if mandated by law or if needed for the legal protection of our legitimate interests in compliance with applicable laws. In the event that our business or any part of it is sold or integrated with another business, your details will be passed to the new owners of the business.
4. How long will you keep my personal data? No longer than is necessary and only that personal information that is necessary in relation to the purpose. We are also required to retain certain information as required by law or for as long as is reasonably necessary to meet regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions. Where you are under 18, we will retain your data for up to 5 years after the year in which you turn 18. This might seem like a long time to retain such information, but our insurers advise us that it is possible for someone to make a claim in that timeframe, so we should retain the information (and obviously have a legitimate interest in doing so).
In the case of any contact you may have with our administrative team, we will retain those details for as long as is necessary to resolve your query. We will retain your data for a short time beyond the specified retention period, to allow for information to be reviewed and any deletion to take place. In some instances, laws may require Outspark Ltd to hold certain information for specific periods other than those listed above.
5. Where is my data stored? Legacy paper consent/medical forms are held in a secure filing cabinet in a locked storage container in a secure compound. Raw information submitted to Google Forms is stored on Google Drive, and formatted summaries of that information are stored on encrypted laptops or in Google Drive. Paper copies of the summaries are produced for distribution to instructors for expeditions
6. How is old data destroyed?
Legacy paper forms are shredded or burnt. Paper copies of participant information summaries are collected at the end of each event and stored until they are shredded. Information stored on Google Drive is deleted in an ongoing rotation based on the date of creation.
7. What are my rights in relation to my personal data? If the information we hold about you is inaccurate or incomplete, you can notify us and ask us to correct or supplement it. You also have the right, with some exceptions and qualifications, to ask us to provide a copy of any personal data we hold about you. If you have a complaint about how we have handled your personal data, you may be able to ask us to restrict how we use your personal data while your complaint is resolved. In some circumstances you can ask us to erase your personal data (a) if it is no longer necessary for us to use your personal data; (b) if you object to the use of your personal data and we don’t have a good reason to continue to use it;
8. Where can I find more information about Outspark Ltd’s handling of my data?
Should you have any queries regarding this Privacy Notice, about how Outspark Ltd processes your personal data or wish to exercise your rights you can contact the Outspark Ltd team using this email address: alex@outspark.co.uk.
If you are not happy with our response, you can contact the Information Commissioner’s Office: https://ico.org.uk/
This policy was last revised in December 2023 and will be reviewed by January 2026.
