Privacy policy

1. Who we are

The controller of your personal data is Edbabel Ltd, a company registered in Scotland under number SC481324, trading as City Explorers Tours.

For any question about your personal data, please write to info@cityexplorerstours.com.

This policy applies to cityexplorerstours.com, to bookings for our tours and to any communication you have with us. We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation.

2. What data we collect

• Contact form, email and WhatsApp: your name, your email address or phone number and the content of your message.
• Bookings: name, email, phone number, number of participants, date and tour and, where relevant, any information you choose to give us (for example, accessibility needs). Payments are processed by our booking system and its payment provider; we never see or store your full card details.
• Bookings through other platforms: if you book through an agency or third-party platform, it shares with us the information we need to provide the service (usually name, number of participants and a contact detail).
• Job applications: the CV, cover letter and details you send us if you would like to work with us.
• Photographs and videos taken during some activities, as explained in our terms and conditions.
• Browsing data: information about how you use the website (pages visited, device, where your visit came from) collected through cookies, only if you accept them.

We do not ask for special category data. If you choose to tell us about a health condition so we can adapt an activity, we will use that information only for that purpose.

3. Why we use it and our legal basis

• Managing your booking and running the tour (sending your confirmation, telling you about changes, looking after you on the day): performance of a contract.
• Answering your enquiries: our legitimate interest in helping you or, if you ask before booking, steps taken at your request before entering into a contract.
• Meeting legal obligations, such as accounting and tax: legal obligation.
• Handling complaints and defending our rights: legitimate interest.
• Website analytics and advertising (Google Analytics and Google Ads through Google Tag Manager): your consent, which you can withdraw at any time.
• Marketing messages: only with your consent or where the law allows it, always with an easy way to unsubscribe.
• Recruitment: steps taken at your request before entering into a contract, and our legitimate interest in filling vacancies.
• Promotional use of images in which you are clearly identifiable: your consent.

4. Who we share it with

We do not sell your data. We only share it where necessary for the purposes above:

• Service providers working for us: booking and payment system (FareHarbor), website hosting and forms (Netlify), cookie consent management (Cookiebot), analytics and advertising (Google), messaging (WhatsApp, owned by Meta) and email.
• Guides leading your tour, who receive the list of participants in their group.
• Third-party platforms you booked through, so the booking can be managed.
• Professional advisers (accountants, lawyers, insurers) and authorities, where necessary or required by law.

5. International transfers

Some of our providers (for example Google, Netlify, FareHarbor or Meta) may process data outside the UK, particularly in the United States. In those cases we make sure an appropriate safeguard recognised under UK law is in place, such as the UK Extension to the EU-US Data Privacy Framework or approved contractual clauses (the IDTA or the UK Addendum to the EU standard contractual clauses).

6. How long we keep it

• Enquiries that do not lead to a booking: up to 2 years from our last contact.
• Booking and invoicing records: 6 years from the end of the financial year, to meet legal obligations.
• Job applications: up to 12 months after the recruitment process, unless you allow us to keep them longer.
• Website analytics data: in line with our Google Analytics settings (14 months at most).
• Promotional images: while they are in use or until you withdraw your consent.

After these periods we delete or anonymise the data.

7. Your rights

You can exercise the following rights at any time:

• Access your data and get a copy of it.
• Have inaccurate or incomplete data corrected.
• Ask us to delete your data.
• Restrict or object to certain uses, including direct marketing.
• Receive your data in a structured format (portability).
• Withdraw your consent, without affecting any processing carried out before.

To exercise these rights, write to info@cityexplorerstours.com. We will reply within one month and may ask for information to confirm your identity.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO): ico.org.uk, phone 0303 123 1113. If you live in the European Union, you can also contact the data protection authority in your country.

8. Cookies

We use technical cookies that the website needs to work and, only if you accept them, statistics and marketing cookies. When you first visit the website we show you a banner so you can choose which cookies to allow.

You can change or withdraw your consent at any time: change my cookie settings.

Here is the up-to-date list of cookies used on the website:

9. Children

Bookings must be made by adults. We do not knowingly collect data from children under 13 without the permission of a parent or guardian. If you believe we have received information about a child without that permission, please contact us and we will delete it.

10. Security

We apply reasonable technical and organisational measures to protect your data against loss, unauthorised access or misuse, and only people who need access for their work can see it.

11. Changes to this policy

We may update this policy to reflect legal changes or changes to our services. The current version will always be published on this page with the date it was last updated.

12. Contact

If you have any question about this policy or your data, write to info@cityexplorerstours.com or to our registered office: Edbabel Ltd, 5 South Charlotte Street, Edinburgh EH2 4AN, Scotland.