Privacy Policy

Introduction Northern Latitude ("we", "us", "our") operates services and a website providing information and booking for swimming, stand-up paddleboarding (SUP) and training experiences in North East England. This Privacy Policy explains how we collect, use, store, share and protect personal data, your rights, and how to contact us. It applies to data collected via our website, bookings, events, email communications and other interactions.

Controller

Northern Latitude LTD is the data controller for the personal data described in this policy.

Data we collect

We may collect the following categories of personal data:

  • Identity and contact information: name, date of birth, postal address, email address, telephone/mobile number.

  • Booking and transaction information: booking dates, session details, payment and billing information (we do not store full payment card details; payment is processed by our payment provider), receipts and refund details.

  • Emergency and health information: medical conditions, allergies, emergency contact name and telephone number, relevant fitness information required for safe participation in activities.

  • Communications: correspondence, enquiries, feedback and customer service records.

  • Marketing preferences: whether you have consented to receiving marketing, preferred communication channels.

  • Website and device data: IP address, device type, browser type, pages visited, referring site, cookies and usage analytics.

  • Photographs and video: media captured during activities or events where you are identifiable (we will notify you if photos or video may be taken and obtain consent where required).

How we collect personal data

  • Directly from you when you register, make a booking, contact us, subscribe to updates or provide information at events.

  • Automatically through your use of our website and services (cookies and analytics).

  • From third parties such as booking platforms, payment processors, emergency contacts, or publicly available sources where permitted by law.

Lawful basis for processing

We process personal data under the following lawful bases:

  • Performance of a contract: to fulfil bookings, supply services and manage payments.

  • Legal obligation: to meet legal or regulatory obligations.

  • Legitimate interests: for purposes such as fraud prevention, safety and security, administration, improving services, and communicating important updates, provided these do not override your rights and freedoms.

  • Consent: where we use your data for marketing, photography/video usage, or other purposes requiring explicit consent.

Purposes of processing

We use personal data to:

  • Manage and fulfil bookings, provide activities and deliver services safely.

  • Process payments and issue receipts.

  • Communicate with you about bookings, changes, cancellations, safety information and customer service.

  • Assess fitness to participate and manage health and safety requirements.

  • Keep emergency contacts informed if necessary.

  • Improve our services, analyse trends and monitor website performance.

  • Send marketing communications if you have opted in; deliver targeted offers and newsletters.

  • Comply with legal obligations and respond to lawful requests from authorities.

  • Maintain records and defend legal claims.

Legal and safety disclosures

We may disclose personal data if required by law, court order or to protect the rights, property or safety of Northern Latitude, our customers, staff or the public. We may also share data with emergency services or medical professionals where necessary for your safety.

Sharing and recipients We share personal data only with parties necessary to provide services, including:

  • Payment processors and financial institutions for payments and refunds.

  • Booking and scheduling platforms when used for reservations.

  • Third-party service providers who help with email, marketing, IT hosting, analytics and website operation.

  • Photographers and media processors when consent is given.

  • Legal and professional advisers where required. We require processors to handle data securely and only for the purposes we specify. We do not sell personal data to third parties.

International transfers

Some service providers may be located outside the UK. Where personal data is transferred internationally, we will ensure appropriate safeguards are in place such as standard contractual clauses or reliance on permitted transfer mechanisms under data protection law.

Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. Measures include encrypted connections, access controls, secure hosting and staff training. While we endeavour to protect your data, no system is completely secure and we cannot guarantee absolute security.

Data retention

We retain personal data only as long as necessary for the purposes outlined, to meet legal obligations, resolve disputes and enforce agreements. Retention periods vary by data type (for example, booking and financial records are kept for tax and accounting purposes). If you wish to know specific retention periods, contact us (see below).

Cookies and similar technologies

Our website uses cookies and similar technologies to provide basic functionality, measure performance, and support analytics. Some cookies are essential; others require your consent. You can manage cookie preferences using your browser settings or any controls provided on the website.

Your rights

You have the following rights in relation to the personal data Northern Latitude processes about you. To exercise any of these rights, please contact us using the details provided in our privacy policy or at the contact address given on our website. We will respond within one month of receiving your request, unless the request is complex or numerous, in which case we will inform you and may extend the period by up to a further two months.

  • Right to be informed: You have the right to be provided with clear and transparent information about how and why we collect and use your personal data, the categories of data we process, and how long we retain it.

  • Right of access: You have the right to request a copy of the personal data we hold about you, together with details about how and why it is processed and any recipients of that data.

  • Right to rectification: If your personal data is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.

  • Right to erasure (right to be forgotten): In certain circumstances you may request that we delete your personal data (for example, where it is no longer necessary for the purposes it was collected, or where you withdraw consent and there is no other legal basis for processing). We may retain some information where required by law or for legitimate business purposes (for example, to fulfil contractual obligations or for fraud prevention).

  • Right to restrict processing: You may request that we restrict the processing of your personal data in certain situations, for example while we verify its accuracy or if you object to our processing.

  • Right to data portability: Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used and machine-readable format, and to transmit that data to another controller.

  • Right to object: You have the right to object to our processing of your personal data where the legal basis is our legitimate interests or for direct marketing. If you object to direct marketing, we will stop processing your data for that purpose immediately.

  • Rights in relation to automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We will provide meaningful information about the logic involved and the envisaged consequences of such processing where it occurs.

Complaints

If you are unhappy with how we have handled your personal data you should contact us in the first instance so we can try to resolve the matter. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). The ICO is the independent regulator responsible for data protection in the UK. Provide the ICO with as much detail as possible about your complaint.

Retention and remedies

Where you exercise your rights, we will consider and respond to your request in accordance with UK data protection law (including the UK General Data Protection Regulation and the Data Protection Act 2018). Where applicable, and subject to any legal or legitimate exemptions, we will action your request without undue delay.

Proof of identity

To protect your privacy and the security of your data, we may need to ask for proof of identity before fulfilling certain requests (for example, requests for access, erasure or portability). We will only request the minimum information necessary to verify your identity.

Contact us

For any data rights requests or queries about how we use your personal data, please contact our data protection representative at hello@northernlatitude.co.uk. Include enough information for us to locate your data and respond to your request promptly.