GDPR Compliance

Last updated: June 19, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: Processing is necessary to fulfill our contract with you when you book a tour
• Legitimate interests: We have a legitimate interest in maintaining customer records and improving our services
• Legal obligation: We must retain certain records to comply with UK tax and business regulations

Data Controller

The data controller responsible for your personal information is:

willow-heron
42 Clerkenwell Road
London EC1M 5PS
United Kingdom
Email: [email protected]

Your GDPR Rights

Under the UK GDPR, you have the following rights:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request.

Right to Rectification

You can ask us to correct any inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data, subject to certain legal exceptions such as business record retention requirements.

Right to Restrict Processing

You can ask us to limit how we use your personal data in certain circumstances.

Right to Data Portability

You can request your personal data in a structured, machine-readable format and transfer it to another organization.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling in our processing of your personal data.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within one month. In complex cases, we may extend this by two additional months and will inform you of any delay.

Data Transfers

Your personal data is stored and processed within the United Kingdom. We do not transfer data outside the UK or EU.

Data Security

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel only
• Regular security assessments and updates
• Staff training on data protection practices

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk

Policy Updates

We may update this GDPR compliance statement periodically. We will notify you of any significant changes by updating the date at the top of this page.