​1. Who is responsible for your information?

​The data controller is Ramblewood Ltd, trading as Ramblewood. Email tanya@ramblewood.co.uk.

​​

2. Information collected by Ramblewood

• Identity and contact details, such as your name, email address, telephone number, postal address and emergency contact.

• Booking and transaction details, including the session, participants, voucher use, amount paid and correspondence. Your full payment-card details will not be collected by Ramblewood. This remains secure in the payment website that you book through, e.g. Eventbrite. 

• Relevant accessibility, dietary, allergy, physical-health or mental-health information you choose or need to provide for safety and reasonable adjustments. This may be special-category health data.

• Consent records and communication preferences, including newsletter and photography choices.

• Photographs, video or audio where you have given the relevant permission or another lawful basis applies.

• Messages, feedback, complaints and incident or accident records.

• Website and device information, such as IP address, browser, cookie identifiers, pages visited and approximate location, depending on your cookie choices and the tools enabled on the site.

​​

3. Where information comes from

Ramblewood usually receives information directly from you, from the person making a group booking for you, or through providers used to operate the website and bookings, such as Wix and Eventbrite. If someone books for you, they must have authority to give me the necessary details and should show you this policy.

​

4. Why Ramblewood uses information and the lawful bases​​​​

​

​Purpose: Take and administer bookings; provide the session; contact you about changes.

Information: Contract, booking and transaction data.​​

GDPR lawful basis: Contract; steps at your request before a contract

​

Purpose: Plan safe participation, adjustments and respond to incidents

Information: Relevant health, accessibility, allergy and emergency information

GDPR lawful basis: Contract and legitimate interests; for health data, normally explicit consent, and in a genuine emergency vital interests where applicable

​

Purpose: Process payments, refunds, accounts and tax records

Information: Transaction and booking data

GDPR lawful basis: Contract and legal obligation

 

Purpose: Answer enquiries, handle complaints and establish or defend claims

Information: Contact, correspondence, incident and booking data

GDPR lawful basis: Legitimate interests; legal obligation; establishment, exercise or defence of legal claims where special-category data is involved

​

Purpose: Send newsletters and marketing

Information: Name, email and preferences

GDPR lawful basis: Consent, or the limited “soft opt-in” where PECR permits it; you can unsubscribe at any time

 

Purpose: Use identifiable photographs or recordings for the stated promotional purposes

Information: Images, recordings and consent record

GDPR lawful basis: Consent

 

Purpose: Operate, secure and improve the website; measure use

Information: Device, log and cookie data

GDPR lawful basis: Legitimate interests for security and strictly necessary functions; consent for non-essential cookies and related analytics/advertising

 

Purpose: Comply with law, insurance and safeguarding requirements

Information: Relevant booking, incident and correspondence data

GDPR lawful basis: Legal obligation and legitimate interests

 

5. Health and other sensitive information

​

Please provide only information relevant to taking part safely or arranging an adjustment. Where I rely on explicit consent for health information, you may withdraw that consent, but I may then be unable to offer a requested adjustment or safely provide the service. Withdrawal does not make earlier lawful processing unlawful. In a serious emergency I may use or disclose necessary information to protect someone’s vital interests.

 

6. Who I share information with

 

I share personal information only where necessary with trusted service providers or recipients, which may include Wix (website, forms and emails), Eventbrite (booking and payment provider), cloud storage and Google Gmail providers, professional advisers, insurers, first-aid or emergency services, relevant landowners, and regulators or law-enforcement bodies where required. Providers acting for Ramblewood are expected to protect the information and use it only for authorised purposes. Some platforms may also act as independent controllers for their own purposes; their privacy notices apply to that processing.

​

I do not sell your personal information.

 

7. International transfers

​

Some service providers may store or access information outside the UK. Where Ramblewood is responsible for such a transfer, I will use a lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, and any required risk assessment. Provider privacy notices may give further detail.

​

8. How long information is kept

​

• Enquiries that do not become bookings: normally up to 12 months after the last contact.

• Booking, invoice and core transaction records: normally 6 years after the end of the relevant financial year, where needed for tax, accounting or legal claims.

• Routine health, accessibility and dietary information: normally deleted or de-identified within 3 months after the session, unless needed for a future booking at your request or for an incident, complaint or legal obligation.

• Incident, accident, safeguarding and related insurance records: for the period advised by the insurer or reasonably required for legal claims, taking account of applicable limitation periods.

• Newsletter information: until you unsubscribe or consent is otherwise withdrawn, plus a minimal suppression record so I can respect the request.

• Photography consent records and selected media: while the use remains relevant and lawful, reviewed periodically; material will no longer be newly used after effective withdrawal of consent.

• Cookie and analytics data: according to the live cookie table and provider settings.

​​

These are normal periods, not absolute rules. I may retain information longer where law, insurance, a complaint or a legal claim requires it, or delete it sooner when it is no longer needed.

​

9. Security

​

I use proportionate organisational and technical measures designed to protect information, including access controls, secure accounts, appropriate provider settings and limiting collection to what is needed. No internet or storage system can be guaranteed completely secure.

​

10. Your rights

​

Depending on the circumstances, you may have rights to be informed; access your information; correct inaccurate information; have information erased; restrict processing; object to processing based on legitimate interests or to direct marketing; receive certain information in a portable form; and withdraw consent. You also have rights relating to solely automated decisions with legal or similarly significant effects. Ramblewood does not currently make such decisions.

To exercise a right, email tanya@ramblewood.co.uk. I may need to verify your identity. Rights are not absolute, and I will explain if an exemption applies. 

​

11. Marketing

​

You can unsubscribe using the link in an email or by contacting me. Unsubscribing does not stop essential messages about an existing booking. I will keep a minimal suppression record where necessary to ensure marketing is not sent again.

​

12. Children

​

The website and standard public sessions are intended for adults. I do not knowingly collect children’s information through the website for these sessions. If a future family or private session involves a child, a separate, age-appropriate process and privacy information may be used.

​

13. Complaints and contact

​

Please contact tanya@ramblewood.co.uk first so I can try to resolve a concern. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. If you live outside the UK, you may also have the right to contact your local data-protection authority.

​

14. Changes to this policy

​

Ramblewood may update this policy when services, providers or legal requirements change. The current version and update date will be published on this website. Significant changes will be highlighted where appropriate.

​

Last updated 21/10/26.