Data protection policy
Key details
- Company: Andean Trails Ltd, registered in Scotland, company number SC274174.
- Person responsible for this policy: Kathy Jarvis.
- Draft updated: 16 October 2026.
- This policy should be reviewed annually and whenever relevant legislation or company procedures change.
Introduction
Andean Trails Ltd collects and uses personal information to respond to enquiries, arrange holidays, manage bookings, work with suppliers and maintain business relationships.
This policy explains how personal information must be collected, used, stored and shared to meet the company’s data protection responsibilities.
Why this policy exists
This policy aims to ensure that Andean Trails Ltd:
- Complies with applicable data protection law.
- Protects the personal information of customers, staff, suppliers and other contacts.
- Explains clearly how personal information is used.
- Reduces the risk of information being lost, misused or disclosed without authorisation.
- Can demonstrate how it meets its data protection responsibilities.
Data protection law
Andean Trails Ltd must comply with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended, together with other applicable privacy legislation.
These requirements apply to personal information held electronically, on paper or in other formats.
The seven data protection principles require personal information to be:
- Used lawfully, fairly and transparently.
- Collected for specified, explicit and legitimate purposes.
- Adequate, relevant and limited to what is necessary.
- Accurate and kept up to date where necessary.
- Kept for no longer than necessary.
- Protected with appropriate security measures.
- Handled in a way that demonstrates accountability for compliance.
Policy scope
This policy applies to all employees, contractors, temporary staff, volunteers and other people handling personal information on behalf of Andean Trails Ltd.
It covers personal information relating to customers, prospective customers, travellers, staff, suppliers and other identifiable individuals.
This may include:
- Names, postal addresses, email addresses and telephone numbers.
- Enquiries, correspondence and booking records.
- Passport details, dates of birth and other information required to arrange travel.
- Emergency contact information.
- Payment and transaction information.
- Health, accessibility and dietary information where needed to arrange a holiday.
- Marketing preferences and consent records.
Only information needed for a specific and lawful purpose should be collected.
Data protection risks
This policy addresses risks including:
- Personal information being shared with the wrong person.
- Unauthorised access to customer or staff records.
- Loss or theft of devices, documents or account credentials.
- Keeping information that is inaccurate or no longer needed.
- Using information for purposes that individuals would not reasonably expect.
- Sharing information with suppliers without appropriate checks and safeguards.
Responsibilities
Andean Trails Ltd is responsible for personal information it controls. Kathy Jarvis oversees the implementation of this policy on behalf of the company.
Everyone handling personal information for Andean Trails Ltd must follow this policy and report concerns promptly.
Kathy Jarvis is responsible for coordinating:
- Reviews of data protection procedures and related policies.
- Appropriate staff training and guidance.
- Responses to questions, complaints and requests about personal information.
- Checks on suppliers and agreements involving personal information.
- Appropriate access controls and security arrangements with relevant IT providers.
- Reviews of marketing practices and privacy information.
- The assessment and handling of suspected personal data breaches.
Tasks may be delegated to appropriate staff or service providers, but Andean Trails Ltd remains responsible for its obligations.
Lawful use of personal information
Before collecting or using personal information, Andean Trails Ltd must identify an appropriate lawful basis and explain the processing in its privacy notice.
Depending on the circumstances, this may include taking steps requested before a booking, performing a contract, meeting a legal obligation, pursuing a legitimate interest or obtaining consent.
Consent must be freely given, specific, informed and unambiguous. Where processing relies on consent, individuals must be able to withdraw it.
Health and other sensitive information
Some travel arrangements may require information about a traveller’s health, disability, accessibility requirements or dietary needs. This information can include special category personal data.
Before processing special category information, Andean Trails Ltd must identify both an appropriate lawful basis and a separate legal condition for handling that information. Explicit consent may be appropriate in some circumstances.
Access must be restricted to those who need the information. Only relevant details should be shared with accommodation providers, guides, transport operators or other suppliers.
General guidelines
- Access to personal information must be limited to people who need it for their work.
- Personal information must not be shared informally or disclosed to unauthorised people.
- Staff must use approved systems and individual accounts wherever possible.
- Passwords must be strong and unique. Multi-factor authentication should be used where available and appropriate.
- Access permissions must be reviewed when someone changes role or leaves the company.
- Suppliers handling personal information must understand their responsibilities and have appropriate contractual arrangements where required.
- Personal information must be reviewed regularly and securely deleted when it is no longer required.
Paper records
Paper records containing personal information must be stored securely and protected from unauthorised access.
- Keep documents in a locked drawer, cabinet or other secure location when not in use.
- Do not leave documents visible in public areas or unattended on printers.
- Limit printing to what is necessary.
- Shred documents or use an appropriate confidential disposal service when they are no longer needed.
Electronic storage and security
Electronic information must be protected against unauthorised access, accidental loss, alteration and malicious activity.
- Use approved systems, devices and cloud services.
- Keep operating systems, software and security tools up to date.
- Lock screens whenever devices are left unattended.
- Protect devices and removable storage with appropriate access controls and encryption.
- Avoid unnecessary local downloads and duplicate copies of customer information.
- Use secure connections when accessing company systems remotely.
- Back up important information and test recovery arrangements regularly.
- Assess new services before using them to store or process personal information.
Sharing personal information
Personal information must only be shared where there is a lawful reason and the recipient needs it for the stated purpose.
When sending information electronically, staff must check recipients carefully and use security measures appropriate to the sensitivity of the information. Sensitive documents should be shared through an approved secure method.
Where a supplier processes information on behalf of Andean Trails Ltd, an appropriate data processing agreement must be in place where required.
International transfers
Arranging overseas holidays may involve sharing personal information with suppliers outside the UK, including accommodation providers, local tour operators and transport companies.
Before making a restricted international transfer, Andean Trails Ltd must assess the applicable requirements and identify a valid transfer mechanism. This may involve UK adequacy regulations, appropriate safeguards or a legally permitted exception where its conditions are met.
Only information necessary for the travel arrangements should be shared. Relevant overseas processing must be explained in the company’s privacy notice.
Data accuracy
Andean Trails Ltd must take reasonable steps to keep personal information accurate and up to date.
- Check important booking and traveller details before using or sharing them.
- Give individuals a straightforward way to request corrections.
- Correct inaccurate information promptly.
- Keep records in as few places as necessary.
- Update marketing preferences and suppression records when someone opts out.
Retention and disposal
Personal information must only be retained for as long as necessary for its purpose, taking account of relevant legal, accounting, insurance and contractual requirements.
Andean Trails Ltd must maintain appropriate retention arrangements for booking records, financial information, enquiries, marketing records and staff information.
Sensitive traveller information should not be retained simply because other booking records need to be kept.
Information that is no longer required must be deleted, anonymised or securely destroyed. Backup retention must also be considered.
Marketing
Marketing activities must comply with applicable data protection law and the Privacy and Electronic Communications Regulations.
- Use consent where required, or another permitted route where its conditions are met.
- Explain how contact details will be used.
- Provide a straightforward way to unsubscribe from marketing emails.
- Act promptly on objections and withdrawal of consent.
- Keep appropriate suppression records to prevent further unwanted marketing.
Individual rights and subject access requests
Individuals have rights over their personal information, including access, correction, erasure, restriction, objection and data portability where applicable.
Requests can be made verbally or in writing. Individuals do not have to use a particular form or refer to data protection legislation.
Requests should be passed promptly to Kathy Jarvis. Individuals can contact Andean Trails Ltd through the contact page and ask for their request to be directed to her.
Andean Trails Ltd must respond without undue delay and normally within one month, subject to any applicable legal provisions concerning identity checks, clarification or extensions.
Requests are normally handled free of charge. Any permitted fee or refusal must meet the relevant legal conditions and be explained to the individual.
Identity checks must be proportionate and only carried out where necessary. Information must not be disclosed to someone who is not entitled to receive it.
Personal data breaches
Anyone who discovers or suspects a personal data breach must report it to Kathy Jarvis immediately.
Andean Trails Ltd must take appropriate steps to contain the incident, assess the risks, recover information where possible and record the incident and decisions made.
Where a breach must be reported to the Information Commissioner’s Office, notification must be made without undue delay and, where feasible, within 72 hours of becoming aware of it.
Where the breach is likely to result in a high risk to individuals’ rights and freedoms, affected individuals must also be informed without undue delay.
Requests from law enforcement and other authorities
Requests for personal information from law enforcement agencies or other authorities must be referred to Kathy Jarvis.
Before disclosing information, Andean Trails Ltd must check the legitimacy of the request, identify the legal basis and limit disclosure to what is necessary. Professional advice should be obtained where appropriate.
Privacy information and complaints
Andean Trails Ltd must provide clear privacy information explaining what personal information it collects, why it uses it, who it shares it with, how long it keeps it and how individuals can exercise their rights.
This policy supports the company’s privacy notice and does not replace it.
Questions or complaints about personal information should be directed to Kathy Jarvis through the contact page.
Individuals can also raise concerns with the Information Commissioner’s Office.
