PRIVACY POLICY

Revel X Limited (“we”, “us”, “our”), trading as Revel Tours, operates revelrugby.com and reveltours.com. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites, make a booking, or interact with us in any way.

We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it.

Information you provide to us:

• Identity Data: full name, title, date of birth, gender
• Contact Data: email address, telephone numbers, postal address
• Booking Data: tour preferences, dietary requirements, medical conditions relevant to travel, passport details, emergency contact information
• Financial Data: payment card details, billing address (processed securely through our payment providers)
• Group Data: information about other travellers in your group, including children and young people
• Communication Data: your correspondence with us via email, phone, WhatsApp or our websites

Information we collect automatically:

• Technical Data: IP address, browser type and version, time zone setting, operating system
• Usage Data: information about how you use our websites, including pages visited and links clicked
• Cookie Data: information collected through cookies and similar technologies

Information from third parties:

• Information from schools, clubs, or organisations booking on behalf of groups
• Information from accommodation providers, transport companies, and other service suppliers
• Information from social media platforms if you interact with us through these channels

The Revel Tours & Clubhouse app (available on iOS and Android) collects additional account data (name and email at login, stored securely via EU-based infrastructure and used solely for authentication) and requests device permissions — camera (QR check-in), photos, location (used exclusively for auto-checkout) and push notifications. We do not use your data for advertising, do not track you across third-party apps or websites, and do not sell your data to third parties.

To provide our services:

• Processing and managing your festival or tour booking
• Arranging accommodation, transport, activities, and other tour services
• Communicating with you about your booking (confirmations, updates, changes)
• Providing on-tour support and assistance
• Processing payments and refunds

To meet legal and regulatory requirements:

• Complying with the Package Travel and Linked Travel Arrangements Regulations 2018
• Meeting safeguarding requirements for tours involving children
• Complying with financial regulations and anti-money laundering requirements
• Responding to legal requests from authorities

For business purposes:

• Improving our services and developing new festival and tour offerings
• Sending you marketing communications (with your consent)
• Conducting customer satisfaction surveys
• Analysing website usage to improve user experience
• Protecting against fraud and ensuring the security of our systems

We process your personal data on the following legal grounds:

• Contract: processing necessary to fulfil our contract with you (your booking)
• Legal Obligation: processing necessary to comply with legal requirements
• Legitimate Interests: processing necessary for our legitimate business interests, such as improving our services and marketing (where this doesn't override your rights)
• Consent: where you have given specific consent for marketing communications or other optional processing
• Vital Interests: in emergency situations to protect someone's life or health

We may share your personal information with service providers (accommodation providers, transport companies, activity and excursion providers, catering services, local tour guides and representatives), business partners (payment processors, insurance providers, IT service providers, and marketing platforms with your consent) and regulatory or legal bodies (ABTA and other industry bodies, government authorities when required by law, and courts and legal advisors in case of disputes).

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

As we organise tours to destinations outside the UK, your personal data may be transferred to and processed in countries outside the UK and European Economic Area (EEA).

When we transfer your data internationally, we ensure appropriate safeguards are in place, including transferring to countries with adequate data protection laws recognised by the UK, using Standard Contractual Clauses approved by the UK Government, and ensuring transfers are necessary for the performance of your tour contract.

Please contact us if you would like more information about the specific safeguards applied to your data.

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, accidental loss or damage, and unlawful processing. These measures include:

• Encryption of data in transit and at rest
• Secure payment processing through PCI-DSS compliant providers
• Regular security assessments and updates
• Staff training on data protection
• Access controls limiting who can view personal data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are:

• Booking records: 7 years after the tour completion (for legal and accounting purposes)
• Marketing data: until you withdraw consent or 3 years of inactivity
• Website analytics: 26 months
• Enquiry data (no booking): 2 years

After the retention period, your data will be securely deleted or anonymised.

Under data protection law, you have the following rights:

• Right of Access: request a copy of the personal data we hold about you
• Right to Rectification: request correction of inaccurate or incomplete data
• Right to Erasure: request deletion of your data in certain circumstances
• Right to Restrict Processing: request limitation of how we use your data
• Right to Data Portability: request transfer of your data to another organisation
• Right to Object: object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at hello@reveltours.com. We will respond to your request within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly. Visit ico.org.uk for more information.

Many of our festivals and tours involve children and young people travelling with schools or clubs. We take extra care to protect the privacy of minors:

• We only collect children's data that is necessary for the booking and their safety
• We require consent from a parent, guardian, or responsible adult (such as a teacher or group leader)
• We do not use children's data for marketing purposes
• We have enhanced safeguarding procedures in place

Our websites use cookies to enhance your browsing experience. Cookies are small text files stored on your device that help us remember your preferences, understand how you use our websites, improve functionality, and provide relevant content.

You can control cookies through your browser settings. However, disabling certain cookies may affect your experience on our websites.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the updated policy on our websites, updating the “Last updated” date on this page, and emailing you if you are an existing customer (for material changes).

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Revel Tours (Revel X Limited), International House, 10 Churchill Way, Cardiff, CF10 2HE, United Kingdom
• Email: hello@reveltours.com
• Phone: +44 (0) 2920 00 27 74