Privacy and Cookie Notice
Effective from 7 October 2026
1. Who we are
This website, www.nomadseakayaking.co.uk, is run by Kurt E. Finch, trading as NOMAD Sea Kayaking and NOMAD Outdoor Learning ("NOMAD", "we", "us", "our"). We are a sole trader based in Suffolk, England.
We are the "data controller" for the personal information described in this notice. That means we decide how and why it is used, and we are responsible for looking after it.
Bookings and orders made before 1 August 2026 were taken by NOMAD Ventures Limited (company number 05414112). Records from that time are now looked after by us under this notice.
Contact us about your data: email adventure@nomadseakayaking.co.uk or call 01473 375 026. Our postal address is shown at the bottom of every page of this website (click "Address").
2. The information we collect
Information you give us
- Contact and identity details: your name, email address, phone number and, for orders, billing and delivery address.
- Booking details: the courses, events, hire, products, memberships or vouchers you book or buy, and the participants you book for.
- Safety and suitability information: emergency contact details, swimming ability, experience, fitness, height, weight, mobility, dietary requirements, and any medical conditions, medication, allergies or disabilities you tell us about.
- Payment records: what you paid, when and how. Card payments are handled by our payment provider, Stripe. We never see or store your full card details.
- Messages: emails, website enquiry forms, live chat conversations, call bookings (through Calendly), notes we make of phone calls, reviews and complaints.
- Membership details: your membership number, plan and signed membership contract, if you are a member.
- Marketing choices: whether you have agreed to receive our email updates.
- Photographs and video taken during events (see our Terms and Conditions, section 39).
Information collected when you use our website
- Essential website data: information needed to keep you logged in, keep your basket and keep the site secure (see section 10, Cookies).
- Analytics data (only if you click Accept): how you found us, which pages you visit and roughly where you are, through Google Analytics. This does not tell us who you are.
- Technical data: like any website, our hosting provider's servers record basic technical details such as your IP address and browser type, for security and to fix problems.
3. How we use your information, and our legal reasons
Data protection law says we must have a lawful reason ("lawful basis") for each use of your information. Ours are:
| What we use it for | Our lawful basis |
|---|---|
| Taking and managing your booking or order, taking payment, sending joining instructions, weather updates and changes | Contract: we need it to provide what you have booked or bought |
| Keeping you and other participants safe, deciding whether an activity is suitable for you, and dealing with emergencies | Contract and legitimate interests (running safe activities). For health information, see section 4 |
| Keeping financial and tax records | Legal obligation |
| Answering enquiries, live chat messages and call requests | Legitimate interests (helping people who contact us), or steps you ask us to take before a booking |
| Handling complaints, accidents, insurance and legal claims | Legitimate interests and legal obligation |
| Sending our email updates and offers | Your consent. You can unsubscribe at any time using the link in every email |
| Using Google Analytics and live chat on our website | Your consent, given through our cookie banner. You can change your mind at any time using "Cookie settings" at the bottom of every page |
| Keeping the website secure and working | Legitimate interests |
4. Health and medical information
Information about your health is "special category" data and gets extra protection. We only ask for it because sea kayaking and outdoor activities carry real risks, and we need it to keep you safe.
- We use it only to judge whether an activity is suitable, to plan safely, and to help in an emergency.
- We rely on your explicit consent, which you give when you provide the information. In an emergency we may also share it with medical or rescue services to protect your life (vital interests).
- Only the people who lead or organise your event can see it.
- If you do not give us information we need for safety, we may not be able to let you take part (see Terms and Conditions, sections 18 and 19).
- We delete your health, medical and fitness details, including any notes about them, on the 31st day after your event, unless there has been an accident, incident or complaint. You will be asked for up-to-date information each time you book.
5. Who we share your information with
We never sell your personal information. We only share it with trusted providers who help us run the business, and only what they need:
| Who | Why |
|---|---|
| Stripe | Processing card payments |
| Key Element / City Racks | Hosting, maintaining and supporting our website and email |
| Algolia | Powering the search box on our website |
| Flare | Reporting website errors so they can be fixed (an error report can sometimes include details of the page you were using) |
| Campaign Monitor | Sending our email updates, if you have signed up |
| Calendly | Booking free phone consultations, if you use it |
| Tidio | Running our live chat, only if you click Accept |
| Google (Analytics and Tag Manager) | Website visitor statistics, only if you click Accept |
| Our accountant, HMRC and insurers | Accounts, tax and insurance |
| Emergency, medical and rescue services | Only in an emergency |
| Police, courts or regulators | Only if the law requires us to |
6. Information sent outside the UK
Some of the providers above (for example Google, Stripe, Algolia, Calendly, Tidio and Campaign Monitor) may store or access data outside the UK, including in the USA and the European Union. Where this happens, we rely on the protections allowed by UK law, such as UK "adequacy" decisions, the UK Extension to the EU-US Data Privacy Framework, or approved contract terms (the UK International Data Transfer Agreement or Addendum).
7. How we keep your information safe
We limit who can see your information, use password-protected systems, use secure (https) connections on our website, and keep any backups encrypted. No system is completely secure, but we take reasonable steps to protect your data.
8. How long we keep your information
| Information | How long we keep it |
|---|---|
| Booking, order, payment and accounting records | 6 years after the end of the tax year they relate to (required for tax purposes) |
| Health, medical, fitness and emergency contact details | Deleted on the 31st day after your event has finished, including any notes about your health. If there has been an accident, incident or complaint, we keep it until the matter is fully closed. We will ask you for up-to-date information each time you book. |
| Your customer account | Until you ask us to close it, or 3 years after your last booking |
| Enquiries, live chat conversations and notes of phone calls | Up to 2 years |
| Waiting list entries | Until the event date has passed, or you ask to be removed |
| Email update subscription | Until you unsubscribe |
| Accident and incident records | As long as needed for any insurance or legal claim |
9. Your rights
You have the right to:
- Ask for a copy of the personal information we hold about you. This is free.
- Ask us to correct anything that is wrong or incomplete.
- Ask us to delete your information, where we no longer need to keep it.
- Ask us to limit how we use it, or object to us using it.
- Ask us to send your information to you or another organisation in a common format.
- Withdraw your consent at any time (for example, unsubscribe from emails or change your cookie settings). This does not affect anything we did before.
To use any of these rights, email adventure@nomadseakayaking.co.uk. We will reply within one month. We may need to check your identity first.
Complaints: if you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
10. Cookies
Cookies are small files that a website saves in your browser. Similar technology called "local storage" works in the same way. We use both.
When you first visit our website, we ask for your permission. Only essential cookies are used unless you click Accept. If you click Reject, no analytics or live chat cookies are set. You can change your mind at any time by clicking "Cookie settings" at the bottom of any page.
Essential (always on)
These are needed for the website to work and cannot be switched off.
| Name | Provider | What it does | How long |
|---|---|---|---|
| nomad_sea_kayaking_session | NOMAD | Keeps you logged in and remembers your basket as you move between pages | 2 hours after your last activity |
| XSRF-TOKEN | NOMAD | Security: protects forms against fake requests | 2 hours |
| nomad_cookie_consent (local storage) | NOMAD | Remembers whether you clicked Accept or Reject, so we don't keep asking | Until you clear your browser data |
| algoliasearch-client-js (local storage) | Algolia | Makes the website search box faster | Until you clear your browser data |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention, which may be set when you pay by card | Up to 1 year |
Analytics (only if you click Accept)
| Name | Provider | What it does | How long |
|---|---|---|---|
| _ga | Google Analytics | Counts visitors and tells us how people use the website, without identifying you | 2 years |
| _ga_V2P8L8YXL8 | Google Analytics | Keeps track of your visit | 2 years |
Live chat (only if you click Accept)
| Name | Provider | What it does | How long |
|---|---|---|---|
| tidio_state_... (local storage) | Tidio | Runs our live chat and remembers your conversation | Until you clear your browser data |
Other websites: links to other sites (such as Facebook, Instagram, YouTube or Calendly) are not covered by this notice. Those sites have their own privacy and cookie notices.
You can also block or delete cookies in your browser settings. To learn more, visit ico.org.uk/for-the-public/online/cookies.
11. Children
Our activities are for adults aged 18 and over. We do not knowingly collect information about anyone under 18.
12. Changes to this notice
We may update this notice from time to time. The latest version will always be on this page, with the date it took effect shown at the top.