Privacy Policy

1. Who We Are

XCape238 is operated by:

Legal name: XCape238
Trading name: XCape238
Email: xcapeevents238@gmail.com
Website: xcape238.co.uk

For the purposes of applicable data protection legislation, XCape238 is the controller of personal information where it determines how and why that information is processed.

2. Personal Information We May Collect

The personal information we collect depends on how you interact with XCape238.

We may collect the following categories of information.

2.1 Identity information

This may include:

• full name;
• title;
• date of birth or age where required;
• gender where relevant to a travel booking or requested by a travel supplier;
• booking reference; and
• other information required to identify travellers.

2.2 Contact information

This may include:

• email address;
• telephone number;
• emergency contact information where required; and
• other contact information voluntarily supplied to us.

2.3 Booking information

When you make or participate in a booking, we may collect information including:

• package selected;
• accommodation selection;
• room occupancy;
• names of other travellers;
• flight requirements;
• departure airport;
• travel dates;
• optional services or upgrades;
• payment-plan information;
• booking status;
• booking amendments;
• cancellations;
• correspondence relating to the booking; and
• other information reasonably required to administer your booking.

2.4 Passport and travel information

Where necessary to arrange flights or other travel services, we may collect information such as:

• name as shown on your passport;
• nationality;
• date of birth;
• passport details where required;
• passport expiry information;
• travel documentation information; and
• information required by airlines, immigration authorities or other travel providers.

We will only collect passport or similar travel-document information where reasonably necessary for the relevant travel arrangements.

2.5 Payment and transaction information

We may collect information concerning:

• amounts paid;
• deposit payments;
• payment dates;
• outstanding balances;
• payment-plan status;
• refunds;
• transaction references; and
• payment status.

Where payments are processed by a third-party payment provider, your full payment-card information may be collected and processed directly by that provider rather than XCape238.

We do not intend to store full payment-card details ourselves unless this is necessary and appropriate for the payment system being used.

2.6 Communications

We may retain communications you send to us, including:

• emails;
• website enquiries;
• booking enquiries;
• complaints;
• cancellation requests;
• customer-service correspondence;
• social-media messages sent directly to us; and
• other communications relating to your booking or XCape238.

2.7 Marketing information

Where applicable, we may collect:

• whether you have requested marketing communications;
• marketing preferences;
• records of consent;
• records of unsubscribing or objecting to marketing; and
• information about engagement with our communications where our systems provide this functionality.

2.8 Website and technical information

When you use our website, certain technical information may be collected automatically.

Depending on the technologies used on the website, this may include:

• IP address;
• browser type;
• device type;
• operating system;
• pages visited;
• referring website;
• approximate location derived from technical information;
• date and time of visits;
• website interactions;
• cookie identifiers; and
• similar technical information.

Further information about cookies is provided below.

3. Information About Other Travellers

The Lead Booker may provide personal information about other people included in their booking.

If you provide personal information about another person, you should ensure that you are authorised to provide that information and that the person understands that their information will be used for the purposes of administering and providing the booking.

The Lead Booker should make this Privacy Policy available to everyone included in their booking.

Where appropriate, we may communicate directly with individual travellers concerning their personal information or travel arrangements.

4. How We Collect Personal Information

We may collect personal information:

• directly from you;
• when you make a booking;
• when another person includes you in their booking;
• through our website;
• when you contact us by email;
• through booking or payment systems;
• when you communicate with us through social media;
• when you subscribe to marketing communications;
• when you attend XCape238;
• from airlines, hotels and other suppliers involved in your booking;
• from payment providers;
• from technical systems used to operate our website; and
• from other lawful sources where appropriate.

Where we receive personal information about you from someone other than you, we will handle it in accordance with applicable data protection law.

5. How We Use Your Personal Information

We may use personal information for the following purposes.

5.1 Managing bookings

We use information to:

• process booking requests;
• confirm bookings;
• administer deposits;
• manage payment plans;
• process balances;
• make accommodation arrangements;
• arrange flights where included;
• arrange transfers or other travel services where included;
• process amendments;
• manage cancellations;
• issue booking information;
• communicate important travel information; and
• provide the services included in your booking.

5.2 Providing XCape238

We may process information to:

• administer event access;
• operate guest lists;
• manage accommodation allocations;
• coordinate travel arrangements;
• communicate programme or operational changes;
• provide customer support;
• deal with incidents; and
• deliver the XCape238 experience.

5.3 Customer service

We may process information to:

• respond to enquiries;
• resolve problems;
• investigate complaints;
• process refund requests;
• respond to cancellation requests; and
• maintain records of communications.

5.4 Safety and security

We may process information where reasonably necessary to:

• protect guests;
• protect staff;
• prevent fraud;
• protect our website and systems;
• investigate security incidents;
• manage serious behavioural or safety incidents; and
• establish, exercise or defend legal claims.

5.5 Legal and regulatory obligations

We may process and disclose information where necessary to comply with applicable laws and lawful requirements, including requirements relating to:

• taxation;
• accounting;
• travel;
• aviation;
• immigration;
• consumer protection;
• data protection;
• fraud prevention; and
• requests from competent public authorities where legally required.

5.6 Improving our services

We may use appropriate information to understand how customers interact with XCape238, improve our website, develop our services and improve the customer experience.

Where cookies or similar technologies require consent, they will be used only in accordance with applicable consent requirements.

6. Our Lawful Bases For Processing

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we may rely upon the following bases.

Contract

We process information where necessary to take steps at your request before entering into a contract or to perform our contract with you.

For example, we need booking and passenger information to administer your XCape238 booking and arrange services included in your package.

Legal obligation

We may process information where necessary to comply with a legal obligation applying to us.

Legitimate interests

We may process information where necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating and improving XCape238;
• providing customer support;
• protecting our business;
• preventing fraud;
• maintaining appropriate business records;
• securing our website and systems;
• understanding how our services are used; and
• establishing, exercising or defending legal claims.

Where required, we will consider and balance our interests against your privacy rights before relying upon legitimate interests.

Consent

Where required, we may process information on the basis of your consent.

Examples may include certain marketing activities and certain uses of cookies or similar technologies.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Special Category Information

Certain personal information receives additional protection under data protection law.

For example, information concerning a person's health can constitute special category personal data.

We do not seek to collect special category information unless it is necessary and appropriate.

You may choose to tell us about a disability, medical condition, dietary requirement or accessibility requirement because it is relevant to your travel or XCape238 experience.

Where we need to process special category information, we will identify an appropriate lawful basis and an applicable condition for processing that information and obtain explicit consent where required.

Please do not provide medical or other sensitive information that we do not reasonably need.

8. Who We May Share Information With

We may share personal information where reasonably necessary with organisations involved in providing or administering your booking.

Depending on your booking, these may include:

• airlines;
• hotels and accommodation providers;
• transfer providers;
• transport companies;
• event venues;
• event and operational suppliers;
• booking technology providers;
• payment processors;
• IT and website service providers;
• communications providers;
• professional advisers;
• accountants;
• insurers where applicable;
• fraud-prevention and security providers; and
• public authorities where disclosure is legally required.

We only disclose information that is reasonably necessary for the relevant purpose.

Some organisations, such as airlines and hotels, may process your information as independent controllers under their own privacy policies.

9. Airlines and Travel Providers

Where flights or other travel services form part of your booking, relevant passenger information may need to be provided to the airline or travel provider.

This may include information such as:

• passenger name;
• date of birth;
• contact information;
• travel dates;
• booking information;
• passport or travel-document information where required; and
• other information required to provide the relevant travel service or comply with applicable law.

Where easyJet or another airline operates your flight, that airline may process your personal information under its own privacy policy and applicable legal obligations.

XCape238 is not responsible for another independent controller's privacy practices, although we will take reasonable steps to use appropriate suppliers.

10. Hotels and Accommodation Providers

Where accommodation forms part of your package, we may provide the accommodation provider with information reasonably necessary to provide your stay.

This may include:

• guest names;
• dates of stay;
• room allocation information;
• booking reference;
• occupancy information;
• accessibility requirements where relevant; and
• other information reasonably necessary for the accommodation provider to fulfil the booking.

Accommodation providers may have their own legal obligations concerning guest information.

11. Payment Providers

Payments may be processed using third-party payment services.

Where a third-party payment provider is used, that provider may collect payment-card and transaction information directly.

The payment provider's own privacy terms may apply to its processing.

XCape238 may receive information confirming matters such as:

• whether a payment was successful;
• amount paid;
• payment date;
• transaction reference;
• refund information; and
• limited payment-method information.

13. Photography and Filming

Photography and filming may take place during XCape238.

Images and recordings may be used for purposes including:

• documenting the event;
• security;
• event operations;
• XCape238 promotional materials;
• the XCape238 website; and
• XCape238 social-media and marketing content.

We will process identifiable images and recordings in accordance with applicable data protection law.

Where consent is required for a particular use, we will obtain the necessary consent.

If you have a particular concern regarding photography or filming, please contact us.

14. International Transfers

XCape238 takes place in Cape Verde and may involve suppliers or service providers located outside the United Kingdom.

Providing your booking may therefore require personal information to be transferred or made accessible outside the UK.

Where UK data protection law treats such a transfer as a restricted international transfer, we will ensure that an appropriate lawful transfer mechanism is available.

Depending on the circumstances, this may include:

• applicable UK adequacy regulations;
• appropriate contractual or other safeguards recognised under UK data protection law; or
• another lawful transfer mechanism or exception where applicable.

Where required, additional safeguards will be implemented to protect personal information.

You may contact us for further information about safeguards applicable to relevant international transfers.

15. How Long We Keep Personal Information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, accounting, tax, contractual and regulatory requirements.

Different information may therefore be retained for different periods.

When determining an appropriate retention period, we consider factors including:

• why the information was collected;
• whether it remains necessary to administer your booking;
• applicable legal requirements;
• accounting and tax obligations;
• potential complaints or disputes;
• applicable limitation periods;
• fraud-prevention requirements;
• safety requirements; and
• whether information is required to establish, exercise or defend legal claims.

Information that is no longer required will be securely deleted, anonymised or otherwise disposed of as appropriate.

16. Security

We take reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• unauthorised disclosure; and
• destruction.

Access to personal information should be limited to people and service providers who reasonably require it for legitimate purposes.

No internet or electronic storage system can be guaranteed to be completely secure, but we take reasonable steps appropriate to the nature of the information we process.

17. Cookies and Similar Technologies

The XCape238 website may use cookies and similar storage or access technologies.

These technologies may be used for purposes such as:

• enabling essential website functions;
• maintaining website security;
• remembering preferences;
• supporting booking functionality;
• understanding website performance;
• measuring website usage; and
• marketing or advertising where applicable.

Strictly necessary technologies may be used where permitted without consent.

Where applicable law requires consent before using a non-essential cookie or similar technology, it will not be activated until the required choice has been made.

Where appropriate, the website will provide cookie controls allowing visitors to manage relevant preferences.

A separate Cookie Policy or cookie-management interface may provide more detailed information about the individual technologies used, their purposes, providers and duration.

18. Website Analytics

We may use website analytics tools to understand matters such as:

• how visitors find the website;
• which pages are visited;
• how visitors interact with the website;
• general website performance; and
• technical errors.

Where analytics technologies require consent, they will only be activated in accordance with applicable cookie and privacy requirements.

The specific analytics providers used by the website should be identified in the website's Cookie Policy or consent-management interface where required.

19. Third-Party Links

Our website may contain links to websites operated by other organisations.

Those websites have their own privacy practices and policies.

XCape238 is not responsible for the privacy practices of independent third-party websites.

We encourage you to read the relevant privacy information when visiting another website.

20. Social Media

XCape238 may operate accounts on social-media platforms.

If you interact with XCape238 through a social-media platform, the platform may process information about you independently in accordance with its own terms and privacy policy.

Information you choose to make publicly available on social media may be visible to other users.

Please consider the information you disclose publicly.

22. Exercising Your Rights

To exercise a data protection right, contact:

xcapeevents238@gmail.com

Please state clearly what you are requesting.

We may need to request reasonable information to confirm your identity before disclosing or changing personal information.

We will respond within the period required by applicable data protection law.

There is normally no charge for exercising your data protection rights, although the law permits fees or refusal in certain limited circumstances.

23. Complaints

If you have concerns about how XCape238 handles your personal information, please contact us first so that we have an opportunity to investigate your concern.

Contact:

xcapeevents238@gmail.com

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Information about making a data protection complaint is available from the ICO.

Your right to contact the ICO is not affected by contacting us first.

24. Children

XCape238 is an adults-only experience and our booking services are not intended to be used by children to make bookings.

We do not intentionally seek to collect personal information from children through the XCape238 booking process.

If we become aware that information relating to a child has been provided in circumstances where it is not required or appropriate, we will consider the appropriate steps to take in accordance with applicable law.

25. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect:

• changes to our services;
• changes to the way we process personal information;
• new suppliers or technologies;
• changes to applicable law; or
• regulatory guidance.

The latest version will be published on the XCape238 website with an updated revision date.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals where required.

26. Contact Us

For questions about this Privacy Policy, our use of personal information or your data protection rights, contact:

XCape238

Legal name: XCape238
Email: xcapeevents238@gmail.com
Website: xcape238.co.uk