Data Protection & Privacy Policy

Last reviewed: 06/08/2025

1. Who We Are

Underwhelming Adventures is a specialist outdoor instruction business providing climbing, bouldering, and snowboarding sessions with a focus on inclusivity and accessibility for individuals with Additional Support Needs (ASN). We are the Data Controller for all personal data we collect and process in connection with our services.

• Business name: Underwhelming Adventures
• Contact email: info@underwhelmingadventures.com
• Data Protection Lead: Mike Marcus

2. What Data We Collect

Clients and participants (depending on interaction):

• Name, date of birth, and contact details
• Emergency contact information
• Medical, behavioural, or access needs (where disclosed)
• Consent status and signatures (digital or written)
• Session attendance records
• Accident or incident reports (where applicable)

Parents or guardians (if participant is under 18):

• Name and contact details
• Consent for participation

3. Legal Basis for Processing

We process personal data only where a lawful basis applies under UK GDPR.

4. How We Use Your Data

Processing purpose	Legal basis
Booking and delivering instruction sessions	Contractual necessity
Managing medical and ASN needs	Explicit consent (special category)
Emergency contacts and incident response	Vital interests
Business communication and updates	Legitimate interests or consent
Data required by insurers or regulators	Legal obligation
Research or pilot projects (for example, Spoons)	Explicit consent

• To manage and deliver booked sessions safely and effectively
• To tailor instruction to individual needs and abilities
• To assess and respond to risk, emergencies, or incidents
• To maintain financial records and comply with legal duties

5. Sharing Your Data

• Session venues (for example, climbing walls or ski centres) where needed for access or safety
• Insurers, legal advisors, or emergency responders where applicable
• Booking platforms or payment processors (for example, Stripe or SumUp)
• Google Workspace and form platforms for secure data handling
• Safeguarding professionals or authorities if legally required

We do not sell or share data for marketing purposes.

6. Data Retention

Data type	Retention period
Session logs and attendance	7 years from last session, or until age 21 for minors
Emergency contact details	Deleted after session or last contact
Medical or access needs	Reviewed annually, deleted if no longer relevant
Incident reports	7 years or as required by law or insurer

Data may be stored longer if required for legal defence or audit purposes.

7. Security and Storage

• All digital records are stored in encrypted or access-controlled environments
• Paper records are not used
• Google Forms and Workspace are restricted to authorised personnel
• Staff and volunteers are trained in confidentiality and data handling

8. Your Rights

• Access your data
• Request correction of inaccurate data
• Request erasure (right to be forgotten)
• Restrict or object to processing
• Withdraw consent where consent is the legal basis
• Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise these rights, email info@underwhelmingadventures.com.

9. Children and Vulnerable Adults

For clients under 18 or lacking capacity, we seek parent or guardian consent and treat data with additional care. We only collect what is strictly necessary for safe participation.

10. Policy Updates

• We will update the effective date at the top
• Notify regular clients or participants where appropriate
• Make the updated policy available on our website or by request

11. Contact Us

Data Protection Lead
Underwhelming Adventures
Email: info@underwhelmingadventures.com