GDPR Compliance

Our GDPR Commitment

Timeless Journeys is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our responsibilities regarding your personal data seriously and have implemented appropriate measures to ensure compliance.

Data Controller

Timeless Journeys is the data controller for the personal information we collect and process. Our contact details are:

Timeless Journeys
42 Colmore Row
Birmingham, B3 2BS
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you provide explicit consent for us to process your personal data for specific purposes
• Contract: When processing is necessary for the performance of a contract with you (e.g., delivering our programmes)
• Legal Obligation: When we need to comply with legal requirements
• Legitimate Interests: When processing is necessary for our legitimate business interests, provided these do not override your rights

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you.

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain situations.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and transmit it to another controller.

Right to Object

You have the right to object to our processing of your personal data in certain circumstances.

Right to Withdraw Consent

Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of your rights, please contact us at [email protected]. We will respond to your request within one month of receipt.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Programme booking and delivery information: for the duration of the programme plus 6 years for legal and accounting purposes
• Email correspondence: for 2 years unless otherwise required by law
• Website analytics data: for 26 months

Children's Data

As our services involve children, we take extra care with children's personal data. We only process children's data with verified parental consent and limit collection to what is necessary for programme delivery.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Staff training on data protection
• Secure data backup and recovery procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

International Transfers

We do not transfer personal data outside the United Kingdom. Should this change, we will ensure appropriate safeguards are in place and inform you accordingly.

Automated Decision-Making

We do not use automated decision-making or profiling in relation to your personal data.

Complaints

If you have concerns about how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.timeless-journeys.com

Updates to This Page

We may update this GDPR compliance information from time to time. The current version is dated May 26, 2026.