PRIVACY POLICY

Revel X Limited (“we”, “us”, “our”), trading as Revel Tours, operates revelstag.com and reveltours.com. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites, make a booking, or interact with us in any way.

We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it.

Information you provide to us:

• Identity Data: full name, title, date of birth, gender
• Contact Data: email address, telephone numbers, postal address
• Booking Data: tour preferences, dietary requirements, medical conditions relevant to travel, passport details, emergency contact information
• Financial Data: payment card details, billing address (processed securely through our payment providers)
• Group Data: information about other travellers in your group, including children and young people
• Communication Data: your correspondence with us via email, phone, WhatsApp or our websites

Information we collect automatically:

• Technical Data: IP address, browser type and version, time zone setting, operating system
• Usage Data: information about how you use our websites, including pages visited and links clicked
• Cookie Data: information collected through cookies and similar technologies

Information from third parties:

• Information from schools, clubs, or organisations booking on behalf of groups
• Information from accommodation providers, transport companies, and other service suppliers
• Information from social media platforms if you interact with us through these channels

The Revel Tours & Clubhouse app (available on iOS and Android) collects additional account data (name and email at login, stored securely via EU-based infrastructure and used solely for authentication) and requests device permissions — camera (QR check-in), photos, location (used exclusively for auto-checkout) and push notifications. We do not use your data for advertising, do not track you across third-party apps or websites, and do not sell your data to third parties.

To provide our services:

• Processing and managing your festival or tour booking
• Arranging accommodation, transport, activities, and other tour services
• Communicating with you about your booking (confirmations, updates, changes)
• Providing on-tour support and assistance
• Processing payments and refunds

To meet legal and regulatory requirements:

• Complying with the Package Travel and Linked Travel Arrangements Regulations 2018
• Meeting safeguarding requirements for tours involving children
• Complying with financial regulations and anti-money laundering requirements
• Responding to legal requests from authorities

For business purposes:

• Improving our services and developing new festival and tour offerings
• Sending you marketing communications (with your consent)
• Conducting customer satisfaction surveys
• Analysing website usage to improve user experience
• Protecting against fraud and ensuring the security of our systems

We process your personal data on the following legal grounds:

• Contract: processing necessary to fulfil our contract with you (your booking)
• Legal Obligation: processing necessary to comply with legal requirements
• Legitimate Interests: processing necessary for our legitimate business interests, such as improving our services and marketing (where this doesn't override your rights)
• Consent: where you have given specific consent for marketing communications or other optional processing
• Vital Interests: in emergency situations to protect someone's life or health

We may share your personal information with service providers (accommodation providers, transport companies, activity and excursion providers, catering services, local tour guides and representatives), business partners (payment processors, insurance providers, IT service providers, and marketing platforms with your consent) and regulatory or legal bodies (industry bodies, government authorities when required by law, and courts and legal advisors in case of disputes).

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

As we organise tours to destinations outside the UK, your personal data may be transferred to and processed in countries outside the UK and European Economic Area (EEA).

When we transfer your data internationally, we ensure appropriate safeguards are in place, including transferring to countries with adequate data protection laws recognised by the UK, using Standard Contractual Clauses approved by the UK Government, and ensuring transfers are necessary for the performance of your tour contract.

Please contact us if you would like more information about the specific safeguards applied to your data.

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, accidental loss or damage, and unlawful processing. These measures include:

• Encryption of data in transit and at rest
• Secure payment processing through PCI-DSS compliant providers
• Regular security assessments and updates
• Staff training on data protection
• Access controls limiting who can view personal data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are:

• Booking records: 7 years after the tour completion (for legal and accounting purposes)
• Marketing data: until you withdraw consent or 3 years of inactivity
• Enquiry data (no booking): 2 years

After the retention period, your data will be securely deleted or anonymised.

Under data protection law, you have the following rights:

• Right of Access: request a copy of the personal data we hold about you
• Right to Rectification: request correction of inaccurate or incomplete data
• Right to Erasure: request deletion of your data in certain circumstances
• Right to Restrict Processing: request limitation of how we use your data
• Right to Data Portability: request transfer of your data to another organisation
• Right to Object: object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at hello@reveltours.com. We will respond to your request within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly. Visit ico.org.uk for more information.

Many of our festivals and tours involve children and young people travelling with schools or clubs. We take extra care to protect the privacy of minors:

• We only collect children's data that is necessary for the booking and their safety
• We require consent from a parent, guardian, or responsible adult (such as a teacher or group leader)
• We do not use children's data for marketing purposes
• We have enhanced safeguarding procedures in place

Cookies are small files a website stores in your browser; local storage is a similar store. On revelstag.com we use them in three groups. Only the essential group is on by default: analytics and marketing stay off, and their tools do not load at all, until you say yes in the cookie banner.

Essential (always on; the site needs them to work as you asked):

• rs_consent: remembers your cookie choice. 6 months.
• rf_origin, rf_country and rf_origin_chosen: remember where you are travelling from, so prices and wording fit your trip. 30 days, or 90 days once you pick a place yourself.
• Cloudflare Turnstile: the security check on our forms, which tells people from automated spam. Cloudflare may set its own short-lived cookies or browser storage while the check runs.
• revel-stag:weekend-picks (local storage): the activities you add to your weekend on a city page, so they are still there when you price the trip. Kept until you remove them or clear your browser.

Analytics (only if you allow them):

• Our own visit statistics: the Revel Tours customer system (served from login.reveltours.com) sets _fv, a random visitor ID kept for 12 months. It records the pages you view, the website that sent you, your screen size and any campaign tags in the link you followed.
• _fref: if you arrive through a friend's referral link, the same system keeps the referral code for 12 months so the right person is credited. (If you don't allow analytics, the code is still sent with your enquiry from the link itself, without a cookie.)

Marketing (only if you allow them):

• Meta pixel (Meta Platforms, for Facebook and Instagram): _fbp, kept for 90 days, and _fbc, kept for 90 days when you arrive from a Meta ad. It tells Meta which pages you view and when you send an enquiry or ask for a price, so we can measure our adverts and show them to relevant people.
• Meta Conversions API: when you send an enquiry or ask for a price, our server also tells Meta, so the result is counted even if your browser blocks the pixel. Your email address, phone number and name are scrambled (hashed) before they are sent, along with your IP address, browser type and the _fbp/_fbc values. Meta counts the browser and server reports as one event. Meta's privacy policy: facebook.com/privacy/policy.
• Ad click references: if you arrive from an advert, the click reference in the link (gclid, gbraid, wbraid or fbclid) and the campaign tags are kept in your browser's local storage for up to 90 days and sent with your enquiry or quote request, so we know which advert it came from. We also link the pages you viewed to the enquiry you sent, so our team can see what you looked at.

Whatever you choose: when you send an enquiry or ask for a price, we record with it the page you arrived on, the website that sent you, any campaign tags in that link (utm_ tags) and any referral code. This uses no cookies and stores nothing on your device; it helps us handle your enquiry and see which of our campaigns work (legitimate interests). Without marketing consent the ad click references above are left out.

How long we keep it: the cookie lifetimes are given above. Visit statistics and anything recorded with an enquiry are kept as set out under Data Retention. Meta and Google keep what they receive under their own policies.

Changing your mind: use “Cookie settings” at the bottom of any page to turn analytics or marketing on or off at any time. Turning a group off stops its tools and deletes the cookies we set for it from this site. You can also block or delete cookies in your browser settings; the site will still work, but the cookie banner will ask again.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the updated policy on our websites, updating the “Last updated” date on this page, and emailing you if you are an existing customer (for material changes).

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Revel Tours (Revel X Limited), International House, 10 Churchill Way, Cardiff, CF10 2HE, United Kingdom
• Email: hello@reveltours.com
• Phone: +44 (0) 2920 00 27 74