Privacy Policy

Who we are

Gene17 Ltd is a whitewater kayaking company registered in England. Our registered office is 20 Ivybridge, Tavistock Road, Weston-super-Mare BS22 6LP, United Kingdom. When we refer to “Gene17”, “we”, “us” or “our” in this policy, we mean Gene17 Ltd.

Data controller: Gene17 Ltd is the data controller responsible for your personal data under the UK GDPR and the Data Protection Act 2018.

For any data protection queries, contact us at info@gene17kayaking.com.

What data we collect

We collect personal data when you interact with our website and services:

• Booking form: Full name, email address, phone number, emergency contact details (name, phone number and relationship of the person you nominate), paddling experience level, favourite river, and any additional notes you provide.
• Payment: When you pay through Stripe, your payment card details are processed directly by Stripe. We never see or store your full card number. We receive your name, email, amount paid, and a transaction reference.
• Waitlist and interest forms: Email address and name.
• Contact form: Name, email address, and your message.
• Automatically collected: When you visit our website, Vercel (our hosting provider) may collect standard web server logs including IP address, browser type, and pages visited. We use privacy-friendly, cookie-free analytics — Vercel Web Analytics and Plausible Analytics — which are fully anonymous and do not track you across sites. If you accept analytics cookies, we additionally use Google Analytics to understand how visitors use the site (see “Cookies” below). We do not use advertising cookies or cross-site trackers.

Why we collect it

We use your personal data for the following purposes:

• To process your booking: Confirming your place, sending trip information, managing group logistics, and contacting you about your trip (contractual necessity).
• Emergency contacts: Used only in the event of an emergency during a trip or course (vital interests).
• To take payment: Processing deposits and balances through Stripe (contractual necessity).
• To respond to enquiries: Replying to messages sent via our contact form (legitimate interest).
• To notify you: If you join a waitlist or register interest, we will contact you when spaces become available (consent).

Who processes your data

We use the following third-party services to operate our website and process bookings:

• Stripe (payments) — processes your card details securely; we never see or store your card number. Stripe Privacy Policy
• Neon (booking database) — stores your booking record and the details you submit after payment (contact, emergency contact and paddling experience) in a private database accessible only to Gene17. Neon Privacy Policy
• Resend (transactional email) — delivers booking confirmations and our notification emails. Resend Privacy Policy
• Sanity (content management) — stores our course and trip content, live availability, and waitlist/interest registrations. Sanity Privacy Policy
• Vercel (website hosting) — serves our website and may process server logs. Vercel Privacy Policy
• Google (analytics, only with your consent) — Google Analytics measures how visitors use the site: pages visited, approximate location (country/city level), device and browser type. It runs only if you accept analytics cookies. Google Privacy Policy

We do not sell, rent, or share your personal data with any other third parties for marketing purposes.

Cookies

We use two kinds of cookies:

• Essential cookies — required for the site to function, such as Stripe’s payment processing cookies during checkout. These are always active and do not require consent.
• Analytics cookies (optional) — if you choose “Accept” on our cookie banner, Google Analytics sets cookies (_ga and _ga_*, lasting up to 13 months) to help us understand how the site is used. The legal basis is your consent. If you decline — or never answer the banner — Google Analytics does not load at all.

You can change your mind at any time via the Cookie Settings link in the footer of every page — withdrawing consent removes the Google Analytics cookies and stops further measurement. Our other analytics (Vercel Web Analytics and Plausible) are fully cookieless, anonymous, and do not track you across sites. We do not use advertising cookies.

Marketing

We will only send you marketing emails (newsletters, new trip announcements) where you have explicitly opted in. We will not add your booking email to any marketing list without your consent. You can withdraw consent at any time by emailing info@gene17kayaking.com.

How long we keep your data

• Booking records: Retained for 6 years after your trip for accounting and legal purposes.
• Emergency contacts: Deleted within 30 days of the trip ending.
• Contact form messages: Retained for up to 12 months, then deleted.
• Waitlist registrations: Retained until you are notified and book, or until you ask to be removed.
• Payment records: Retained by Stripe according to their data retention policy.
• Google Analytics data: Retained for 14 months, then automatically deleted.

Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Delete your personal data (where there is no legal reason for us to keep it)
• Object to processing based on legitimate interest
• Withdraw consent at any time (for waitlist notifications)
• Data portability — receive your data in a structured, machine-readable format
• Complain to the Information Commissioner's Office (ICO) if you believe your data rights have been breached: ico.org.uk

To exercise any of these rights, email us at info@gene17kayaking.com. We will respond within 30 days.

International transfers

Some of our third-party processors (Stripe, Vercel, Sanity, Neon, Resend, Google) may transfer data outside the UK. These transfers are protected by appropriate safeguards including Standard Contractual Clauses and adequacy decisions (Google participates in the EU–US Data Privacy Framework and its UK Extension).

Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “last updated” date.