GDPR Compliance

Last Updated: 1 September 2024

Our Commitment to GDPR

fjord-quest is committed to protecting the personal data of all individuals, including visitors from the European Economic Area (EEA) and the United Kingdom. We comply with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

This page explains how we fulfil our obligations under these regulations and outlines the rights available to you.

Data Controller

fjord-quest acts as the data controller for personal information collected through our website and services. This means we determine the purposes and means of processing your personal data.

Contact details:

fjord-quest
47 Heritage Lane
London, WC2R 1LA
United Kingdom

Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The legal bases we rely upon include:

Contract Performance

When you book a tour, we process your data to fulfil our contractual obligations. This includes processing your name, contact details, and payment information to provide the requested services.

Legitimate Interests

We may process data for our legitimate business interests, provided these do not override your fundamental rights. Examples include improving our services, preventing fraud, and maintaining website security.

Consent

Where required, we obtain your explicit consent before processing. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Legal Obligation

We process certain data to comply with legal requirements, such as maintaining financial records and responding to lawful requests from authorities.

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access

You may request a copy of the personal data we hold about you. We will provide this information free of charge within one month of receiving your request.

Right to Rectification

You may request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

Also known as the "right to be forgotten," you may request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed

Right to Restriction

You may request that we restrict processing of your data in certain circumstances, such as when you contest accuracy or have objected to processing.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently engage in such automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by a further two months, informing you of the reasons for any delay.

We may request verification of your identity to ensure we release data only to the rightful individual.

Data Protection Principles

In accordance with GDPR, we ensure that personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Stored only as long as necessary
• Protected with appropriate security measures

International Transfers

When we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by relevant authorities, or transfer to countries with adequacy decisions.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours. Where the breach is likely to result in a high risk to you, we will also notify you directly.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom

Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information periodically. Material changes will be communicated through our website.

Contact Our Data Protection Team

For any questions regarding data protection or to exercise your rights, please contact:

Data Protection Enquiries
fjord-quest
47 Heritage Lane
London, WC2R 1LA
United Kingdom

Email: [email protected]