Terra Nova CollectivePrivacy policy
Last updated: [DATE]
Who we are
[BUSINESS NAME], trading as Terra Nova Collective, is responsible for your personal information (the “controller”) under UK data protection law. Our address is [ADDRESS]. Contact us about privacy at hello@exploreterranova.com.
What we collect
When you log in or buy an itinerary: your email address, which itineraries you’ve bought, when, and how much you paid. We also store a reference to your Stripe payment.
To keep you logged in: we store secure session and login-link records. These are stored in scrambled (hashed) form, so the codes themselves can’t be read from our database.
When you pay: Stripe collects your payment details. We never see or store your full card number.
When you submit an itinerary: the details you enter in the form, including your email address and any trip leader contact details you provide. If you email us photos, we keep those emails and photos.
When you visit the website: our hosting provider processes technical information such as your IP address, browser type and the pages you request. This is used to deliver the website and protect it from abuse.
We do not use analytics or advertising tracking.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Give you access to itineraries you’ve bought, log you in, and send login emails | Performing our contract with you |
| Keep records of sales | Legal obligation (tax and accounting) |
| Protect the website and prevent misuse, such as limiting login emails | Our legitimate interests in running a secure service |
| Review, edit and publish itinerary submissions, and contact you about them | Our legitimate interests, and our agreement with you as a contributor |
| Reply to your emails | Our legitimate interests in responding to you |
Who we share it with
We use these service providers to run the website. They process your information on our behalf and only for these purposes:
- Stripe: payments. Stripe is also responsible for some payment data in its own right; see Stripe’s privacy policy.
- Cloudflare: website hosting, our database of accounts and purchases, and photo storage.
- Resend: sending login emails.
- Web3Forms: receiving itinerary submission forms.
- Google Fonts: delivers the website’s fonts. Your browser connects to Google to load them, which shares your IP address with Google.
- Datawrapper: shows the interactive world map on some pages.
Some of these providers process data outside the UK, including in the United States. Where they do, they protect it using safeguards recognised under UK law, such as the UK International Data Transfer Addendum or the UK-US data bridge.
We never sell your personal information.
How long we keep it
- Purchase records: 6 years after the end of the financial year of the purchase, as required for tax purposes.
- Your account email: for as long as you have purchases with us, so you can keep accessing them.
- Login links: deleted within a day of expiring. Logged-in sessions expire after 60 days.
- Itinerary submissions: for as long as the itinerary is published, or up to 12 months if we don’t publish it.
Cookies
We use two cookies, both needed for logging in:
- tn_session keeps you logged in (lasts up to 60 days).
- tn_li lets pages show “My itineraries” instead of “Log in” when you’re logged in (same lifetime).
Because these are strictly necessary for a service you’ve asked for, we don’t need your consent for them. We don’t use any analytics or advertising cookies. Stripe sets its own cookies on its checkout page to process payments securely and prevent fraud.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal information
- correct information that’s wrong
- delete your information (we may need to keep purchase records for tax reasons)
- restrict or object to how we use it
- give you your information in a portable format
Email hello@exploreterranova.com to make a request. We’ll respond within one month.
If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We’d appreciate the chance to put things right first.
Changes
We’ll update this page if we change how we use your information.