Fishies Tour - Privacy policy
PRIVACY & DATA USE NOTICE
How Fishies collects, uses, shares and protects personal information.
BENIDORM 2027
Trip start date: 30 March 2027
Version: 1 | October 2026
Effective date: 22 October 2026
Legal entity: What Happens On Tour Limited trading as Fishies Tour
Company number: 17487925
Registered office: 1 Des Roches Square, Witney, OX28 4BE
General enquiries: info@fishiestour.com | Booking enquiries: bookings@fishiestour.com
This Privacy & Data Use Notice explains how Fishies uses personal information in connection with bookings, tours, events, customer communications and related services. It is intended to meet the transparency requirements of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (“PECR”).
1. Who we are
What Happens On Tour Limited, trading as Fishies Tour (“Fishies”, “we”, “us”, “our”), is the controller of personal information described in this Notice except where another organisation independently determines how it uses your information.
Registered office: 1 Des Roches Square, Witney, OX28 4BE. Company number: 17487925.
Privacy contact: info@fishiestour.com. Please mark privacy requests “Privacy request”. Booking enquiries should be sent to bookings@fishiestour.com.
Privacy enquiries and requests should be directed to the privacy contact above.
2. Information we collect
Depending on your relationship with Fishies and the services you use, we may collect and process:
• identity information, including name, date of birth and age; passport information inspected at accommodation check-in and any identity-verification record genuinely required by law or for booking security. Fishies does not routinely keep a complete passport copy merely to check a room allocation; accommodation providers may have their own legal registration obligations.
• contact information, including email address, telephone number and address where provided;
• university, society, sports club, team or group information where relevant to a booking or event;
• booking information, including booking reference, package selections, optional extras, rooming preferences and event/activity choices;
• payment and transaction information, including payment status, refunds, provider references and bank details where needed for an alternative refund. Card payments, security checks and authorised collections are handled through secure payment providers; Fishies does not ordinarily retain complete card details, PINs or card security codes.
• travel and operational information, including accommodation allocation, arrival/departure information supplied to us, transfer information where applicable, and participation records;
• emergency contact information;
• dietary, allergy, accessibility, health or other special-requirement information that you choose or need to provide;
• communications with Fishies, including emails, messages, support requests, complaints and customer-service records;
• incident, welfare, conduct, lost-property and safety records where relevant;
• marketing preferences and records of consent, opt-out or unsubscribe requests;
• technical and online information generated when you use our websites, booking systems or digital services, such as IP address, device/browser information and security logs, where collected; and
• photographs, video or other event media where Fishies or an authorised provider records an event and the use is lawful.
3. How we obtain information
We obtain information directly from you at checkout, through booking updates and forms, when you contact us, and during the Trip. Checkout collects relevant medical, allergy, dietary and accessibility information so that Fishies can discuss suitability and arrange necessary support. Do not provide unrelated medical history. Sensitive information is collected with the separate consent or other lawful condition described in section 5.
Group leaders coordinate rooming before the Trip. Fishies and accommodation providers use traveller identity and passport checks at accommodation check-in to match guests to the agreed allocation and satisfy applicable registration requirements. A passport check does not itself authorise retention of a full passport copy or disclosure of health information to a group leader.
Fishies collects refundable resort damage deposits through Stripe. Refunds may be made to the original payment method through Stripe or by bank transfer where appropriate. The post-event refund-details form requests only information reasonably needed to identify the booking, verify the person entitled to repayment and complete the refund. New bank details are not required if the original payment method can be refunded. General event feedback is optional and is not a condition of refund. Any additional form provider will be identified with relevant privacy information. Never submit online-banking passwords, PINs or card security codes.
We may receive necessary booking, rooming, welfare, incident or payment information from a lead booker, group organiser, accommodation or activity supplier, booking/payment provider, or authorised security and welfare personnel. We record the source where relevant and distinguish reports or allegations from established facts.
If you provide another person’s information, give them this Notice and ensure you have a proper basis for sharing it. Where Fishies obtains information indirectly, we will provide the required privacy information to the affected person within the applicable time limit, normally within one month, at first communication or before first disclosure if earlier, unless a lawful exception applies. Group members and emergency contacts can access this Notice without accepting marketing.
4. Why we use personal information and our lawful bases
The following entries identify the principal Article 6 lawful basis for each purpose. Where the same information is used for a different purpose, that use must have its own applicable basis. Sensitive information and criminal-offence information also require the additional conditions in section 5.
Purpose: Administer a traveller’s booking, payments, refund, accommodation, extras and essential service messages.
Lawful basis: Contract: necessary to enter into or perform the contract with that traveller.
Purpose: Coordinate group rooming and communicate with group leaders or payers who are not the contracting traveller.
Lawful basis: Legitimate interests: administer the group booking and coordinate the requested services with minimum necessary disclosure.
Purpose: Meet specific package-travel, tax, accounting, regulatory or legally required reporting duties.
Lawful basis: Legal obligation: the particular duty relevant to the record or disclosure.
Purpose: Discuss and arrange requested health, allergy, dietary or accessibility support.
Lawful basis: Contract for the requested booking arrangements; legitimate interests for necessary support involving a non-contracting person. An additional Article 9 condition is required under section 5.
Purpose: Manage welfare, safety, suspected misconduct, fraud and proportionate incident disclosures.
Lawful basis: Legitimate interests: protect travellers, staff and others and investigate incidents; legal obligation where disclosure is required by law.
Purpose: Respond to an emergency threatening someone’s life.
Lawful basis: Vital interests where necessary to protect life; additional sensitive-data conditions apply under section 5.
Purpose: Handle service complaints and corrections.
Lawful basis: Contract for contractual service requests; legitimate interests for investigating and resolving disputes beyond immediate contract performance.
Purpose: Establish, exercise or defend legal claims and maintain relevant insurance evidence.
Lawful basis: Legitimate interests: protect legal rights and obtain insurance assistance; legal obligation where particular records or disclosures are legally required.
Purpose: Maintain and improve service operations and proportionate system/security logs.
Lawful basis: Legitimate interests: operate reliable, secure services and improve their performance.
Purpose: Send optional marketing emails, SMS or equivalent messages and tailor those messages using ordinary booking/interests data.
Lawful basis: Consent for the selected channels and explained use. Withdrawal and unsubscribe rights apply.
Purpose: Keep a minimal marketing suppression record following an opt-out.
Lawful basis: Legal obligation: respect applicable objections and electronic-marketing requirements.
Purpose: Use general event and crowd photographs for proportionate reporting and promotion.
Lawful basis: Legitimate interests, subject to assessment, notices and the rights described in section 15.
Purpose: Use deliberately posed individual promotional features or close-up promotional interviews.
Lawful basis: Separate consent for the stated use under section 15.
Purpose: Use non-essential cookies, advertising pixels or similar tracking requiring consent.
Lawful basis: Consent collected through the relevant cookie tool; essential technologies are explained in the Cookie Notice.
Where we rely on legitimate interests, we assess necessity and balance our interests against the individual’s rights and reasonable expectations. Our relevant interests are delivering safe events, preventing fraud, resolving disputes, protecting legal rights, improving services and documenting and promoting events in a proportionate way. We do not rely on legitimate interests as a substitute for consent where electronic-marketing or other law requires consent.
5. Special category information
Some information you provide may constitute special category personal data under the UK GDPR, for example health information or information that reveals a disability, allergy, medical requirement or, in some cases, religious belief through a dietary requirement.
For routine dietary, allergy, health and accessibility arrangements, Fishies uses the Article 6 basis in section 4 and asks for your separate explicit consent under Article 9 to collect and share the relevant sensitive information with the accommodation, activity, catering, transport or welfare providers who genuinely need it. The request identifies the information, purpose and relevant recipient categories and is separate from general booking acceptance and marketing choices. A group leader’s acceptance of booking terms is not a substitute for the affected traveller’s explicit consent. Where another Article 9 condition applies, Fishies identifies and documents it before use. Vital interests may apply in an emergency where the person is physically or legally incapable of consenting; the legal-claims condition may apply where necessary for legal claims.
You may withdraw explicit consent at any time by contacting info@fishiestour.com. This does not make earlier lawful processing unlawful. Fishies will stop consent-based use and explain any genuine effect on a requested arrangement, consider reasonable alternatives and adjustments, and identify any separate legal basis for information that must still be retained. Refusing or withdrawing consent does not automatically cancel the booking or remove consumer or equality rights.
Allegations, suspicions or records of criminal conduct are subject to additional protection under Article 10 UK GDPR. Before recording or sharing this information, Fishies will identify an Article 6 lawful basis and applicable authorisation under the Data Protection Act 2018, including a relevant Schedule 1 condition and an appropriate policy document where required. Reports will distinguish allegations from established facts. Disclosure to universities, clubs or other organisations is not automatic and is assessed separately for necessity, proportionality and a lawful basis.
6. Essential service communications
If you have an active booking or transaction with Fishies, we will use the contact details associated with that booking to send communications that are necessary or reasonably required to administer and perform the service. These are service communications and are not treated as optional marketing merely because they are sent by email, text message or another electronic channel.
Examples include booking confirmations, payment reminders, final balance notices, hotel and rooming information, event schedules, itinerary updates, operational changes, safety notices, customer-service messages and information required under the Package Travel Regulations.
You cannot opt out of essential service communications while we still need to send them to perform an active contract or comply with law. You can, however, opt out of direct marketing separately.
Operational WhatsApp or text messages will be limited to relevant service information. Where a group chat would reveal telephone numbers or profile information to other travellers, participation will be optional and a private alternative will be available for essential information. Health information and incident reports should be sent privately to authorised staff, not posted in traveller group chats.
7. Marketing by email, text and similar messages
Fishies sends marketing emails and SMS only where you have actively opted in through the relevant unticked checkbox. Marketing choices are optional and separate from acceptance of booking terms. Fishies uses these preferences for its own marketing; it does not sell your details or give other organisations permission to use them for their own marketing.
We may rely on your specific consent. Where we ask for consent, it will be freely given, specific, informed, unambiguous and separate from acceptance of the Booking Terms & Conditions. We will not use pre-ticked boxes as evidence of consent.
Our current booking process uses checkbox opt-in for marketing rather than relying on the customer soft opt-in. We record the consent given and respect withdrawals and unsubscribe requests.
The marketing channels covered by your opt-in will be stated beside the checkbox. You can change your preferences or unsubscribe at any time using the option in a message or by contacting info@fishiestour.com.
Opting out of marketing does not prevent Fishies from sending essential booking or service communications.
8. Profiling and audience segmentation
With your relevant marketing consent, Fishies may use ordinary information such as university, Fishies purchases, selected interests and engagement with communications to group and tailor marketing messages. Consent information will explain the relevant use. We do not use health, welfare, incident, criminal-allegation or refund bank-detail information to target marketing. Necessary operational grouping, such as allocating rooms or activity attendance, is administered separately under section 4.
Fishies does not intend to make decisions producing legal or similarly significant effects solely by automated means unless this is separately explained and a lawful basis is established.
9. Who we share information with
Fishies uses Easol to collect and administer bookings and Stripe or other identified payment providers for payment and refunds. Authorised staff receive access appropriate to their role. Platform or payment providers may process information on Fishies’ instructions or act as separate controllers for specified purposes such as payment security and legal compliance; their own notices explain those independent uses. Suppliers and group leaders do not receive unrestricted access to the complete booking record. Minimum necessary information may be shared with the following recipient categories for the relevant purposes in this Notice; this does not permit their independent marketing:
• booking, ticketing and customer-management platforms, including Easol where used;
• payment processors and financial service providers;
• hotels and other accommodation providers;
• event venues, activity providers, DJs/production providers or other suppliers where they need information to deliver a booked service;
• transport and transfer providers where transport forms part of the service;
• catering providers where dietary information is required;
• insurers, brokers and insolvency-protection providers;
• IT hosting, communications, CRM, analytics and security providers acting on our instructions;
• professional advisers, including accountants and lawyers;
• universities, students’ unions, sports clubs, societies, group organisers or other associated organisations where disclosure is necessary, proportionate and lawful in connection with a serious conduct, welfare or safeguarding matter;
• medical providers, emergency services, police, local authorities, consular services or security providers where necessary for welfare, safety, law enforcement or legal compliance; and
• regulators, courts or other public authorities where disclosure is required or permitted by law.
We disclose only information reasonably necessary for the relevant purpose, using appropriate secure channels. Where a provider processes information for Fishies, we require an appropriate processing agreement, access controls and data-handling safeguards. Independent controllers, including accommodation providers performing their own guest-registration duties, are responsible for their own lawful processing and privacy information.
Group leaders may receive the minimum booking, rooming or attendance information needed for their authorised role. Health information, incident details, personal contact details and payment information will not be shared with the whole group or team merely because travellers booked together. Suppliers and staff receive only information needed for their role.
Incident information shared with universities, clubs or societies is assessed individually. Disclosure is limited to what is necessary for a legitimate and lawful safety, welfare, conduct or legal purpose; an allegation is identified as an allegation. Group membership does not give a university or captain routine access to health records, passport details, bank details or disciplinary files.
10. Emergency contacts
We use emergency-contact names, relationship details and contact details for necessary serious welfare or safety communication, normally on the basis of legitimate interests in protecting the traveller and arranging support. Vital interests may apply in a life-threatening emergency. We do not market to emergency contacts merely because their details were supplied. Required privacy information is provided as described in section 3.
Providing an emergency contact does not give Fishies unrestricted permission to disclose all information about you. We will consider necessity, proportionality and the circumstances before sharing personal information with an emergency contact.
11. International data transfers
The Benidorm Trip requires Fishies to work with suppliers in Spain. Relevant information may therefore be processed in Spain or elsewhere in the European Economic Area where necessary to perform the booking.
Transfers to Spain and other EEA countries are made on the basis of applicable UK adequacy regulations where in force. Where we transfer personal information to a country that does not benefit from applicable UK adequacy regulations, we will use an appropriate transfer mechanism or other lawful safeguard where required, and information about relevant safeguards can be requested from the Privacy contact above.
12. How long we keep information
We keep personal information only for as long as necessary for the relevant purpose. The periods below guide deletion and review; an active dispute, claim or legal obligation can justify retaining the minimum relevant information for longer, with restricted access and documented review. Keeping a core booking or accounting record does not justify retaining every sensitive field or operational attachment with it.
Information: Core booking, contract and accounting transaction records
Retention and review: Normally up to six years after the end of the relevant contractual/accounting period, or longer where a legal obligation or active claim requires it. Unnecessary sensitive fields and passport copies are removed separately.
Information: Routine health, allergy, accessibility and dietary information
Retention and review: Delete or anonymise as soon as no longer needed, normally within 90 days after the Trip. This includes the live booking fields and operational copies, not only staff downloads. Minimum relevant incident/claim evidence may be retained separately with restricted access.
Information: Routine emergency-contact information
Retention and review: Normally delete within 90 days after the Trip unless still necessary for a documented incident, claim or legal obligation.
Information: Bank details collected for an alternative damage-deposit refund
Retention and review: Keep while the refund remains outstanding and necessary checks are completed. Normally delete or mask reusable account details within 90 days after the refund and any related dispute are resolved. Keep only necessary transaction/audit evidence with the accounting record.
Information: Passport and identity-verification material
Retention and review: Inspect rather than copy where sufficient. Retain copies only for a documented legal or security need and delete when that need ends; not automatically with the six-year booking record.
Information: Complaints, welfare, conduct, criminal allegations and insurance evidence
Retention and review: Retain only relevant information for investigation, resolution and applicable legal/insurance claim periods. Review on closure and at least annually while retained; restrict sensitive or allegation records.
Information: Marketing preferences and consent evidence
Retention and review: Retain while the permission is used and for the period reasonably needed to demonstrate compliance or resolve a dispute. Review relevance at least annually and stop marketing promptly after withdrawal.
Information: Suppression/do-not-contact record
Retention and review: Retain the minimum contact identifier and opt-out information needed to prevent unwanted future marketing.
Information: Event photography and video
Retention and review: Review published promotional use and retained media at least annually; remove material no longer needed or lawfully usable. Honour consent withdrawal and objections as described in section 15.
Information: Security and technical logs
Retention and review: Set proportionate periods for each system according to its security and fraud purpose; review at least annually and retain particular evidence longer only where an incident or claim requires it.
Retention applies across Easol and other live systems, forms, shared drives, staff devices and downloaded operational copies. Fishies will delete or anonymise information from systems it controls and give appropriate instructions to processors. Restricted backup copies follow scheduled secure overwrite and are not used for ordinary operations; if restored, applicable deletions will be reapplied. Independent suppliers may have their own legal retention duties.
13. Security
Fishies applies technical and organisational safeguards appropriate to the information and risk, including role-based access, secure payment/form providers, confidentiality obligations and secure sharing. Staff access is limited to what their role requires, with multi-factor authentication where supported. Health and incident records are restricted; passport copies and bank details must not be posted in traveller chats or unrestricted shared files. Payment-card verification is handled through secure provider processes rather than informal collection of card details.
No system can be guaranteed to be completely secure. Where a personal-data breach creates a legal reporting obligation, Fishies will notify the Information Commissioner’s Office and affected individuals as required by law.
14. Your rights
Depending on the circumstances and the lawful basis relied upon, you may have the right to:
• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request erasure of information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• receive certain information in a portable format where the right to data portability applies;
• withdraw consent at any time where processing is based on consent; and
• raise a complaint with the Information Commissioner’s Office.
The right to object to direct marketing is absolute. If you object to direct marketing, Fishies will stop using your personal information for that purpose.
To exercise a right, contact info@fishiestour.com. Fishies may need to verify your identity before acting on a request.
Identity, contact and payment information necessary for the booking must be provided for Fishies to enter into and perform the contract. Relevant health, allergy and accessibility needs should be declared at checkout and updated promptly so suitability, requested adjustments and safe arrangements can be assessed; unrelated medical history is not required. Fishies will explain any genuine limitation if necessary information is unavailable and consider reasonable alternatives. Marketing consent and participation in promotional photography are optional and are not conditions of booking.
Requests will be answered within the applicable legal deadline, normally one month, with any lawful extension explained. You may object to legitimate-interest processing, including promotional photography, by emailing info@fishiestour.com. Your right to object to direct marketing is absolute.
15. Photographs and event media
Fishies events may be photographed or filmed for event reporting and promotion on Fishies websites, social media and marketing materials. For general event and crowd images, Fishies may rely on its legitimate interest in documenting and promoting its events, following an assessment of people’s reasonable expectations and rights. Notices will identify official photography and explain how to contact staff about an objection. Promotional close-up interviews or deliberately posed individual features will use separate consent. Booking does not grant an unrestricted image release.
Where consent is legally required for a particular use, Fishies will obtain consent separately. Nothing in this section permits intrusive or inappropriate recording in private areas or overrides a person’s legal rights.
You can tell the photographer or Fishies staff if you do not want to be featured and can request review or removal of an identifiable published image via info@fishiestour.com. Fishies will assess requests promptly, stop consent-based future use when consent is withdrawn and take reasonable steps concerning material within its control. Withdrawal does not make earlier lawful processing unlawful. Images revealing sensitive health or welfare situations will not be used for promotion without an appropriate legal basis and any necessary separate consent.
16. Cookies and online tracking
Where Fishies uses cookies, pixels or similar technologies, the Cookie Notice and relevant consent tool identify their purpose, provider, duration and choices. Technologies requiring consent will not be activated until that consent is given, and withdrawal will be available. Strictly necessary technologies are explained separately. Acceptance of booking terms or this Notice is not cookie consent.
17. Changes to this Notice
Fishies may update this Notice where its services, suppliers or legal obligations change. The current version will be available through the privacy link on the Fishies Tour website and booking pages, and on request from info@fishiestour.com. It will show its effective date. Material changes affecting an active booking will be communicated where required by law.
18. Contact and complaints
Questions or requests relating to privacy should be sent to info@fishiestour.com.
You also have the right to complain to the Information Commissioner’s Office (ICO). You can contact the ICO at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. You may contact Fishies first to seek a resolution, but this does not limit your right to complain to the ICO.