RAMS Adventures - Your information
General Data Protection Regulations compliant (GDPR)
Overview
RAMS Adventures and Remote Adventure Medical Services Ltd collects, holds and processes a considerable amount of information, including personal data about you, the enquirer or customer. This allows us to provide our information more efficiently and keeps you the customer updated with new adventures.
We understand that your personal data is important to you, and we have a responsibility to you regarding the information we hold about you, to ensure that the information we collect and use is done so proportionately, correctly and safely.
Being transparent with you and providing accessible information about how we use your information demonstrates our commitment to the General Data Protection Regulations, hereafter referred to as ‘GDPR’. (Regulation (EU) 2016/679).
We are committed to safeguarding your privacy and in this policy we explain how we will handle your personal data.
Who we are
RAMS Adventures Ltd
Company registration 08514471
3 Manor Close
Droitwich Spa
Worcestershire
WR98HG
0844 6645251
Data Protection Officer Leah Lee
[email protected]
Purpose of processing
We collect, hold and use personal data received by you to enable us to provide adventure holidays. These services include, ensuring client safety, ensuring client is prepared for the adventure to include Visa’s, Driving Permits and transfer of monies, new adventures being advertised and updates that the client may require by email. The amount and type of information we hold on you depends on whether signed up for an adventure or thinking about signing up for an adventure. You can also request a hard copy using the RAMS Adventures contact details.
Personal Data
“Personal data” means any information relating to a person who can be identified, directly or indirectly, from that information. This could include your name, your identification number, location data, online identifier (such as IP address or email) or to one or more factors specific to the identity of that person.
Some of the adventures we provide may require us to process your ‘special categories of personal data’. These special categories of personal data might include health data in relation to the adventure or dietry requiremnets. The definition ‘sensitive’ or ‘special categories’ of personal data has been extended to now include photographs. Photographs of past adventures identifying the person will not be used without prior consent.
Conditions of processing
When we process your personal data we will do so in accordance with the data protection principles.
These principles are designed to protect you, and ensure that we:
Processing special categories of personal data
All personal data is not the same, and some information is more sensitive than others. As such special rules apply when processing these ‘special categories’ of personal data. Special categories’ of personal data include:
Consent
RAMS Adventures also provide limited services which will require your consent to process your personal data.
In circumstances as described above - your consent to process your personal data must be ‘specific, informed, active and affirmative, meaning it must be clear and freely given by you after we explain what further processing we would like to do with your data. You can therefore make an informed decision about whether you consent to the processing or not. You are in control and you can withdraw your consent at any stage by contacting the Data Protection Officer Leah Lee. (Please note however that any processing that has taken place up to the time that you withdraw consent will however be considered lawful).
Consent for special category personal data
In respect of sensitive or ‘special categories of personal data’ we will require your ‘explicit consent’ to further process this type of personal data. This means your consent must be very clear and specific, and again you can withdraw your consent at any stage by contacting the Data Protection Officer Leah lee.
Where the RAMS Adventures seek to disclose sensitive personal data, such as medical details, to third parties, we will do so only with your prior explicit consent.
There may be occasions where we may have to disclosure your personal data if it is required or permitted by law, for example in relation to crime prevention/detection. In these cases we do not require your specific consent or explicit consent for the disclosure of your personal data.
Recording or managing consent
Once a clients’ consent is obtained we will keep a record of when the client consented, the information they were provided with prior to consent and how they consented.
Consent is part of your ongoing relationship with our clients and will therefore be managed appropriately. The consent will be reviewed periodically to ensure it remains appropriate, and, as previously stated, clients have the right to withdraw their consent at any stage.
Retention
We will only retain your personal data for as long as necessary and in accordance with our retention schedule. When your personal data is no longer needed it will be securely deleted, except where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another person. Few paper records are kept however if appropriate will be shredded and disguarded
Security
RAMS Adventures will strive to ensure that any personal data in its care will be kept safe and secure. In order to prevent unauthorised access, loss, destruction or theft, we have put in place appropriate technical, physical and managerial procedures to safeguard the information that we collect from you; this includes encryption of our computer systems. Our security measures are frequently reviewed in light of new risks or guidance from the Information Commisioners Office (ICO).
International transfers of your personal data
We may provide personal data to agents/subcontractors/fixers outside the European Economic Area (EEA). The EEA includes all European Union countries and the following three non-European Union countries Namibia, India and Vietnam.
The European Commission has made an "adequacy decision" in respect of a number of other countries outside of the EEA. An adequacy decision is a decision which confirms whether or not another country (outside of the EEA) provides an adequate level of protection of an individual’s personal data. If we intend to provide personal data to agents/subcontractors outside of the EEA then this will be outlined in the relevant service privacy policy which you can access from the relevant service area homepage.
Data sharing
To ensure that we can provide you with the best possible service we may have to share your personal data between our external partners. Our external partners are trusted representatives of RAMS Adventures and all data is processed under the strict guidance of GDPR under the supervison of RAMS Adventures.
We will never share your information with a third party, other than those of a legal requirement/entitlement, (Police) and it will only do so if necessary or where permitted under data protection legislation.
Your rights
You have certain rights in relation to the personal information we hold about you. In particular, you may have a right to:
We will respond to your request within 30 days, by either providing you with the information requested, requesting further information from you, or requesting further time to complete your request.
RAMS Adventures can also refuse your request. In the event that the we refuse your request we will provide you with reasons why, as well as provide you with details of how you can challenge or appeal our decision. You will also be informed of your right to legally challenge our decision with the ICO.
Complaints
If you wish to make a complaint about how RAMS Adventures are processing your personal data, then in the first instance please contact the Data Protection Officer Leah Lee in the 'Our details' section.
If you are still dissatisfied with how RAMS Adventures have handled your complaint then you have the right to complain to the Information Commissioners Office (ICO).
The ICO can be contacted as follows:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 08456 30 60 60
Website: www.ico.gov.uk
RAMS Adventures and Remote Adventure Medical Services Ltd collects, holds and processes a considerable amount of information, including personal data about you, the enquirer or customer. This allows us to provide our information more efficiently and keeps you the customer updated with new adventures.
We understand that your personal data is important to you, and we have a responsibility to you regarding the information we hold about you, to ensure that the information we collect and use is done so proportionately, correctly and safely.
Being transparent with you and providing accessible information about how we use your information demonstrates our commitment to the General Data Protection Regulations, hereafter referred to as ‘GDPR’. (Regulation (EU) 2016/679).
We are committed to safeguarding your privacy and in this policy we explain how we will handle your personal data.
Who we are
RAMS Adventures Ltd
Company registration 08514471
3 Manor Close
Droitwich Spa
Worcestershire
WR98HG
0844 6645251
Data Protection Officer Leah Lee
[email protected]
Purpose of processing
We collect, hold and use personal data received by you to enable us to provide adventure holidays. These services include, ensuring client safety, ensuring client is prepared for the adventure to include Visa’s, Driving Permits and transfer of monies, new adventures being advertised and updates that the client may require by email. The amount and type of information we hold on you depends on whether signed up for an adventure or thinking about signing up for an adventure. You can also request a hard copy using the RAMS Adventures contact details.
Personal Data
“Personal data” means any information relating to a person who can be identified, directly or indirectly, from that information. This could include your name, your identification number, location data, online identifier (such as IP address or email) or to one or more factors specific to the identity of that person.
Some of the adventures we provide may require us to process your ‘special categories of personal data’. These special categories of personal data might include health data in relation to the adventure or dietry requiremnets. The definition ‘sensitive’ or ‘special categories’ of personal data has been extended to now include photographs. Photographs of past adventures identifying the person will not be used without prior consent.
Conditions of processing
When we process your personal data we will do so in accordance with the data protection principles.
These principles are designed to protect you, and ensure that we:
- process your information lawfully, fairly and in a transparent manner
- use your information for a specified, explicit and legitimate purpose and not further processed in a manner that is incompatible with that purpose
- only obtain adequate, relevant and limited information to allow us to carry-out the purpose for which it was obtained
- ensure the information we hold about you is accurate and, where necessary, kept up to date
- keep any information for no longer than necessary for the purposes for which it was collected and ensure information is deleted following the return from an adventure.
- process your information in a manner that ensures appropriate security of your personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Processing special categories of personal data
All personal data is not the same, and some information is more sensitive than others. As such special rules apply when processing these ‘special categories’ of personal data. Special categories’ of personal data include:
- Racial or ethnic origin;
- Dietary preferences
- Religious and philosophical beliefs;
- Genetic data;
- Sex life/sexual orientation.
- The citizen has given explicit consent to the processing
- It is necessary for the purposes of carrying out the obligations and exercising specific rights of RAMS Adventures or the client.
- Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the client, medical diagnosis, the provision of health or social care or treatment. (Medical treatment)
- Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
- Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Consent
RAMS Adventures also provide limited services which will require your consent to process your personal data.
In circumstances as described above - your consent to process your personal data must be ‘specific, informed, active and affirmative, meaning it must be clear and freely given by you after we explain what further processing we would like to do with your data. You can therefore make an informed decision about whether you consent to the processing or not. You are in control and you can withdraw your consent at any stage by contacting the Data Protection Officer Leah Lee. (Please note however that any processing that has taken place up to the time that you withdraw consent will however be considered lawful).
Consent for special category personal data
In respect of sensitive or ‘special categories of personal data’ we will require your ‘explicit consent’ to further process this type of personal data. This means your consent must be very clear and specific, and again you can withdraw your consent at any stage by contacting the Data Protection Officer Leah lee.
Where the RAMS Adventures seek to disclose sensitive personal data, such as medical details, to third parties, we will do so only with your prior explicit consent.
There may be occasions where we may have to disclosure your personal data if it is required or permitted by law, for example in relation to crime prevention/detection. In these cases we do not require your specific consent or explicit consent for the disclosure of your personal data.
Recording or managing consent
Once a clients’ consent is obtained we will keep a record of when the client consented, the information they were provided with prior to consent and how they consented.
Consent is part of your ongoing relationship with our clients and will therefore be managed appropriately. The consent will be reviewed periodically to ensure it remains appropriate, and, as previously stated, clients have the right to withdraw their consent at any stage.
Retention
We will only retain your personal data for as long as necessary and in accordance with our retention schedule. When your personal data is no longer needed it will be securely deleted, except where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another person. Few paper records are kept however if appropriate will be shredded and disguarded
Security
RAMS Adventures will strive to ensure that any personal data in its care will be kept safe and secure. In order to prevent unauthorised access, loss, destruction or theft, we have put in place appropriate technical, physical and managerial procedures to safeguard the information that we collect from you; this includes encryption of our computer systems. Our security measures are frequently reviewed in light of new risks or guidance from the Information Commisioners Office (ICO).
International transfers of your personal data
We may provide personal data to agents/subcontractors/fixers outside the European Economic Area (EEA). The EEA includes all European Union countries and the following three non-European Union countries Namibia, India and Vietnam.
The European Commission has made an "adequacy decision" in respect of a number of other countries outside of the EEA. An adequacy decision is a decision which confirms whether or not another country (outside of the EEA) provides an adequate level of protection of an individual’s personal data. If we intend to provide personal data to agents/subcontractors outside of the EEA then this will be outlined in the relevant service privacy policy which you can access from the relevant service area homepage.
Data sharing
To ensure that we can provide you with the best possible service we may have to share your personal data between our external partners. Our external partners are trusted representatives of RAMS Adventures and all data is processed under the strict guidance of GDPR under the supervison of RAMS Adventures.
We will never share your information with a third party, other than those of a legal requirement/entitlement, (Police) and it will only do so if necessary or where permitted under data protection legislation.
Your rights
You have certain rights in relation to the personal information we hold about you. In particular, you may have a right to:
- Right to be informed – you have a right to be told how the RAMS Adventures use your personal data.
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to erasure (right to be forgotten) – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restrict processing – where certain conditions apply to have a right to restrict the processing.
- Right of data portability – you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right to object to automated processing, including profiling.
- The right to withdraw consent - If the legal basis for our processing of your personal information is consent then you have the right to withdraw that consent at any time.
We will respond to your request within 30 days, by either providing you with the information requested, requesting further information from you, or requesting further time to complete your request.
RAMS Adventures can also refuse your request. In the event that the we refuse your request we will provide you with reasons why, as well as provide you with details of how you can challenge or appeal our decision. You will also be informed of your right to legally challenge our decision with the ICO.
Complaints
If you wish to make a complaint about how RAMS Adventures are processing your personal data, then in the first instance please contact the Data Protection Officer Leah Lee in the 'Our details' section.
If you are still dissatisfied with how RAMS Adventures have handled your complaint then you have the right to complain to the Information Commissioners Office (ICO).
The ICO can be contacted as follows:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 08456 30 60 60
Website: www.ico.gov.uk
