Last updated: 20 August 2026. This version replaces the policy dated 24 December 2024.
This policy explains what personal information Your Adventure Challenge collects, why we collect it, what we do with it, how long we keep it and what rights you have. It covers our website, our enquiry and participant forms, and the challenges we run.
We have written it in plain English. If anything is unclear, please ask us — we would rather explain it than have you guess.
For detail on cookies and website tracking specifically, please see our Cookie Policy.
- Who we are
- The information we collect
- Where we get it from
- Why we use it, and our lawful basis
- Health information
- Emergency contacts
- Photographs and video
- Marketing emails
- Who we share information with
- Sending information outside the UK
- How long we keep it
- How we keep it safe
- Your rights
- Cookies and the website
- Children
- Automated decisions
- Changes to this policy
- Contact us and how to complain
1. Who we are
Your Adventure Challenge Limited is the “data controller” for the information described in this policy. That means we decide what is collected and what happens to it, and we are responsible for looking after it.
Your Adventure Challenge Limited
37 High Street, Tewkesbury, GL20 5BB
Registered in England and Wales, company number 14670942
Email: mark@youradventurechallenge.com
Telephone: 07586 884896
We are not required to have a Data Protection Officer, so questions come straight to us.
2. The information we collect
If you make an enquiry
- Your name, email address and telephone number
- The organisation you represent, if you are enquiring on behalf of a charity or a business
- Whatever you choose to tell us in your message
If you book or take part in a challenge
- Your name, date of birth, email address, telephone number and the organisation you are with
- Which challenge you are doing and on what date
- Health information — pre-existing medical conditions, regular medication, allergies, other health concerns and dietary requirements
- Your self-assessed fitness level, relevant experience and intended training
- The name, telephone number and relationship of your emergency contact
- Your acceptance of our participant disclaimer, and the date you gave it
- Payment and booking records, and how much was raised for the charity
Photographs and video
We take photographs and video during challenges, and we receive them from participants and charity partners. These are used to record the day and to promote future challenges. Section 7 explains this in full, including how to ask us not to use your image.
If you use the website
Our website collects technical information such as your IP address, browser and device type, the pages you view and where you arrived from. Almost all of this is handled through cookies and similar technologies, which are set out in detail in our Cookie Policy. Only strictly necessary information is collected before you give consent.
3. Where we get it from
- Directly from you — through our enquiry form, the participant disclaimer form, email, telephone, social media or in person. This is the source of nearly everything we hold.
- From a charity or employer — if you have signed up to a challenge through a charity you are fundraising for, or through your workplace, they may pass us your name and contact details so we can organise your place.
- From your device — technical and usage information collected automatically when you visit the website.
- From another participant — if someone has given us your details as their emergency contact. Section 6 explains what we do with those.
4. Why we use it, and our lawful basis
The law requires us to have a specific reason, called a lawful basis, for each thing we do with your information. Ours are set out below.
| What we do | Information used | Our lawful basis |
|---|---|---|
| Reply to your enquiry and discuss a possible challenge | Name, contact details, your message | Legitimate interests — you have contacted us and expect a reply |
| Organise and run a challenge you have booked | Name, contact details, date of birth, organisation, booking and payment records | Performance of a contract with you, or with the charity or business that booked on your behalf |
| Keep you safe during a challenge, brief guides on relevant conditions, and respond to a medical incident | Health information, fitness and experience, emergency contact | Legitimate interests in running challenges safely, together with your explicit consent for the health information itself (see section 5) |
| Cater for dietary requirements | Dietary information | Explicit consent, given when you complete the disclaimer form |
| Record challenges and promote future ones using photographs and video | Images and footage, first names, the charity or company involved | Legitimate interests in promoting the business, balanced against your privacy — you can object at any time (see section 7) |
| Publish the results of a completed challenge, including amounts raised | Organisation name, challenge details, fundraising totals, participant first names | Legitimate interests in showing what our challenges achieve |
| Send marketing emails about future challenges | Name, email address | Consent, or the soft opt-in where you have booked with us before (see section 8) |
| Understand how the website is used and measure our advertising | Cookie and usage data | Consent, given through the cookie banner |
| Keep accounting records and meet tax obligations | Booking and payment records | Legal obligation |
| Deal with an insurance claim, complaint or legal dispute | Whatever is relevant to the matter | Legitimate interests in defending our position, and legal claims where health information is involved |
| Keep our website and systems secure and free of spam | Technical data, form security checks | Legitimate interests in protecting the business |
Where we rely on legitimate interests, we have considered whether our reason is fair to you and whether you would reasonably expect it. You can object to any of it — section 13 explains how, and we will stop unless we have a compelling reason not to.
5. Health information
Our challenges are physically demanding and often take place on remote ground. The participant disclaimer form asks about medical conditions, medication, allergies, other health concerns and dietary requirements. This is what the law calls special category data, and it gets extra protection.
- We ask for it so our guides know about anything that could affect your safety on the day, and so we can act quickly and correctly if something goes wrong.
- We collect and use it on the basis of your explicit consent, which you give when you tick the consent box and submit the disclaimer form.
- In a genuine emergency where you are unable to consent — for example if you are unconscious — we may share it with emergency services or medical staff to protect your vital interests.
- It is seen only by the people who need it: the person organising your challenge and the guides leading it on the day.
- It is not used for marketing, is never sold, and is not shared with the charity or company you are fundraising for.
- You can withdraw your consent at any time by contacting us. If you do so before your challenge we may not be able to let you take part, because we would not be able to run it safely for you.
6. Emergency contacts
We ask every participant for an emergency contact. If you have given us someone else’s details, please tell them, as we have no way of doing so ourselves.
We hold only their name, telephone number and relationship to the participant. We use it for one purpose — to contact them if there is an incident during a challenge — and we delete it on the same timescale as the rest of the participant record. If you are an emergency contact and would like your details removed, contact us and we will remove them, and ask the participant for an alternative.
7. Photographs and video
Photographs and video are a central part of what we do. They record the day for the people taking part, they show charities what their challenge achieved, and they are how we attract the next group. We publish them on this website, on our social media accounts, and sometimes in printed material.
We do this on the basis of our legitimate interests. We have weighed that against your privacy and taken the following position:
- We identify people by first name only, unless you have agreed otherwise, or unless you are named in a quote you have given us.
- We do not publish images alongside any health or medical information.
- We will not use an image that shows someone in distress, receiving medical attention, or in any situation they would reasonably find embarrassing.
- You can tell us at any time that you do not want to appear. Tell your guide on the day, or email us. We will not photograph you deliberately, and we will not publish an image of you.
- You can ask us to remove an image already published. Email us and we will take it down from our website and our own social media accounts within five working days. Where a charity or a participant has reshared it, we will ask them to do the same, though we cannot force them.
Please note that where a charity or a company organises a challenge, they often take their own photographs as well. Those are their responsibility and are covered by their own privacy policy, not this one.
8. Marketing emails
We may email you about future challenges, fundraising ideas and news. We will only do so if:
- you have asked us to, or ticked a box agreeing to it; or
- you have booked or enquired about a challenge with us before, and we are telling you about similar challenges. This is known as the soft opt-in and the law permits it, provided we always give you a way out.
Every marketing email has an unsubscribe link, and you can also just reply and ask us to stop. We will act on it straight away. If you unsubscribe we keep a minimal record of the fact, purely so that we do not email you again by accident.
We will never sell your details, and we will never pass them to another company for their own marketing.
9. Who we share information with
We do not sell personal information. We share it only where it is needed to run a challenge, to operate the business, or where the law requires it.
| Who | What they receive | Why |
|---|---|---|
| Our guides and safety staff | Participant names, relevant health information, emergency contacts | So the people leading your challenge can run it safely |
| The charity or business you are fundraising for | Your name and whether you completed the challenge, and the amount raised | So they can thank you and record the fundraising. Health information is never shared with them. |
| HubSpot | Contact details and enquiry history | The system we use to manage enquiries and customer records |
| Google and Meta | Website usage and advertising data, and a scrambled version of your email address where you have enquired | Website analytics and advertising measurement, only where you have consented. See our Cookie Policy |
| Our website host and IT suppliers | Whatever is stored on the website, including form submissions | Hosting, backups and technical support |
| Pixertise | Access to the website and marketing systems | Our website and digital marketing agency, acting on our instructions |
| Emergency services and medical professionals | Health information and emergency contact details | Only if there is a medical incident during a challenge |
| Our accountant, insurers and professional advisers | Booking and payment records, and incident details where relevant | Accounts, tax, insurance and legal advice |
| Law enforcement or regulators | Whatever we are legally required to provide | Only where the law obliges us |
Everyone who handles information on our behalf is bound by a written contract requiring them to keep it secure and to use it only for the purpose we have given them.
10. Sending information outside the UK
Some of the companies we use, including Google, Meta and HubSpot, are based in the United States or store data there. Where information leaves the UK, it is protected by one of the safeguards the law recognises — usually the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement and the standard contractual clauses. You can ask us for details of the safeguard used for any particular transfer.
11. How long we keep it
We keep personal information only for as long as we have a reason to. These are our standard periods.
| Information | How long | Why |
|---|---|---|
| Enquiries that do not lead to a booking | 24 months from your last contact with us | Enquiries often come back around a year later, and challenges are planned well in advance |
| Customer and booking records | 6 years after the last transaction | The limitation period for contract claims |
| Participant disclaimer forms, including health information | 3 years after the challenge | The limitation period for personal injury claims in England and Wales |
| Emergency contact details | 3 years after the challenge, as part of the same record | Held only for the safety of the challenge |
| Accounting and tax records | 6 years after the end of the financial year | Required by HMRC |
| Photographs and video | For as long as we are using them, and removed on request | Section 7 explains how to ask us to remove an image |
| Marketing contacts | Until you unsubscribe, then a minimal suppression record kept indefinitely | So that we do not email you again by mistake |
| Website and cookie data | As set out in our Cookie Policy, up to a maximum of 2 years | Varies by cookie |
| Records of an incident, complaint or claim | 6 years after the matter is closed | So we can defend a claim and learn from what happened |
At the end of these periods we delete the information, or anonymise it so it can no longer be linked to you. Fundraising totals and challenge records that no longer identify anyone may be kept indefinitely as part of our history.
12. How we keep it safe
- The website runs over an encrypted connection, and forms are protected against automated abuse.
- Access to enquiry and participant records is limited to the people who need it, and protected by strong passwords and two-factor authentication where the system supports it.
- Health information is shared with guides only for the challenge they are leading, and only for as long as it is needed.
- Our suppliers are chosen on the basis that they can demonstrate appropriate security, and are bound by written contracts.
- We take backups so that information can be restored if something goes wrong.
No system is completely secure, and we will not pretend otherwise. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner’s Office within 72 hours as the law requires.
13. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the following rights. They are free to exercise, and using them will never affect how we treat you.
| Right | What it means |
|---|---|
| Be informed | To know what we do with your information. That is what this policy is for. |
| Access | To get a copy of the information we hold about you. |
| Rectification | To have anything inaccurate corrected, or anything incomplete filled in. |
| Erasure | To have your information deleted, where we have no continuing reason to keep it. We may need to retain some records for the retention periods in section 11. |
| Restriction | To have us pause using your information while a question about it is resolved. |
| Object | To object to anything we do on the basis of legitimate interests, including the use of your photograph, and to stop direct marketing at any time. Marketing objections are always honoured, without exception. |
| Portability | To receive information you gave us in a common electronic format, or have it sent to another organisation. |
| Withdraw consent | Where we rely on your consent — for health information, dietary requirements, cookies or marketing — to withdraw it at any time. This does not affect anything done before you withdrew it. |
To exercise any of these, email mark@youradventurechallenge.com. We may ask you to confirm your identity so that we do not release information to the wrong person. We will respond within one month, and will tell you if we need longer because a request is complex.
14. Cookies and the website
Our website uses cookies and similar technologies for essential functions, for analytics, and for advertising measurement. Only strictly necessary cookies are set before you choose; everything else waits for your consent through the banner.
Rather than repeat it here, the full detail — every cookie, what it does, how long it lasts and how to control it — is in our Cookie Policy.
15. Children
Our challenges are for adults. We do not accept bookings from anyone under 18 and we do not knowingly collect information about children through this website or our forms. If you believe a child has given us their information, please contact us and we will delete it.
16. Automated decisions
We do not make any decision about you by automated means alone, and we do not profile you in any way that produces a legal or similarly significant effect. Advertising audiences built by Google and Meta are based on grouped, not individual, decisions and have no bearing on whether you can book a challenge or on what you pay.
17. Changes to this policy
We review this policy at least once a year, and whenever we change something material about how we handle information. The date at the top shows when it was last updated. Where a change significantly affects you, we will tell you directly rather than relying on you to notice.
18. Contact us and how to complain
For anything to do with your information, or this policy:
Your Adventure Challenge Limited
37 High Street, Tewkesbury, GL20 5BB
Email: mark@youradventurechallenge.com
Telephone: 07586 884896
If you are unhappy with how we have handled your information, please tell us first — we would like the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint