Resilience &Rise Ltd

Privacy Policy

Version: 1.0

Effective Date: 15 Jul 26

1. Introduction

Resilience &Rise Ltd (SC825656) (“Resilience &Rise”, “we”, “our” or “us”) is committed to protecting your privacy and handling personal information lawfully, fairly and transparently.

This Privacy Policy explains how we collect, use, store and protect your personal information when you:

  • visit our website (www.resilienceandrise.com);

  • contact us via email, telephone or through our website;

  • book or participate in one of our events or activities;

  • engage us to provide services.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

2. Data Controller

Resilience &Rise Ltd is the Data Controller responsible for your personal information.

Contact Details:

Resilience &Rise Ltd

Company No. SC825656

Registered Office: 1 Victoria Terrace, Crieff, PH7 4AA

Email: cal@resilienceandrise.com

If you have any questions regarding this Privacy Policy or wish to exercise your data protection rights, please contact us using the details above.

3. Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

Personal Information

  • Name

  • Email address

  • Telephone number

  • Postal address (where required)

  • Employer or organisation

  • Job title

  • Booking information

  • Payment information (where applicable)

  • Correspondence with us

  • Information Relating to Participation in Activities

  • Where you book onto one of our activities, we may collect:

  • Emergency contact details

  • Previous outdoor experience

  • Relevant qualifications

  • Information relating to your ability to participate safely

Health and Special Category Data

To enable us to plan events and activities safely and meet our duty of care, we may ask you to provide information including:

  • Relevant medical conditions

  • Current injuries

  • Allergies (including food, medication and environmental allergies)

  • Relevant medication

  • Physical limitations that may affect participation

  • Accessibility requirements

  • Dietary requirements

We only collect information that is reasonably necessary to safely deliver our events, activities and services. Our services are intended for adults aged 18 years and over. We do not knowingly collect personal information directly from children or offer our services to individuals under the age of 18. If we become aware that we have collected personal information from a person under the age of 18 in error, we will take reasonable steps to delete that information promptly. We ask participants to ensure information provided is accurate and notify us if anything changes.

4. How We Collect Information

We collect information:

  • directly from you;

  • through our website;

  • when you contact us by email or telephone;

  • through booking forms;

  • through participant medical or emergency information forms;

  • during delivery of our services when required.

Our website may also automatically collect technical information using cookies and similar technologies.

5. How We Use Your Information

We use your information to:

  • respond to enquiries;

  • provide quotations;

  • administer bookings;

  • deliver services;

  • carry out safety planning and risk assessments;

  • make reasonable adjustments where appropriate;

  • arrange catering and accommodate dietary requirements;

  • communicate before events;

  • process payments;

  • comply with legal obligations;

  • improve our services;

  • maintain business records.

We will only send electronic marketing communications where permitted by law and you have opted in

where required. You can unsubscribe at any time by emailing: cal@resilienceandrise.com.

6. Lawful Basis for Processing

We process personal information under one or more of the following lawful bases:

  • Purpose Lawful Basis

  • Responding to Enquiries Legitimate interests

  • Providing services Contract

  • Processing payments Contract

  • Safety Planning Legitimate Interests

  • Medical Information Article 9 Explicit Consent / Vital Interests

  • Accounting Legal Obligation

  • Marketing Consent

  • Processing Health Information

  • Information relating to medical conditions, allergies, accessibility requirements and other health

  • information is classed as special category personal data.

We process this information only where necessary to:

  • assess risk;

  • plan activities safely;

  • make reasonable adjustments;

  • provide suitable catering;

  • protect participants in an emergency;

  • comply with our health and safety responsibilities.

We process special category personal data only where necessary and permitted under Article 9 UK GDPR.

Depending on the circumstances, this may include where:

  • you have provided explicit consent;

  • processing is necessary to protect your vital interests or those of another person in an emergency;

  • processing is necessary for the establishment, exercise or defence of legal claims.

7. Sharing Your Information

We do not sell your personal information. We may share information where necessary with:

  • freelance instructors, guides or facilitators engaged by us;

  • emergency services;

  • first aid providers;

  • insurers;

  • professional advisors including accountants and solicitors;

  • IT and website providers;

  • Payment providers.

Health information will only be shared where necessary to deliver activities safely or in response to an emergency.

8. Website and Technology Providers

We use third-party data processors to provide website hosting, email services and related IT services. Our website is hosted by Squarespace. Squarespace may process technical information including IP addresses, browser information, device information and website usage data in order to provide secure website hosting and website functionality. Our business email is provided through Microsoft 365, licenced through GoDaddy. Email correspondence may therefore be processed using Microsoft’s cloud infrastructure. These providers apply their own security measures and process information in accordance with applicable data protection legislation.

9. Cookies

Our website uses cookies and similar technologies. Cookies help us:

  • keep the website functioning correctly;

  • understand how visitors use the website;

  • improve website performance;

  • remember user preferences.

Where legally required, we will request your consent before placing non-essential cookies.

You can manage cookie preferences through your browser settings.

10.International Transfers

Some of our technology providers may process personal information outside of the United Kingdom. Where personal information is transferred internationally, appropriate safeguards will be in place in accordance with UK data protection legislation.

11.Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on

individuals.

12.Security

We take appropriate technical and organisational measures to protect personal information against

unauthorised access, loss, misuse, alteration or disclosure.

These measures include:

  • password-protected systems;

  • secure cloud storage;

  • limited access to information;

  • regular software and security updates.

While we take reasonable steps to protect information, no internet transmission can ever be guaranteed to be completely secure.

We regularly review our security measures to ensure they remain appropriate.

13.How Long We Keep Information

We only retain personal information for as long as necessary.

Typical retention periods are:

  • General enquiries 24 months

  • Client records 6 years following completion of services

  • Financial records Six years after the end of the relevant financial year (or longer

  • where required by law).

  • Participant medical information Normally deleted within 12 months of the activity unless an

  • incident, insurance claim or legal obligation requires longer

  • retention

  • Incident records As long as necessary to meet legal or insurance obligations

14.Your Rights

Under the UK General Data Protection Regulation (UK GDPR), you have a number of rights in relation to

your personal information. These include the right to:

  • request access to the personal information we hold about you;

  • request that inaccurate or incomplete personal information is corrected;

  • request the deletion of your personal information in certain circumstances;

  • request that we restrict the processing of your personal information in certain circumstances;

  • object to our processing of your personal information where we rely on legitimate interests or

  • process your information for direct marketing purposes;

  • receive certain personal information you have provided to us in a structured, commonly used and machine-readable format, where the right to data portability applies;

  • withdraw your consent at any time where we rely on your consent to process your personal information. This will not affect the lawfulness of any processing carried out before you withdrew your consent.

To exercise any of these rights, please contact us using the details set out in Section 2. We will respond to your request in accordance with applicable data protection legislation. If we are unable to comply with your request, we will explain the reasons why and inform you of any right you have to challenge our decision or to make a complaint to the Information Commissioner's Office (ICO).

15.Complaints

If you have any concerns regarding how we process your information, please contact us first so we can attempt to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

ICO

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

16.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or business operations.

The latest version will always be published on our website together with the effective date.