Privacy policy

1) Who we are

Controller
Tally Ho (legal entity: Tally Ho Experiences Limited)

Address
189 Hercules Road, London SE1 7LD, United Kingdom

Email
hello@tallyho.com

Legal basis
We act as the “controller” of your personal data under UK GDPR (and EU GDPR where applicable).

2) What personal data we collect

Contact details
Name, email address, phone number.

Booking details
Tour/date selections, party size, special requests, emergency contact.

Messages
Enquiries sent via forms, email, or live chat.

Technical & usage data
IP address, device, browser, pages viewed, time on page, clicks.

Consent preferences
Choices made in our cookie banner.

Media from tours
Photographs and videos taken during tours and events.

3) How we collect data

Directly from you
When you book, enquire, or message us.

Automatically
Through cookies and similar technologies.

From service providers
When you use features embedded in our site (for example booking, chat, analytics).

4) Legal bases for processing

Consent
When you opt in to analytics, marketing, or certain forms.

Contract
To take bookings, process payments, and deliver your tour.

Legal obligation
Where we must keep records or meet regulatory duties.

Legitimate interests
To run, protect, and improve our services (balanced against your rights).

5) Third-party tools and services we use

Google Analytics 4 (GA4)
What we collect: Anonymised IP, device/browser info, usage data (after consent).
Legal basis: Consent.
Notes: May involve international transfers subject to appropriate safeguards.

Google Tag Manager (GTM)
What we collect: Tag loading only; no personal data processed by GTM itself.
Legal basis: Legitimate interests.

Framer (cookie consent and forms)
What we collect: Consent state, device/browser info; form inputs where used.
Legal basis: Consent (for cookies and forms) and legal obligation (cookie compliance).

Meta (Facebook) Pixel
What we collect: IP, browser data, on-site behaviour (after consent).
Legal basis: Consent.
Notes: May involve international transfers subject to appropriate safeguards.

Hotjar
What we collect: Anonymised user interactions (for example clicks, scrolls), session recordings, feedback widgets (after consent).
Legal basis: Consent.

Crisp Chat
What we collect: Name if provided, email, message content, limited usage data to deliver support.
Legal basis: Contract (support you request) and Consent (for analytics within chat, if any).

Framer Forms
What we collect: All form inputs you submit, IP, browser info.
Legal basis: Consent.

TicketingHub (booking system)
What we collect: Name, contact details, booking details, payment metadata required for booking.
Legal basis: Contract.

Stripe (payments)
What we collect: Name, email, IP, card/payment details (handled by Stripe to PCI DSS standards).
Legal basis: Contract.
Notes: Stripe is a separate controller for payment processing and applies appropriate safeguards for any international transfers.

Attio (CRM)
What we collect: Contact details, booking history, communication records to manage your relationship.
Legal basis: Legitimate interests and Contract.

Zapier (automations)
What we collect: Only the data needed to pass info between systems you use with us.
Legal basis: Legitimate interests and Contract.

Mailchimp (email marketing)
What we collect: Email, name, preferences, booking tags where relevant.
Legal basis: Consent.
Your rights: You can unsubscribe at any time via the link in any email or by contacting us.

6) Cookies

What cookies do
They help the site work, measure performance, and show relevant content.

Types we use
Essential (site to function). Analytics (understand usage). Marketing (measure ads and audiences). Preferences (remember choices).

Your choices
Set your preferences in our cookie banner or adjust your browser settings at any time. Some features may not work without certain cookies.

7) Photography and video

What we capture
Photos and video of tours and activities for marketing.

Storage
Securely stored (for example in Google Drive).

Legal basis
Legitimate interests.

Your choice
If you do not wish to be photographed or filmed, tell your guide at check-in and we'll make sure you're not included.

8) Emergency contacts and tour safety

What we use
The phone numbers and emergency contact you provide.

Why
To coordinate logistics and contact you in urgent situations.

Legal basis
Legitimate interests and Contract.

9) Partner data sharing

What we share
Only what's needed to arrange extras you request (for example out-of-town trips, attraction tickets).

Legal basis
Legitimate interests.

Your choice
You can ask which partners receive your data and opt out by contacting us.

10) How long we keep your data

Retention
We keep your data only as long as necessary for the purpose collected, including any legal, accounting, or reporting duties. Examples: Bookings and invoices are commonly retained for statutory periods set by law. Marketing consent records are kept until you withdraw consent or the data becomes inactive, after which we securely delete or anonymise.

11) Your rights (UK GDPR / EU GDPR)

Access
Ask for a copy of your data.

Rectification
Correct inaccurate or incomplete data.

Erasure
Ask us to delete your data where we have no lawful reason to keep it.

Restriction & objection
Limit or object to certain processing, including marketing.

Withdraw consent
Where we rely on consent, you can withdraw it at any time.

Complaints
You can complain to the UK Information Commissioner's Office (ICO) or your local EU authority.

How to exercise your rights
Email hello@tallyho.com and we'll respond within the timelines set by law.

12) International data transfers

Where data goes
Some providers store or process data outside the UK/EU/EEA.

How we protect it
We use recognised safeguards such as Standard Contractual Clauses, adequacy decisions, or certified frameworks as applicable.

13) Security

How we protect your data
We use technical and organisational measures appropriate to the risks, including encryption in transit, access controls, and staff training. No system is 100% secure, but we work to prevent unauthorised access, use, or disclosure.

14) Changes to this policy

Updates
We may update this policy to reflect changes in our practices or the law. The latest version will always appear on this page.