Privacy

This notice explains what personal data Man on Rock Trips (operated by Redpoint Vision [legal entity TBC], the data controller · hello@manonrock.com) collects, why, who processes it, and your rights under UK GDPR.

1. What we collect, and why

• Booking data — name, email, phone, country, any named guest, your climbing CV, and emergency contact. Used to assess and run your booking. Legal basis: performance of a contract.
• Health-related data — dietary requirements, allergies, and medical conditions relevant to the trip. This is special-category data; we ask for the minimum needed to run the trip safely, use it only for catering and safety planning, and share it only with the people who need it to keep you safe. Legal basis: your explicit consent, given when you submit the form; in an emergency, protection of vital interests.
• Payment data — handled entirely by Stripe; card numbers never touch our systems. We see the amount, status and reference. Legal basis: performance of a contract.
• Declarations — which versions of the legal documents you accepted, and when. Legal basis: legal obligation and legitimate interest in recording the contract.
• Mailing list — your email, if you sign up for new dates. Legal basis: consent; unsubscribe at any time via any email we send or by writing to us.
• Analytics — Google Analytics 4 measures visits and how the booking pages are used (pages, approximate location, events like "reached payment"). It sets cookies. [Consent mechanism for analytics cookies under PECR — TBC on review.]

The booking form also saves what you've typed in your own browser's session storage so nothing is lost while you fill it in; that data stays on your device and is cleared when you finish or close the tab.

2. Who processes it for us

• Formspree Inc. (US) — receives form submissions and sends our notification and confirmation emails. Transfers are safeguarded under its data-processing terms. [Confirm current transfer mechanism on review.]
• Stripe — payments.
• Google — analytics (GA4).
• Apple (iCloud) — our email hosting.
• Cloudflare — website hosting and security; standard server logs.

We do not sell personal data, and we do not share it with anyone else except where the law requires.

3. How long we keep it

• Booking and payment records: 6 years after the trip (contract and tax obligations).
• Medical and dietary details: deleted within 3 months after the trip ends, or immediately if your booking is declined or cancelled.
• Mailing list: until you unsubscribe.

4. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and you can withdraw consent (for example to the mailing list, or to holding your medical details — though we cannot take you on the trip without the safety minimum). Write to hello@manonrock.com; we respond within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

5. Versions

This is version 1 of this notice, published 13 July 2026, pending legal review. Material changes will be posted here.