Some of the third-party service providers we use to operate our website, booking systems, analytics and customer communications may process personal data outside of the United Kingdom. These providers include Google Analytics, Webflow, Periode and Typeform.
Where personal data is transferred outside the UK, we ensure that such transfers are carried out in accordance with applicable data protection laws and that appropriate safeguards are in place to protect your personal data to a standard equivalent to UK law. In particular:
- Where personal data is transferred to a country or territory subject to a UK adequacy regulation under Section 17A of the UK GDPR, we rely on that adequacy decision as the lawful transfer mechanism;
- Where no adequacy regulation applies, we implement appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), as approved by the UK Information Commissioner’s Office;
- Where applicable, we may rely on transfers to organisations participating in approved certification schemes or recognised international data transfer frameworks, where these provide appropriate safeguards under UK data protection law.
All international transfers are subject to appropriate contractual, technical and organisational measures, and we carry out transfer risk assessments where required, to ensure a level of protection equivalent to that required under UK data protection law.
We carry out periodic reviews of our international data transfer arrangements at least annually, and more frequently where there are changes to our processing activities, suppliers, or applicable legal requirements, to ensure ongoing compliance.
