Privacy Policy

Last updated: 4 November 2025

This Privacy Policy describes how NessTours (“we”, “us”, “our”) collects and processes your personal information when you visit nesstours.com or contact us about tours. We comply with the UK General Data Protection Regulation (UK-GDPR) and the Data Protection Act 2018.

1. Who we are and how to contact us

2. The personal data we collect

  • Directly from you: name, email address, phone number, message content and preferences when you submit a form or email us; booking details where relevant.
  • Automatically: IP address, device and browser type, pages visited, time on site and referrer via analytics and server logs (see Cookie Policy).
  • Communications: correspondence by email, phone or messaging.
  • Photos/Media (optional): only when you share them or consent to us using them (e.g., testimonials).

3. Purposes and lawful bases

PurposeExamplesLawful basis
Respond to enquiries & provide quotesAnswer your messages, discuss tours, pricing & availabilityLegitimate interests / Pre-contractual steps (Art. 6(1)(b))
Manage bookings & deliver servicesItineraries, confirmations, operational communicationsContract (Art. 6(1)(b))
Improve site & servicesAnalytics, troubleshooting, securityLegitimate interests (Art. 6(1)(f))
Marketing (limited & respectful)Occasional updates where you’ve opted inConsent (Art. 6(1)(a)); or Legitimate interests with soft opt-in where applicable
Legal & regulatoryAccounting, tax, and legal complianceLegal obligation (Art. 6(1)(c))

4. Who we share data with

We do not sell your personal data. We share only what is necessary with trusted providers who help us run the website and deliver our services:

  • Website hosting & security: UK/EU hosting provider (e.g., 34SP.com) and standard server logs.
  • Email & communications: our email provider (Gmail/Google Workspace) to receive and respond to messages.
  • Forms: Forminator (or similar) to securely process enquiries submitted via the site.
  • Analytics/Maps: Google Analytics and Google Maps (see Cookie Policy).
  • Professional advisers: accountants, legal advisors where necessary.

Some providers may process data in the EEA/UK and/or the USA. Where transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses and provider commitments.

5. Data retention

  • Enquiry emails and contact forms: normally up to 24 months.
  • Booking/contract information: up to 7 years for tax and accounting.
  • Analytics data: typically 14–26 months (see Google’s retention controls).

We keep data no longer than necessary for the purposes described, unless a longer retention period is required by law.

6. Your rights

Under UK-GDPR you have the right to request: access, rectification, erasure, restriction, portability, and to object to certain processing. Where we rely on consent, you may withdraw it at any time.

To exercise your rights, email nestor.m.scotland@gmail.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk.

7. Security

We implement reasonable technical and organisational measures to protect personal data, including HTTPS encryption, limited access, and secure hosting.

8. Children

Our website and services are not directed to children under 16. If you believe a child has provided us with personal data without consent, please contact us and we will delete it.

9. Links to other websites

Our website may contain links to third-party sites. We are not responsible for their content or privacy practices. Please review their policies.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and post the new version here.

11. Contact

For questions or requests regarding this policy or your data, please contact: