Data Protection

General Data Protection Regulation

How McTours may use your personal data

Last updated: 14th April 2026

Data Protection and Privacy Policy

Last updated: April 2026

1. Introduction

McTours Ltd ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, store, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller Details:

2. What Personal Data We Collect

We collect and process the following types of personal data:

2.1 Information You Provide Directly:

2.2 Information We Collect Automatically:

2.3 Photographs and Videos:

3. How We Use Your Personal Data

We process your personal data for the following purposes, based on the legal grounds outlined:

Processing bookings and enquiries
Legal Basis: Performance of a contract / Legitimate interest
Delivering tours and services
Legal Basis: Performance of a contract
Communicating about your booking (confirmations, updates)
Legal Basis: Performance of a contract
Processing payments
Legal Basis: Performance of a contract
Sending marketing communications (only with consent)
Legal Basis: Consent
Improving our website and services (analytics)
Legal Basis: Legitimate interest
Complying with legal obligations (e.g., tax, accounting)
Legal Basis: Legal obligation
Investigating complaints or incidents
Legal Basis: Legitimate interest / Legal obligation

We will never:

4. Who We Share Your Data With

We may share your personal data with the following third parties, but only when necessary:

4.1 Service Providers:

4.2 Tour Partners:

4.3 Legal Obligations:

All third parties we work with are required to:

5. How Long We Keep Your Data

We retain your personal data for the following periods:

Enquiries (not converted to bookings)
2 years from enquiry date
Bookings and tour records
7 years (for accounting and legal purposes)
Marketing consent records
Until consent is withdrawn, then 1 year for audit purposes
Website analytics (anonymised)
26 months (Google Analytics default)
Motorcycle rental records
7 years (insurance and legal purposes)

After the retention period expires, we securely delete or anonymise your data.

6. Your Data Protection Rights

Under UK GDPR, you have the following rights:

✅ Right of Access

Request a copy of the personal data we hold about you (free of charge).

✅ Right to Rectification

Request correction of inaccurate or incomplete data.

✅ Right to Erasure ("Right to be Forgotten")

Request deletion of your personal data (subject to legal retention obligations).

✅ Right to Restrict Processing

Request that we limit how we use your data (e.g., keep it but not process it).

✅ Right to Data Portability

Request a copy of your data in a structured, machine-readable format (where technically feasible).

✅ Right to Object

Object to processing of your data for marketing purposes or based on legitimate interests.

✅ Right to Withdraw Consent

Withdraw consent for marketing communications or data processing at any time (does not affect lawful processing before withdrawal).

How to Exercise Your Rights:

7. Photographs and Videos Taken on Tours

7.1 Consent

By participating in a tour, you grant specific, informed, and unambiguous consent for McTours and fellow participants to capture and share photographs/videos on social media platforms (e.g., Facebook, Instagram, YouTube).

7.2 Withdrawal of Consent

If you wish to withdraw consent:

We will remove images we control, but cannot control images already shared by other participants on third-party platforms (as we are not the data controller for that content).

7.3 Opting Out

If you do not consent to being photographed, please inform your tour guide and fellow participants at the start of the tour.

8. International Data Transfers

We primarily store data within the UK/EU. If data is transferred outside the UK (e.g., to cloud hosting providers such as Microsoft based in the USA), we ensure adequate safeguards are in place, such as:

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

9.1 Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights, we will:

10. Cookies and Website Analytics

We use cookies to improve website functionality and analyse usage. See our Cookie Policy for details on:

11. Marketing Communications

We only send marketing emails (tour updates, special offers) if you have explicitly consented via:

You can unsubscribe at any time by:

12. Children's Privacy

We do not knowingly collect personal data from individuals under 16 without parental consent. If you believe we have inadvertently collected such data, please contact us immediately at privacy@mctours.eu.

13. Changes to This Policy

We may update this policy periodically to reflect:

Effective Date: Changes take effect on the date posted. We encourage you to review this policy regularly.

14. Complaints and Contact

If you believe we have not handled your data correctly, you can:

14.1 Contact Us:

14.2 Lodge a Complaint with the ICO:

If we cannot resolve your concern, you have the right to lodge a complaint with the UK's data protection authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Summary of Key Points

Your Rights

  • ✅ Access your data
  • ✅ Correct inaccurate data
  • ✅ Delete your data
  • ✅ Object to marketing
  • ✅ Withdraw consent anytime
  • ✅ Complain to the ICO

How We Protect You

  • ✅ Encrypted data transmission
  • ✅ Secure storage (UK/EU servers)
  • ✅ Limited data retention periods
  • ✅ Easy unsubscribe options
  • ✅ Transparent consent processes
  • ✅ Responsive privacy team

For any questions about this policy, contact:
Email: privacy@mctours.eu
Phone: +44 (0)141 416 0230