Privacy Policy

1. Who we are

The Kilted Unicorn is a trading name of TheCampBox Ltd, a company registered in Scotland (Company No. SC597976), with its registered address at:

139/10 Great Junction Street, Edinburgh, EH6 5JB, United Kingdom

We are the data controller for all personal information collected through thekiltedunicorn.com. This means we decide how and why your personal data is used.

For any questions about this Privacy Policy or how we handle your data, please contact us at:

We are registered with the UK Information Commissioner's Office (ICO), registration number ZB347196.

2. What personal data we collect

We collect personal data in the following circumstances.

a) When you submit an enquiry or make a booking

• Full name and title
• Email address and phone number
• Home address (for booking confirmation and correspondence)
• Nationality and passport details (where required for accommodation or activity bookings)
• Dietary requirements, mobility needs, or other health information you choose to share with us to tailor your trip
• Travel dates, preferences, and trip specifications
• Payment information (processed securely, we do not store full card details)

b) When you visit our website

• IP address and browser type (via analytics tools)
• Pages visited and time spent on site (via cookies, see Section 9)
• Referral source (how you found our website)

c) When you correspond with us

• Emails, messages, and any information you voluntarily provide in communications

3. How we use your personal data

We use your personal data for the following purposes and on the following legal bases:

We do not use your personal data for automated decision-making or profiling.

4. Special category data

If you share health or dietary information with us to personalise your trip (for example mobility requirements, food allergies), this constitutes special category data under UK GDPR. We process it only with your explicit consent and solely for the purpose of arranging your travel. This information is not shared beyond what is strictly necessary to fulfil your trip requirements.

5. Who we share your data with

We share your personal data with third parties only where necessary:

• Accommodation providers, activity operators, and transport companies involved in your trip — to make the bookings your itinerary requires
• Our booking management system (Ezus) and accounting software (Xero) — both operate under data processing agreements
• Our insurance brokers (James Hallam Ltd) — where required for claims or policy administration
• Legal and regulatory authorities — where required by law

We do not sell, rent, or share your personal data with third parties for marketing purposes.

6. International data transfers

TheCampBox Ltd is based in the United Kingdom. If you are located outside the UK (including the United States or Canada), your data will be transferred to and processed in the UK, which the UK Government has confirmed maintains adequate data protection standards.

Where we share data with suppliers outside the UK (for example, Scottish accommodation providers), we ensure appropriate safeguards are in place. We do not transfer your data to countries without adequate data protection without your knowledge.

7. How long we keep your data

• Booking records and related correspondence: 7 years from the date of travel (to comply with UK financial and tax obligations)
• Enquiries that did not result in a booking: 12 months from last contact
• Website analytics data: 26 months (anonymised)
• Marketing consent records: until you withdraw consent, plus 1 year

After these periods, your data is securely deleted or anonymised.

8. Your rights

Under UK GDPR (applies to all users)

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data ('right to be forgotten'), where no legal obligation requires us to retain it
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, contact us at info@thekiltedunicorn.com. We will respond within one calendar month.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Additional rights for California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, disclose, or sell
• The right to delete personal information we hold about you
• The right to opt out of the sale of your personal information — note: we do not sell personal information
• The right to non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at info@thekiltedunicorn.com. We will respond within 45 days.

9. Cookies

Our website uses cookies to understand how visitors use the site and to improve your experience. We use:

• Essential cookies — necessary for the website to function (e.g. session management)
• Analytics cookies — to understand visitor behaviour (e.g. Google Analytics). These are anonymised and do not identify you personally

You can manage or disable cookies through your browser settings at any time. Disabling analytics cookies does not affect your ability to use our website or make a booking.

10. Data security

We take the security of your personal data seriously. We use industry-standard measures including encrypted communications (HTTPS), access controls, and regular security reviews of our digital infrastructure. Our key business systems are covered by a Cyber Insurance policy.

In the event of a data breach that affects your rights and freedoms, we will notify the ICO within 72 hours and inform you directly where required by law.

11. Third-party links

Our website may contain links to third-party websites (accommodation providers, tourist boards, activity operators). We are not responsible for the privacy practices of these sites and encourage you to read their own privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be published at thekiltedunicorn.com/privacy-policy with the date of the most recent update. We will notify you of significant changes by email where we hold your contact details.

13. Contact us

For any questions, requests, or concerns about this Privacy Policy or your personal data:

This policy applies to thekiltedunicorn.com and all services provided by TheCampBox Ltd under The Kilted Unicorn trading name. It is governed by UK law.