Privacy Policy

Plain-English summary

TripCaptain helps schools, clubs and other group organisers manage trips. The organisation running a trip normally decides what passenger information is collected and why. TripCaptain provides the platform and processes that information on the organisation’s instructions. TripCaptain separately uses limited account, service and billing information to operate its own business.

1. Who we are

TripCaptain is operated by [FULL LEGAL NAME], trading as TripCaptain (“TripCaptain”, “we”, “us” or “our”). Our [registered/business] address is [ADDRESS]. Our company number is [NUMBER, IF APPLICABLE].

Questions about this policy or personal information can be sent to [PRIVACY EMAIL] or to the address above, marked for the attention of [PRIVACY LEAD OR DPO, IF APPLICABLE].

2. When this policy applies

This policy applies when you visit tripcaptain.co.uk, create or use a TripCaptain account, receive a TripCaptain invitation or unique access link, submit information for a trip, communicate with us, or otherwise use the TripCaptain service.

A school, club, team, charity, company or other group that creates and manages a trip is referred to as an “Organiser”. A person whose information relates to a trip is referred to as a “Passenger”. Passengers may include children.

3. Our data-protection roles

3.1 Information controlled by the Organiser

For Passenger information, booking information and other trip records entered into TripCaptain by or for an Organiser, the Organiser will normally be the controller and TripCaptain will normally act as its processor. The Organiser decides what information is required, why it is used, who can access it and how long it should be retained, subject to applicable law and its agreement with us.

Questions about how a particular school or club uses Passenger information should normally be directed to that Organiser. We will support the Organiser in responding where required by our agreement and data-protection law.

3.2 Information controlled by TripCaptain

TripCaptain is normally the controller for information used to create and secure accounts, administer subscriptions and invoices, provide support, prevent misuse, understand service performance, meet our legal obligations and communicate about our service.

3.3 Separate controllers

Travel operators, airlines, accommodation providers, payment providers and other third parties may act as separate controllers under their own privacy notices. TripCaptain does not control their independent use of personal information.

4. Information we may collect

Please do not enter information that the Organiser has not asked for or does not need. Organisers should avoid collecting passport, medical or other sensitive details unless necessary, lawful and appropriately protected.

5. How and why information is used

Where TripCaptain acts as processor, the Organiser is responsible for identifying and communicating its lawful basis and, where special-category information is involved, an applicable additional condition under UK GDPR and the Data Protection Act 2018. Consent is not automatically the correct basis for school processing and should not be presented as the only option without legal review.

6. Children and safeguarding

TripCaptain is intended to be configured and administered by authorised adults. Children should not create Organiser accounts or independently contract for the service. A parent, guardian, school or club may provide information about a child where it has authority and a lawful reason to do so.

TripCaptain is an administration platform. It does not verify the suitability of adults, conduct safeguarding checks, supervise children or assume the safeguarding duties of a school, club, tour operator or group leader. Safeguarding concerns should be reported immediately to the Organiser and, where a child is at immediate risk, to the appropriate emergency services or safeguarding authority.

7. AI-assisted features

TripCaptain may provide AI-assisted tools to help authorised users draft itineraries, identify missing administrative information, summarise non-sensitive trip information, estimate costs or produce planning suggestions. AI output may be incomplete or inaccurate and must be reviewed by a responsible adult before it is relied upon.

• We will describe when an AI feature is being used and what information is submitted to it.
• Organisers must not place children’s personal information, passport details, medical information or other special-category information into free-text AI prompts unless the feature is expressly designed, contracted and approved for that purpose.
• [CONFIRM AND INSERT: AI provider, processing location, retention settings, whether inputs are used for provider model training, and contractual safeguards.]
• TripCaptain will not make solely automated decisions that produce legal or similarly significant effects about passengers unless clearly disclosed and lawfully implemented.

8. Who information is shared with

Information may be shared only where necessary with:

• authorised users of the relevant Organiser, according to their assigned permissions;
• parents, guardians or passengers through access links or accounts configured for their booking;
• service providers supporting hosting, storage, authentication, email, customer support, analytics, security, payments and AI features;
• travel, accommodation or activity suppliers where the Organiser directs or enables that disclosure;
• professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies or public authorities where reasonably necessary or legally required; and
• a buyer, investor or successor in connection with a proposed or completed business transfer, subject to appropriate confidentiality and data-protection safeguards.

A current list of material subprocessors should be maintained at [SUBPROCESSOR PAGE URL] or provided on request. We do not sell personal information.

9. International transfers

Some suppliers may process information outside the United Kingdom. Where UK personal information is transferred internationally, we will use a lawful transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, and appropriate supplementary measures. [INSERT ACCURATE SUPPLIER AND LOCATION DETAILS.]

10. Security

We use proportionate technical and organisational measures designed to protect personal information. These should include, as applicable, encrypted network connections, controlled access, role-based permissions, secure authentication, logging, backups, vulnerability management, supplier due diligence, incident response and staff confidentiality obligations. No online service can guarantee absolute security.

Organisers and users are responsible for protecting account credentials and unique links, assigning access only to appropriate people, promptly removing access that is no longer needed and telling us at [SECURITY EMAIL] about suspected unauthorised access.

11. Retention and deletion

We retain personal information only for as long as it is needed for the purpose for which it was collected, to follow the Organiser’s documented instructions, and to meet legal, accounting, security and dispute-resolution requirements.

The Organiser may have its own retention policy. Deletion from TripCaptain does not necessarily delete copies already lawfully provided to the Organiser or an independent third party.

12. Your rights

Depending on the circumstances, individuals may have rights to be informed; obtain access; correct inaccurate information; request erasure or restriction; object to processing; receive portable information; withdraw consent where consent is relied upon; and obtain safeguards relating to automated decision-making.

For information controlled by a school, club or other Organiser, contact that Organiser first. If a request is sent to us, we may need to refer it to the Organiser and assist it. For information controlled by TripCaptain, contact [PRIVACY EMAIL]. We may need to verify identity and will respond within the period required by law.

You may complain to the UK Information Commissioner’s Office at ico.org.uk, or to another competent supervisory authority. We would welcome the opportunity to address the concern first.

13. Cookies and similar technologies

TripCaptain may use strictly necessary cookies or local storage for authentication, security and service operation. Any non-essential analytics or advertising technologies will be used only with the choices and consent required by law. Details should be provided in a separate cookie notice or consent interface at [COOKIE NOTICE URL].

14. Accuracy, links and third-party services

Users and Organisers should keep information accurate and current. TripCaptain may contain links to third-party services. Their privacy practices are governed by their own notices, and users should review them before providing information.

15. Changes to this policy

We may update this policy to reflect product, legal or operational changes. We will publish the updated version and date. Where a change is material, we will take reasonable steps to notify affected account holders or Organisers before it takes effect where appropriate.

16. Contact

Privacy enquiries: [PRIVACY EMAIL]

Security reports: [SECURITY EMAIL]

Postal address: [ADDRESS]

Data Protection Officer (if appointed): [NAME/CONTACT OR “Not appointed”]