This explains what we collect when you book one of our events, why we need it, and what we do with it. The short version: we ask only for what we need to run a safe event, we don't sell anything to anyone, and you can ask us to delete it.
Who we are
Ummatically runs retreats, outdoor experiences and training programmes in the United Kingdom. For data protection purposes we are the "data controller" for the information described here.
To contact us about anything on this page, email abuobaydahalyafawe@gmail.com.
What we collect, and why
Almost everything we hold comes from the booking form you fill in yourself.
| What | Why we need it |
|---|---|
| Name, email, phone number | To confirm your place, send joining instructions, and reach you if plans change |
| Age | Some activities have minimum ages and different supervision requirements |
| Emergency contact name and number | So we can reach someone on your behalf if you are hurt or unwell |
| Dietary requirements and allergies | To feed you safely |
| Medical conditions and injuries | So we can plan activities safely and respond properly in an emergency |
| Number of places, and any notes you add | To organise accommodation, transport and group sizes |
| How you heard about us | To understand what is working. Optional |
| Whether you consent to photography | To honour your choice when we take photos |
Health information
Dietary, allergy and medical details are treated as a special category of personal data and given extra care. We collect them because outdoor and physical activity carries real risk and we cannot keep you safe without knowing. We rely on your explicit consent, given when you submit the form, and on our need to protect the vital interests of anyone at the event.
These details are seen only by the people organising and running your event, and only when needed. They are never used for marketing, never shared with other attendees, and never sent to our payment provider.
Payment information
We do not see, handle or store your card details. Payments are taken by Stripe, who process them on their own systems. We receive only a confirmation that payment succeeded, the amount, and a reference. Stripe holds your name and email as their own controller under their privacy policy.
Our legal bases
- Performing our contract with you — taking your booking, taking payment, and running the event you paid for.
- Your explicit consent — health and dietary information, and the use of photographs where you have agreed.
- Protecting vital interests — using emergency and medical details if someone's health or safety is at risk.
- Our legitimate interests — keeping records of past events, and understanding how people find us. You can object to this at any time.
- Legal obligation — keeping financial records for as long as the law requires.
Where your information is kept
Bookings are stored in Google Sheets and processed by Google Apps Script, both provided by Google. Emails are sent through Google. Payments run through Stripe. These providers act on our instructions, and both may process data outside the UK under safeguards approved for international transfers.
We do not sell your information, and we do not share it with anyone else except where we are required to by law.
How long we keep it
- Health, dietary and emergency contact details — deleted within 3 months of the event finishing. We have no reason to keep them longer.
- Booking and contact records — kept while you may want to hear from us, and reviewed periodically.
- Payment and financial records — kept for 6 years, as UK tax law requires.
- Unfinished bookings — where payment was never completed, removed within 3 months.
Photography
We take photographs and video at our events and use them to show what we do. The booking form asks whether you are happy to appear, and your answer is recorded against your booking. If you say no, we will not knowingly use images of you. If you change your mind, or spot yourself in something you would rather we removed, email us and we will take it down.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of what we hold about you;
- correct anything that is wrong;
- delete your information, where we do not need to keep it;
- stop or limit how we use it;
- send your information to you or someone else in a portable form;
- withdraw consent you have given — including for health details or photography.
Withdrawing consent for health information may mean we cannot safely offer you a place on a physical event. We will tell you if that is the case rather than simply cancelling on you.
Email abuobaydahalyafawe@gmail.com and we will respond within one month. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
This website sets no tracking or advertising cookies and does not use analytics. Our fonts are loaded from Google Fonts, which means your browser makes a request to Google when the page loads. When you pay, Stripe sets cookies on its own checkout page, which its privacy policy covers.
Our trailer is hosted on YouTube. Until you press play, nothing is requested from them — you see only a still image served from this site. Once you press play the video loads from YouTube, which may set cookies and record that you watched it. We use their no-cookie domain, which limits this, but if you would rather avoid it entirely, simply do not press play.
Keeping it secure
Booking records are held in a Google account protected by a password and two-step verification, and are shared only with the people who need them. Payment card details never reach us. No system is perfectly secure, but if something happened that put your information at risk we would tell you and the ICO where the law requires it.
Changes to this policy
If we change how we use your information we will update this page and change the date at the top. For anything significant, we will tell people who have booked with us directly.