Wayfinding Kaia customer privacy notice

This privacy notice tells you what to expect us to do with your personal information.

  • Contact details

  • What information we collect, use, and why

  • Lawful bases and data protection rights

  • Where we get personal information from

  • How long we keep information

  • Who we share information with

  • How to complain

Contact details

Email

wayfindingkaia@gmail.com

What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details

  • Addresses

  • Date of birth

  • Purchase or account history

  • Payment details (including card or bank information for transfers and direct debits)

  • Health information (including dietary requirements, allergies and health conditions)

  • Health and safety information

  • Information relating to loyalty programmes

  • Website user information (including user journeys and cookie tracking)

  • Photographs or video recordings

We collect or use the following information for the operation of customer accounts and guarantees:

  • Names and contact details

  • Addresses

  • Payment details (including card or bank information for transfers and direct debits)

  • Marketing preferences

We collect or use the following information for service updates or marketing purposes:

  • Names and contact details

  • Addresses

  • Marketing preferences

  • Location data

  • Recorded images, such as photos or videos

  • Purchase or viewing history

  • IP addresses

  • Website and app user journey information

  • Records of consent, where appropriate

We collect or use the following information for scientific or historical research purposes, for statistical purposes or for archiving in the public interest:

  • Names and contact details

  • Addresses

  • Location data

  • Personal information used for administration of research

  • Personal information used for the purpose of research

We collect or use the following information to comply with legal requirements:

  • Name

  • Contact information

  • Financial transaction information

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details

  • Payment details

  • Account information

  • Purchase or service history

  • Video recordings of public areas

  • Audio recordings of public areas

  • Relevant information from previous investigations

  • Information relating to health and safety

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for scientific or historical research purposes, for statistical purposes or for archiving in the public interest are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

    • We use aggregated information provided by our members such as age, location, name, email address, phone number or addresses and personal interests to understand our community better and plan events that reflect what our members would genuinely enjoy. This helps us make informed decisions about future event categories, timings and formats, ensuring the experiences we offer remain relevant and enjoyable for the people we serve.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for legal requirements are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

    • We collect and use personal information when someone raises a query, complaint or claim so that we can properly investigate the issue, respond appropriately, and put things right where needed. This may include the person\'s name, contact details, booking history, and any relevant correspondence. This benefits both the individual and our business. It allows us to resolve issues fairly and efficiently, improve our events based on genuine feedback, and maintain trust within our community. Without processing this information, we would be unable to properly investigate or respond to concerns raised by our members. We only use this information for the purpose of resolving the specific issue raised, and we do not use it for any other purpose such as marketing. We keep this information only for as long as necessary to resolve the matter and meet any relevant legal or accounting requirements. We believe this processing is proportionate and does not unfairly override the rights and interests of the individual, as it directly benefits them by enabling us to address their concern.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you

How long we keep information

We only keep personal information for as long as necessary to fulfil the purposes we collected it for, or to meet our legal and accounting obligations. Below is a summary of how long we typically retain different types of information.

Booking and payment records
We keep transaction and financial records for 6 years, in line with HMRC requirements for business record keeping.

Membership and account information
We keep membership details for as long as you remain an active member, plus a further 12 months after you stop engaging with us, after which your information is deleted or anonymised.

Marketing consent (newsletter and community communications)
We keep a record of your marketing consent for as long as you remain subscribed. If you unsubscribe, we retain a minimal record of this for 12 months, solely to demonstrate compliance with your request, after which it is deleted.

Complaints, queries and claims
We keep records relating to complaints or queries for 3 years following resolution, in case further correspondence or dispute resolution is required.

Travel and trip-specific information
For travel, sensitive information including medical conditions, insurance details and emergency contacts is deleted within 3 months of the trip's conclusion, unless a longer period is required to resolve an ongoing issue such as an insurance claim.

Photographs and video
We may retain photographs and video taken at events for marketing purposes for up to 3 years, after which they are reviewed and either retained for continued use or deleted.

If you would like your information deleted sooner, you can contact us directly and we will action your request in line with your rights under UK GDPR.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.

Who we share information with

Data processors

Stripe, Inc., payment processing sector, financial technology industry, based in the United States with UK operations through Stripe Payments UK Ltd, London, United Kingdom

This data processor does the following activities for us: Stripe processes and handles all payment transactions on our website, including securely collecting and processing customers\' payment card details. We do not store or have access to full card information ourselves.

Squarespace, Inc., website hosting and e-commerce platform sector, technology industry, based in New York, United States

This data processor does the following activities for us: Squarespace hosts our website and stores the personal information submitted through our online forms, such as names, email addresses and event booking details. Squarespace also powers our email marketing campaigns.

Others we share personal information with

  • Organisations we’re legally obliged to share personal information with

  • Publicly on our website, social media or other marketing and information media

  • Suppliers and service providers

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Online: www.wayfindingkaia.co.uk/contact

Email: wayfindingkaia@gmail.com

By using our Services, you consent to the terms of this Privacy Policy.

Wayfinding Kaia 2026

This Privacy Policy was last updated on: 11th August 2026