Privacy Policy

Elevate Outdoors ("Elevate Outdoors", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights in relation to it.

By using our website or booking any of our services, you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Information You Provide Directly

We collect personal information you voluntarily give us when you:

• Submit a trip reservation form (name, email address, phone number, number of people, and any notes)
• Send us a message through the Contact page (name, email, phone, subject, message)
• Communicate with us by email, phone, or WhatsApp

1.2 Information Collected Automatically

When you visit our website, we may automatically collect certain technical information, including your IP address, browser type and version, pages visited, time and date of your visit, and referring website. This information is used to maintain the security and performance of the website and is not linked to your personal identity.

1.3 Sensitive Information

If you voluntarily disclose health-related information (such as medical conditions, dietary requirements, or disabilities) in order to facilitate your safe participation in a trip, we treat this information with the highest level of confidentiality and use it solely for the purpose of ensuring your safety and wellbeing.

2. How We Use Your Information

We use the personal information we collect to:

• Process and manage your trip reservations and send booking confirmation emails
• Communicate with you about your booking, including confirmations, reminders, and updates
• Respond to your enquiries and contact form messages
• Ensure your safety and the safety of others on our trips
• Send transactional emails via our email service provider (Resend)
• Improve our website, services, and trip offerings
• Comply with our legal obligations

We do not use your personal information for unsolicited marketing communications without your consent. If you wish to receive updates about upcoming trips and new adventures, we may ask your permission separately.

3. Legal Basis for Processing

We process your personal information on the following legal grounds:

• Contract performance: to fulfil your booking and deliver the services you have requested
• Legitimate interests: to operate and improve our business, and to communicate with you about your reservation
• Legal obligation: where we are required to retain or process information by law
• Consent: where you have explicitly given us permission to process your information for a specific purpose

4. How We Share Your Information

Elevate Outdoors does not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

4.1 Service Providers

We use trusted third-party service providers to help us operate our website and deliver services. These include:

• Supabase — our database provider, used to securely store reservation and contact information
• Resend — our email delivery service, used to send booking confirmation and auto-reply emails
• Vercel — our website hosting provider

Each provider is bound by their own privacy policies and data processing agreements and is only permitted to use your data to perform services on our behalf.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to a valid legal request from a public authority (such as a court or government agency).

4.3 Safety

In an emergency, we may share relevant personal or medical information with emergency services, medical personnel, or other parties necessary to protect your safety or the safety of others.

5. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements.

• Reservation records: retained for a minimum of 3 years for operational and legal purposes
• Contact messages: retained for 12 months from the date of receipt, then deleted unless an ongoing booking relationship exists
• Technical logs: retained for up to 90 days

You may request deletion of your personal information at any time (see Section 7 — Your Rights).

6. Data Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

• All data is stored on Supabase infrastructure with encryption at rest and in transit
• Access to admin features is protected by authenticated login and role-based access controls
• Row Level Security (RLS) policies ensure that personal data is only accessible to authorised administrators
• Our website is served over HTTPS (TLS encryption)

No method of data transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you suspect that your information has been compromised, please contact us immediately.

7. Your Rights

You have the following rights regarding your personal information:

• Right of access: you may request a copy of the personal information we hold about you
• Right to rectification: you may ask us to correct any inaccurate or incomplete information
• Right to erasure: you may request that we delete your personal information, subject to any legal obligations to retain it
• Right to restrict processing: you may ask us to limit how we use your information in certain circumstances
• Right to object: you may object to the processing of your information where we rely on legitimate interests as the legal basis
• Right to data portability: you may request a copy of your information in a structured, machine-readable format

To exercise any of these rights, please contact us at hello@elevateoutdoorske.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

8. Cookies

Our website uses a minimal number of cookies necessary for the site to function. These include session cookies used to maintain your authentication state when logged in to the admin portal. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

You can configure your browser to refuse cookies or to alert you when cookies are being set. Disabling cookies may affect the functionality of the admin portal but will not affect your ability to browse trips or submit a reservation.

9. Third-Party Links

Our website may contain links to third-party websites, including WhatsApp. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before submitting any personal information.

10. Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If a parent or guardian becomes aware that their child has provided us with personal information without consent, please contact us and we will delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. Updated policies will be posted on this page with a revised date. Your continued use of our website or services after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us