Controller: Prestbury Girls Academy.

The Academy operates connected services through prestburyacademy.co.uk, prestburygirls.co.uk, prestburytour.co.uk and prestbury.app. Prestbury Tours is the tour-management service within that digital estate.

Tour enquiries: tours@prestburyacademy.co.uk.

• Booker and participant names, contact details, dates of birth, team/age group and relationship details
• Booking references, tour selections, participant type, accommodation preferences and special requests
• Passport information, nationality, document status and passport/identification photographs where required for travel
• Emergency contacts and relevant parent/guardian information
• Medical conditions, allergies, medication, dietary requirements, support needs and relevant medical updates
• Travel, swimming, medication, photography/media and other tour-specific consent records
• Payments, refunds, balances, payment schedules and transaction/provider references
• Fundraising allocations and credits associated with a participant, booking, team or tour
• Participant-location information where a trip safety/location feature is deliberately enabled
• Messages, notifications, audit records and access/security information

• To create, administer and fulfil tour bookings
• To organise transport, accommodation, football, activities and participant logistics
• To manage payments, refunds, balances and fundraising allocations
• To protect participant safety, welfare and safeguarding
• To manage medical, dietary and emergency needs
• To check travel documentation and communicate required actions
• To maintain appropriate records, audit trails and security
• To communicate with bookers, parents/guardians, participants and authorised team contacts

The lawful basis depends on the purpose. We may rely on contract, legal obligation, legitimate interests, consent, recognised legitimate interests where applicable, or another lawful basis available under UK data-protection law.

Health information is special category data. Where we use medical, allergy, medication or other health information, we also identify an appropriate Article 9 condition, which may vary according to the circumstances.

Consent is used where it is genuinely the appropriate basis, for example certain optional media or location-sharing choices; we do not describe all tour processing as consent-based.

We share only what is reasonably necessary for the relevant purpose. Recipients may include:

• Authorised Academy and tour staff, coaches, welfare and medical personnel
• Transport providers, accommodation providers, tournament organisers, activity venues and relevant suppliers
• Healthcare professionals, emergency services and insurers where necessary
• Payment providers such as PayPal
• Fundraising providers such as RallyUp where used
• Technology/hosting providers supporting the service
• Authorities, regulators or professional advisers where required or reasonably necessary

Team managers may receive participant information only to the extent necessary for the team/tour role they are carrying out.

Travel documents and medical information require a higher level of care. Access is restricted to people who need the information for an authorised tour, welfare, travel or administrative purpose. Public pages must not expose passport numbers, medical details or other sensitive travel information.

Tour photography/public media is handled separately from operational football recording. An Academy or football-analysis permission does not automatically authorise promotional publication.

Where a location-sharing feature is enabled for participant safety, the relevant device permission and any required authorisation will be obtained. Location information will be restricted to authorised users and retained only for as long as reasonably required for the trip/safety purpose.

We keep information only for as long as necessary for the relevant booking, safeguarding, accounting, insurance, legal or evidential purpose. Different categories therefore have different retention periods rather than one blanket period.

Access controls, authentication, role restrictions, secure document handling and audit records are used where appropriate. No internet or storage system can be guaranteed to be completely risk-free.

Many tour participants are children. We take account of their age, understanding and best interests when using their information. Parents/guardians may act on behalf of a child where appropriate, but information rights belong to the child and the way those rights are exercised depends on age, understanding, circumstances and applicable law.

Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection and data portability, and the right to withdraw consent where processing relies on consent.

Privacy/data-protection complaints may be submitted to the Academy. We aim to acknowledge formal complaints within 5 working days and will investigate and communicate the outcome. You may also complain to the Information Commissioner's Office.

See our Cookie & Storage Technology Policy for information about cookies, localStorage, sessionStorage and similar technologies used by the tour service.

Prestbury Girls Academy – Prestbury Tours

Email: tours@prestburyacademy.co.uk

Master privacy notice: Prestbury Girls Academy Privacy & Data Protection Notice.