Last updated: 13 September 2026
This Privacy Policy explains how Jonathan Holland trading as Devon and Cornwall Bushcraft (“we”, “us”, “our”) collects, uses, stores and shares personal information. It applies to our website, enquiries, bookings, courses, events, corporate and group activities, participant safety records and marketing.
1. Who is responsible for your information?
For the purposes of UK data-protection law, Jonathan Holland trading as Devon and Cornwall Bushcraft is the data controller for personal information we determine how and why to process. Contact us at info@devonandcornwallbushcraft.co.uk, telephone 07801 400628, or write to Ambleside, 33 Firleigh Road, Kingsteignton, TQ12 3NH.
2. Information we may collect
- Identity and contact information, such as name, address, email address and telephone number.
- Booking and transaction information, including activities booked, dates, participant numbers, payments and booking correspondence.
- Participant information, including age or date-of-birth information where relevant, emergency contact details, parent/guardian information and group or organisation details.
- Health, medical, injury, disability, allergy, medication, accessibility and suitability-to-participate information where relevant to safe participation. This is special-category personal data.
- Safety records, including signed participant declarations, safety-briefing acknowledgements, parental/guardian forms, risk-related declarations, accident, incident and near-miss information.
- Corporate, school, youth-group and organiser information supplied by the person arranging a booking.
- Enquiry and correspondence information from email, telephone, website forms and social-media communications.
- Photographs and video where taken in connection with our activities.
- Website and technical information such as IP address, browser/device information, cookies, analytics information and interactions with our website or advertising, where applicable.
- Marketing preferences and records of consent, unsubscribe or objection requests.
3. Why we use information and our lawful bases
We use personal information only where we have a lawful basis. Depending on the circumstances, these include:
- Contract: to respond to booking requests, take and administer bookings, take payment, send joining instructions and deliver the activity or service requested.
- Legal obligation: where information must be kept or used to meet applicable legal, tax, employment, health and safety or other regulatory obligations.
- Legitimate interests: to operate and improve our business, respond to enquiries, maintain appropriate business and safety records, prevent misuse, protect our property and legal rights, understand how our services are used and communicate with existing customers where lawful. We consider the impact on individuals before relying on this basis.
- Consent: where we ask for consent for a particular use, such as certain marketing or promotional photography. Consent can be withdrawn at any time, although withdrawal does not make earlier processing unlawful.
- Vital interests: exceptionally, where using or sharing information is necessary to protect someone’s life or physical safety in an emergency.
4. Health and other special-category information
Health information is particularly sensitive. Our insurer requires participants to complete suitability-to-participate information declaring fitness, existing injuries and/or medical conditions, and requires those declarations to be retained and available to insurers on request. We also need relevant health, allergy, disability and medication information to assess and manage safe participation.
We process special-category information only where both an Article 6 lawful basis and an appropriate additional condition under UK data-protection law apply. Depending on the circumstances this may include explicit consent, vital interests where a person cannot give consent, or processing necessary for the establishment, exercise or defence of legal claims. We collect only information reasonably relevant to the purpose, restrict access and apply additional care to its storage and disclosure.
5. Participant declarations and insurance records
Our liability insurance arrangements require us to obtain and retain certain participant records. These can include suitability-to-participate declarations, information about existing injuries and medical conditions, confirmation that a safety briefing was given, acknowledgement of the risks involved and parent/guardian signatures for participants under 16. We may make relevant records available to our insurer, insurance broker, claims handlers or professional advisers where required for insurance, claims or legal purposes.
We also maintain risk assessments and incident/accident records as part of our health-and-safety and insurance arrangements.
6. Children and young people
We may process information about children and young people when they participate in family, school, Scout, youth-group or other activities. We aim to collect only what is needed for booking, safeguarding, supervision, safety and insurance purposes. Where required, information and declarations for a participant under 16 must be supplied, signed or countersigned by a parent or guardian. We do not knowingly use children’s contact details for direct marketing without an appropriate lawful basis and safeguards.
7. Photographs and video
We may photograph or film activities for business records and promotion. Where consent is the appropriate basis, particularly for identifiable children, we will seek appropriate permission. You may tell us that you do not wish to appear in promotional photography. Withdrawal of consent will apply to future use where consent is the basis, but may not always require us to recall material already lawfully published.
8. Payments and booking providers
Payment and ticketing information may be processed by the payment, ecommerce or booking provider used for the transaction. We do not need to receive or retain full payment-card details where payment is handled directly by a payment provider. Providers process information under their own privacy terms as well as, where applicable, on our instructions.
8A. Pre-course forms and participant information
For certain courses, events and activities, we may ask the person making the booking and/or individual participants to complete an online pre-course or participant form. We currently use Jotform for this purpose. These forms may collect contact details, emergency contact information, age or parent/guardian details, medical conditions, existing injuries, allergies, medication, disabilities, accessibility requirements and other suitability information relevant to safe participation.
Information submitted through pre-course forms is used for course administration, participant safety, reasonable adjustments, emergency response, insurance requirements and, where necessary, the establishment, exercise or defence of legal claims. Access to health and other sensitive information is restricted to people who reasonably need it for those purposes. Jotform and other service providers involved in processing these forms may process information on our behalf in accordance with their contractual and data-protection obligations.
9. Who we may share information with
We do not sell personal information. Where necessary and lawful, information may be shared with service providers that help us operate our website, online forms, bookings, email, payments, customer management, analytics and marketing. These may include DreamHost for website hosting; CookieYes for consent management; HubSpot for enquiry forms, customer management and chat; Jotform for participant and pre-course forms; Stripe and applicable ticketing providers for bookings and payments; Google for services such as Site Kit, Analytics, reCAPTCHA and advertising measurement; Meta for the Meta Pixel and advertising; and Mailchimp where it is used for email marketing. We may also share relevant information with venues, instructors and subcontractors where they need it to deliver an activity safely; schools, corporate clients or group organisers where appropriate; and professional advisers, insurers, brokers, claims handlers, emergency services, regulators, courts or law-enforcement bodies where necessary.
Our current liability insurer is NPA Insurance Ltd t/a Peach and our cover is arranged through Activity Business Cover. Relevant participant, safety or incident information may be provided to them where required under our insurance arrangements or in connection with a claim.
10. Information received from other people
For group, corporate, school or youth bookings, an organiser may provide participant information to us. We may also receive information from a parent/guardian or another person acting for a participant. Where information is obtained from someone other than the individual, it will normally consist of the same booking, contact, participant, accessibility, medical or safety information described above and will be used for the relevant booking, safety and service-delivery purposes.
11. Website, cookies, analytics and advertising
Our website may use essential cookies required for functionality and, subject to applicable consent requirements, analytics or advertising technologies to understand website use and measure or improve advertising. Third-party services and embedded content may receive technical information such as IP address, browser/device identifiers and interaction data. Non-essential cookies or similar technologies will be used only in accordance with applicable consent requirements. Cookie choices can be changed through the controls made available on the website or browser settings.
12. Marketing
We may send marketing where you have consented or where another lawful route permits it. You can unsubscribe from email marketing using the unsubscribe facility provided or by contacting us. You have the right to object to direct marketing at any time, and we will stop using your information for that purpose.
13. International transfers
Some website, email, analytics, payment, CRM, advertising or cloud-service providers may process information outside the UK. Where personal information is transferred internationally, we require an appropriate lawful transfer mechanism or safeguard where required by UK data-protection law, such as UK adequacy regulations or approved contractual safeguards. You may contact us for more information about safeguards relevant to your information.
14. How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, tax, safety, insurance and claims requirements. Different records therefore have different retention periods.
- Booking, invoice and accounting records are generally retained for the period required for tax/accounting and potential legal claims.
- Participant suitability, medical, parental/guardian and safety declarations are retained for as long as required by our insurance arrangements and for relevant legal/claims purposes. Our policy specifically requires copies of participant declarations to be retained and available to insurers on request.
- Accident and incident records are retained for the applicable health-and-safety, insurance and legal-claims period. Our insurance Statement of Fact records that we keep an accident book for a minimum of three years.
- Employers’ Liability insurance certificates and related historic evidence may be retained long term; our insurer recommends retaining Employers’ Liability certificate details for at least 40 years.
- Marketing information is kept until consent is withdrawn, an objection is made, it is no longer needed, or our retention review determines it should be deleted; we may retain a minimal suppression record so that an unsubscribe request continues to be respected.
- Website security and technical logs are retained for periods appropriate to security and operational needs.
Where an insurer requires a record to be permanently retained, or where an incident or claim makes longer retention necessary, we may retain the relevant record for that longer period. We periodically review information and securely delete or anonymise it when it is no longer required.
15. Security
We use reasonable organisational and technical measures appropriate to the nature of the information we hold. Access to sensitive participant and medical information is limited to people who need it for safety, administration, insurance or legal purposes. No internet or storage system can be guaranteed completely secure, but we take reasonable steps to protect information against unauthorised access, loss, alteration or disclosure.
16. Your data-protection rights
Depending on the circumstances and lawful basis, you may have rights to access your personal information; correct inaccurate information; request erasure; restrict processing; receive certain information in a portable form; and object to processing. Where processing is based on consent, you may withdraw consent at any time. These rights are not absolute and legal or insurance record-keeping requirements may mean that some information cannot be deleted immediately.
Your right to object: You have an absolute right to object to your personal information being used for direct marketing. You may also have a right to object where we rely on legitimate interests, in which case we will consider your circumstances and whether we have compelling legitimate grounds to continue.
To exercise a right, contact info@devonandcornwallbushcraft.co.uk. We may need to verify your identity before acting on a request.
17. Complaints about data protection
Please contact us first if you have concerns about how we use personal information so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Current contact and complaint information is available at ico.org.uk/make-a-complaint/.
18. Is providing information mandatory?
Some information is necessary to enter into or administer a booking. Relevant participant health, suitability and safety declarations may also be required as a condition of safe participation and under our insurance arrangements. If required information is not provided, we may be unable to confirm a booking or allow a person to take part in a particular activity.
19. Automated decision-making
We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on participants or customers. Safety and suitability decisions are made with human involvement.
20. Changes to this policy
We may update this Privacy Policy when our activities, systems, service providers, insurance requirements or the law change. The latest version will be published on this page with its update date.
Privacy enquiries
Devon and Cornwall Bushcraft
Email: info@devonandcornwallbushcraft.co.uk
Telephone: 07801 400628
Address: Ambleside, 33 Firleigh Road, Kingsteignton, TQ12 3NH