Privacy policy
In short: we collect only what we need to book your tour, take payment and stay in touch about your booking. We never sell your personal data.
Analytics and advertising cookies are used only if you agree to them, and you can change your choice at any time.
1. Who is responsible for your data
Bright Function Limited is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
Bright Function Limited85 Woodlands Lane
Chichester
West Sussex
PO19 7NQ
United Kingdom
Company number 9016105, registered in England and Wales
Email: [email protected]
Phone: +44 734 716 9708 (Monday to Sunday, 9:00–18:00 (Budapest time))
For any privacy question or request, email [email protected].
2. Data we collect
Data you give us
- Booking details: your name, email address, phone number, chosen tour date and time, ticket types and number of visitors, and whether you selected EU/EEA pricing.
- Messages you send us by email, phone, chat or messaging apps.
Payment data
Card payments are handled by [PAYMENT PROVIDER, e.g. Stripe]. We receive confirmation of payment, the amount, and limited card details such as the card type and last four digits. We never receive or store your full card number.
Data collected automatically
- Technical data such as IP address, browser and device type, and pages visited, collected by our hosting provider for security and to keep the site working.
- If you accept analytics or advertising cookies: how you use the site and whether you arrived from an ad (see section 4).
3. How we use your data and why
| Purpose | Data used | Legal basis |
|---|---|---|
| Make your booking, obtain and deliver your ticket | Booking details | Performance of a contract |
| Take payment and issue refunds | Booking and payment data | Performance of a contract |
| Contact you about your booking, including changes and cancellations | Name, email, phone | Performance of a contract |
| Answer questions and handle complaints | Messages, booking details | Legitimate interests (customer service) |
| Keep accounting and tax records | Booking and payment data | Legal obligation |
| Prevent fraud and keep the website secure | Technical and payment data | Legitimate interests (security, fraud prevention) |
| Measure site usage and improve the site | Analytics cookie data | Consent |
| Measure the results of our ads | Advertising cookie data | Consent |
We do not send marketing emails unless you have opted in. You can unsubscribe at any time using the link in the email.
4. Cookies and similar technologies
We use:
- Strictly necessary cookies that make booking and payment work and remember your cookie choice. These don't need consent.
- Analytics cookies (Google Analytics) to understand how visitors use the site. Used only with your consent.
- Advertising cookies (Google Ads) to measure whether our ads lead to bookings. Used only with your consent.
We use Google Consent Mode: until you accept, Google tags do not set analytics or advertising cookies. You can change or withdraw your consent at any time using the "Cookie settings" link in the footer of every page. Learn how Google uses data at policies.google.com/technologies/partner-sites.
5. Who we share data with
We share personal data only as needed to provide our service:
- the primary ticket provider, where visitor details are needed to issue your ticket;
- [PAYMENT PROVIDER, e.g. Stripe], to process payments and refunds;
- our website hosting, email and customer support providers, who act on our instructions;
- Google, for analytics and ad measurement, only if you have consented;
- professional advisers such as accountants, and authorities where the law requires it.
We do not sell or rent your personal data.
6. International transfers
Some of our providers process data outside the UK and the European Economic Area, for example in the United States. When this happens, we rely on an adequacy decision or on safeguards approved by UK and EU law, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.
7. How long we keep data
- Booking and payment records: 6 years after the end of the financial year of your booking, as required by UK tax law.
- Customer service messages: 2 years after your tour, unless needed for a complaint or legal claim.
- Analytics data: up to 14 months.
8. Security
The website uses HTTPS encryption. Access to personal data is limited to people who need it to provide our service, and our providers are bound by confidentiality and data protection obligations.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we don't need to keep it by law;
- restrict or object to our use of your data, including for direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing before you withdrew it.
To use any of these rights, email [email protected]. We reply within one month.
10. How to complain
Please contact us first so we can try to help. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EU, to the data protection authority in your country.
11. Children
Bookings must be made by adults aged 18 or over. We do not knowingly collect data from children, other than the number and age category of children on a booking.
12. Changes to this policy
We may update this policy. The date at the top shows when it was last changed.