Table of Contents
Introduction
Welcome to the LDN Tour Privacy Policy.
LDN Tour is a trading name of Demapal Ltd. We respect your privacy and are committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use our website, submit an enquiry, request a quotation, communicate with us, ask us to arrange services, make a booking, or otherwise engage with us.
It also explains your privacy rights and how the law protects you.
Please read this Privacy Policy together with any other privacy notice or fair processing notice we may provide in specific situations, so that you understand how and why we use your data.
1. Important information and who we are
1.1 Controller
Demapal Ltd is the controller and is responsible for your personal data.
In this Privacy Policy, references to “LDN Tour”, “Demapal Ltd”, “we”, “us” or “our” mean Demapal Ltd trading as LDN Tour.
1.2 Contact details
Full legal entity name: Demapal Ltd
Trading name: LDN Tour
Registered office: 16 Upper Woburn Place, London WC1H 0AF, United Kingdom
Company number: 11059790
Privacy enquiries: info@demapal.com
Telephone: +44 20 7183 6290
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters. We would, however, appreciate the opportunity to deal with your concerns first, so please contact us before approaching the ICO.
1.3 Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our business practices, our service providers, or the way we use personal data.
The latest version will always be published on this website.
Last updated: 17 April 2026
2. The personal data we collect
Personal data means any information that can identify an individual.
We may collect, use, store and transfer different kinds of personal data, including the following.
| Category of data | Examples |
|---|---|
| Identity Data | First name, last name, title, company name, passenger names, representative details |
| Contact Data | Email address, telephone number, WhatsApp number, billing address, correspondence address |
| Booking and Enquiry Data | Travel dates, group size, traveller details, hotel or area of stay, itinerary preferences, accessibility or mobility needs, ticket requests, luggage details, scheduling preferences |
| Financial Data | Payment-related details, payer details, billing references |
| Transaction Data | Quotations, invoices, payment records, refunds, receipts, service history |
| Communications Data | Emails, WhatsApp messages, website form submissions, call notes, fax messages, and where applicable lawful call recordings |
| Technical and Usage Data | IP address, browser type, device information, page views, referring URLs, cookie-related data |
| Marketing and Preferences Data | Your preferences regarding marketing communications and communication methods |
| Special Category / Sensitive Data | Information voluntarily provided by you that may be relevant to the booking, such as accessibility needs, dietary requirements or mobility information |
We do not generally seek special category data unless it is genuinely relevant to the service requested.
3. If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In that case, we may have to refuse or cancel the relevant service.
4. How we collect your personal data
We use different methods to collect data from and about you, including:
4.1 Direct interactions
You may give us your personal data by:
- filling in website forms;
- sending us a WhatsApp message;
- telephoning us;
- corresponding with us by email, fax or post;
- requesting a quotation;
- asking us to arrange a booking;
- making payment;
- replying to our messages;
- giving feedback or reviews.
4.2 Automated technologies
As you interact with our website, we may automatically collect technical and usage data through cookies and similar technologies.
4.3 Third parties and suppliers
We may receive relevant personal data from payment providers, guides, transport operators, ticketing services, venues, professional advisers, analytics providers, website service providers and similar third parties where this is reasonably necessary for the requested service.
5. How we use your personal data
We will only use your personal data where the law allows us to do so.
Most commonly, we use your personal data in the following circumstances:
- where we need to take steps at your request before entering into a contract;
- where we need to perform a contract with you;
- where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests;
- where we need to comply with a legal or regulatory obligation;
- where you have given consent, where consent is the appropriate lawful basis.
ICO guidance expects privacy information to explain the purposes of processing, the lawful basis, the recipients, international transfers, retention, and people’s rights. (OpenAI Help Center)
5.1 Purposes and lawful bases
| Purpose | Types of data used | Lawful basis |
|---|---|---|
| To respond to enquiries and prepare quotations | Identity, Contact, Booking and Enquiry Data, Communications Data | Steps at your request before entering into a contract; Legitimate interests |
| To arrange and administer bookings and services | Identity, Contact, Booking and Enquiry Data, Financial Data, Transaction Data, Communications Data | Performance of a contract; Steps at your request before entering into a contract; Legitimate interests |
| To process payments, issue invoices and keep records | Identity, Contact, Financial Data, Transaction Data | Performance of a contract; Legal obligation; Legitimate interests |
| To manage our relationship with you | Identity, Contact, Communications Data, Transaction Data | Performance of a contract; Legitimate interests; Legal obligation where relevant |
| To operate, protect and improve our business and website | Identity, Contact, Technical and Usage Data, Communications Data | Legitimate interests |
| To request feedback or reviews | Identity, Contact, Communications Data | Legitimate interests; Consent where required |
| To send marketing communications | Identity, Contact, Marketing and Preferences Data | Consent, where consent is required |
| To establish, exercise or defend legal claims, prevent fraud, and comply with law | Identity, Contact, Transaction Data, Communications Data, Financial Data | Legal obligation; Legitimate interests |
5.2 Marketing
We strive to give you clear choices about marketing communications.
If you opt in to receive marketing, you can unsubscribe at any time by using the unsubscribe link in the email or by contacting us directly.
We do not treat a general enquiry or booking request as automatic consent to marketing.
5.3 Change of purpose
We will only use your personal data for the purposes for which we collected it unless we reasonably consider that another use is compatible with the original purpose and lawful.
If we need to use your personal data for a materially different purpose, we will update this Privacy Policy or otherwise notify you where appropriate.
6. Use of AI tools and technology providers
We may use artificial intelligence or language-assistance tools, including tools made available by third-party providers, to assist with tasks such as:
- drafting replies;
- translation;
- summarising information;
- organising enquiries;
- document handling;
- text extraction or OCR-style processing where reasonably necessary;
- internal administration and efficiency support.
Where such tools are used, we aim not to input more personal data than is reasonably necessary for the relevant purpose.
If OpenAI or ChatGPT-based tools are used, the privacy implications may differ depending on the product and settings used. OpenAI states that content submitted to ordinary consumer ChatGPT services may be used to improve model performance depending on user settings, while API, ChatGPT Business and ChatGPT Enterprise content is not used by default to improve models unless the customer explicitly opts in. (OpenAI Help Center)
For that reason, where AI tools are used in connection with client information, we may minimise identifiable data, use business-grade products where appropriate, or apply additional safeguards where available.
7. Disclosures of your personal data
We may share your personal data where necessary with the following categories of recipients:
| Recipient category | Examples |
|---|---|
| Service suppliers | Guides, transport operators, ticketing providers, venues, restaurants, attractions, concierge-style suppliers |
| Payment and finance providers | Stripe, PayPal, GoCardless, banks, accountants |
| Business administration systems | Xero, Microsoft 365 / Outlook, Trello |
| Cloud storage and backup providers | pCloud, Synology and similar systems used for storage, file handling or backup |
| Website and technical providers | Hosting providers, WordPress-related systems, website form tools, analytics tools, email delivery systems |
| Professional advisers | Solicitors, auditors, insurers, consultants |
| Regulators and authorities | HMRC, ICO, courts, law enforcement and other authorities where required by law |
| AI and automation tools | OpenAI / ChatGPT-based tools and other language-assistance or administration tools, where applicable |
We require third-party service providers to respect the security of your personal data and to process it in accordance with the law.
We do not sell your personal data.
8. International transfers
Some of our service providers may process or store personal data outside the United Kingdom.
Where personal data is transferred internationally, we will take reasonable steps to ensure that appropriate safeguards are in place, such as:
- adequacy regulations;
- standard data protection clauses, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum, where appropriate;
- contractual, organisational or technical measures appropriate to the risk.
ICO guidance explains that restricted transfers outside the UK require a valid basis such as adequacy regulations, appropriate safeguards, or a recognised exception, and that the IDTA and Addendum are examples of UK transfer tools. (ICO)
Because payment providers, cloud services, analytics tools and AI tools may involve international infrastructure, you should not assume that all personal data remains solely within the UK.
9. Data security
We have put in place appropriate security measures designed to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way.
We also limit access to personal data to those persons and service providers who have a genuine business need to know it.
We have procedures in place to deal with suspected personal data breaches and will notify you and any applicable regulator where legally required.
10. Data retention
We keep personal data only for as long as reasonably necessary for the purposes for which we collected it, including for satisfying legal, tax, accounting, regulatory, insurance and dispute-resolution requirements.
10.1 Retention schedule
| Type of record | Typical retention approach |
|---|---|
| Client identity, contact, transaction and billing records | Up to six years after the end of the relevant client relationship, where needed for legal, tax, accounting and record-keeping purposes |
| Quotations, invoices and payment records | Up to six years or longer where required for claims or legal compliance |
| General enquiry records that do not become bookings | For a reasonable business period, then deleted or anonymised unless needed for follow-up or legal reasons |
| Marketing preferences and opt-in / opt-out records | Kept as long as reasonably necessary to respect your preferences and demonstrate compliance |
| Website and technical records | Kept according to operational need, security need and cookie settings |
| Backups and archives | Retained in line with technical, security and disaster-recovery requirements, then cycled out or overwritten |
In some cases, we may keep information for longer where this is necessary to establish, exercise or defend legal claims, or where we are required by law to do so.
In some cases, we may anonymise data so that it can no longer be associated with you, and we may then use that information without further notice.
11. Your legal rights
Under data protection law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete personal data;
- request erasure of your personal data;
- object to processing based on legitimate interests;
- request restriction of processing;
- request transfer of your personal data in a structured, commonly used, machine-readable format, where applicable;
- withdraw consent at any time where we rely on consent.
If you wish to exercise any of your rights, please contact us using the details above.
12. Cookies and similar technologies
Our website uses cookies and similar technologies.
For this reason, we use a cookie banner and cookie settings tool to manage cookie preferences. Further information is available in our Cookie Policy.
13. Third-party websites
This website may contain links to third-party websites. We are not responsible for the privacy practices, content or security of third-party websites.
14. Complaints
If you have any concerns about how we use your personal data, please contact us first.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
15. Final note
If you have any questions about this Privacy Policy, your data, or how we use personal information in connection with LDN Tour and Demapal Ltd, please contact us.