privacy policy.

1. who we are and scope

in this policy, participant means a person who makes or is named in a booking, or who takes part in a tour operated or arranged by Hardly Solo, and trip means that tour. this policy applies to all personal information we collect and use in connection with our website, bookings, marketing and tour operations.

2. information we collect

depending on how you interact with us, we may collect:

1. identity and contact details, including name, date of birth, age, address, email, phone number, nationality and passport or visa information;
2. booking, departure, itinerary, rooming, dietary, activity, preference, communication and customer-service information;
3. payment and transaction information. Stripe or another payment processor ordinarily collects complete card details; we generally receive transaction status, limited card metadata and identifiers;
4. travel-insurance details, including insurer, policy number, coverage and emergency-assistance contacts;
5. emergency-contact information and information about another person where you book or communicate on their behalf;
6. sensitive information, including health and medical conditions, medication, injury, pregnancy, disability, accessibility needs, allergies, dietary information that may reveal health or religious beliefs, and incident or emergency information;
7. photographs, video, audio, name, image, likeness, voice, statements and information about participation in a trip;
8. complaints, incident reports, witness accounts, conduct information and communications with us, insurers, suppliers or authorities;
9. website and device information, including IP address, cookie identifiers, browser and device type, approximate location, referral information, pages viewed, interactions and analytics or advertising data; and
10. marketing preferences, survey responses, competition entries, social-media interactions and other information you choose to give us.

3. how we collect information

we collect information directly from you through bookings, forms, waivers, email, phone, WhatsApp, social media, surveys, incident reporting and participation in a trip.

we may also collect information from a lead booker, another participant, emergency contact, travel insurer, Stripe, accommodation or activity provider, trip leader, authority, social-media platform, analytics or advertising service, or publicly available source.

if you give us information about another person, you must be authorised to do so and should make this policy available to them. we may separately notify them where required.

if required information is not provided, we may be unable to confirm a booking, assess a safety need, facilitate an activity, arrange assistance or comply with law.

4. why we use information

we use personal information to:

1. respond to enquiries, administer bookings and payments, form and perform the tour service agreement and provide trip services;
2. arrange accommodation, transport, meals, activities, rooming and supplier services;
3. assess trip suitability, insurance and participation requirements, make reasonable adjustments and manage health, safety, incidents, emergencies and evacuations;
4. communicate operational information, changes, reminders, safety notices and post-trip service information;
5. administer and enforce the tour service agreement, participant liability waiver and code of conduct, investigate complaints and resolve disputes;
6. comply with legal, regulatory, tax, accounting, insurance, safeguarding and law-enforcement obligations;
7. secure and improve our website, services, itineraries, customer experience and business operations;
8. create and use photographs, video and audio under the tour service agreement and applicable law; and
9. send marketing, measure campaigns and personalise advertising where permitted, subject to consent or opt-out rights.

5. legal bases under EU and UK data law

where EU GDPR or UK GDPR applies, we rely on one or more of the following lawful bases:

1. contract: processing needed to take booking steps or perform the tour service agreement;
2. legal obligation: processing needed to comply with applicable law;
3. legitimate interests: operating, securing and improving the business; communicating with customers; preventing fraud; managing complaints; and appropriately promoting services, where those interests are not overridden by your rights;
4. consent: for activities such as non-essential cookies, certain direct marketing, sensitive information and media use where consent is the required basis; and
5. vital interests: protecting life or physical safety where a person cannot give consent.

where we rely on legitimate interests, you may ask for information about our balancing assessment. where we rely on consent, you may withdraw it for future processing, but withdrawal does not affect earlier lawful processing.

6. sensitive and health information

we collect sensitive information only where you consent, the collection is reasonably necessary for our functions, or another legal exception applies. under EU or UK data law, we also identify an applicable special-category condition, ordinarily explicit consent or protection of vital interests in an emergency.

we ask participants to disclose only information we should reasonably know to facilitate safe participation or respond appropriately in an emergency. we do not use a diagnosis alone as an automatic basis for exclusion.

we restrict access to sensitive information, minimise what is shared and de-identify it before supplier disclosure where reasonably practicable. in an emergency, we may disclose necessary information to trip leaders, suppliers, health professionals, emergency services, insurers, emergency contacts or authorities.

7. who we disclose information to

we may disclose information to:

1. Sri Lankan and other accommodation, transport, activity, guide, restaurant and logistics providers, but only to the extent reasonably needed to supply services or manage safety;
2. Stripe and other payment, fraud-prevention, accounting and transaction providers;
3. website, cloud, email, form, booking, messaging, customer-support and IT providers;
4. analytics, advertising and content providers, which currently may include Google services, Meta/Facebook Pixel, Cloudflare and Mapbox;
5. travel insurers, assistance companies, medical providers, emergency contacts and emergency services;
6. professional advisers, auditors and insurers;
7. police, regulators, courts, immigration, health or other authorities where required or reasonably necessary; and
8. a prospective purchaser, investor or successor in a genuine business transaction, subject to appropriate confidentiality and legal controls.

some recipients are independent controllers and determine their own purposes. their privacy notices may also apply.

8. overseas disclosure and international transfers

we operate from Australia and provide trips in Sri Lanka. information may be stored or accessed in Australia, Sri Lanka, the United States, the United Kingdom, the European Economic Area and countries where our technology or service providers operate.

for disclosures from Australia, we take reasonable steps required by APP 8 before disclosing personal information overseas, unless an exception applies. where we seek informed consent to an APP 8 exception, we will explain the practical consequence and seek voluntary, specific consent; we do not treat this policy alone as blanket consent.

where EU GDPR or UK GDPR applies to a restricted transfer, we use a legally available mechanism where required, such as an adequacy decision, approved contractual clauses with supplementary measures, or a specific permitted derogation. you may ask for information about the relevant safeguard.

9. website, cookies and analytics

our website may use cookies, pixels, local storage and similar technologies for essential functions, security, analytics, maps, content, advertising and measurement.

current technologies may include Google Analytics, Meta/Facebook Pixel, Cloudflare and Mapbox. these providers may receive device, usage, cookie, approximate-location or interaction information and may process it under their own notices.

where law requires it, non-essential analytics and advertising technologies will be used only after valid consent. you may use our consent controls or browser settings to refuse or withdraw consent. see our cookies policy for full details.

10. direct marketing

we may send marketing where you consent or where otherwise permitted by law. messages will identify us and provide an unsubscribe method.

you may opt out at any time by using the unsubscribe function or contacting us. we may retain a suppression record so we do not send further marketing.

opting out of marketing does not stop operational messages about an existing booking, safety, payment, itinerary or legal obligations.

11. photography, video and audio

the tour service agreement contains a prominent, broad media consent and licence. we use trip media for group communications, website content, social media, advertising, publicity, promotions and future marketing. publicly shared media may be copied or redistributed beyond our control.

we will not knowingly publish disclosed sensitive medical information or use media in a materially misleading, defamatory or humiliating way.

where applicable law requires consent to be withdrawable or another basis, those mandatory rights prevail. withdrawal does not affect processing already lawfully undertaken.

12. security and data breaches

we use reasonable technical and organisational safeguards, which may include access controls, encryption offered by service providers, minimum-necessary disclosure, staff and contractor confidentiality, backups and incident response.

no system or transmission is completely secure. if an eligible data breach occurs, we will investigate, contain and notify affected individuals and regulators where required, including under Australia's Notifiable Data Breaches scheme.

13. retention

we retain information only for as long as reasonably needed for the purposes in this policy, legal and accounting obligations, insurance, safety, dispute resolution and establishment or defence of claims:

1. booking, payment and contractual records are generally retained for at least 7 years after the relevant transaction or as otherwise required;
2. health, passport, insurance and emergency information is reviewed after the trip and deleted or de-identified when no longer needed, unless an incident, claim, legal duty or future booking justifies longer retention;
3. incident, waiver and complaint records may be retained for the applicable limitation, insurance or legal period;
4. marketing information is retained until consent is withdrawn, you opt out or it is no longer useful, subject to suppression records; and
5. media may be retained under the licence in the tour service agreement, subject to mandatory privacy rights.

14. your privacy rights

subject to applicable law and exceptions, you may ask us to access or correct personal information, complain about our handling, or withdraw consent.

if EU GDPR or UK GDPR applies, you may also have rights to erasure, restriction, objection, data portability and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.

we do not currently make solely automated decisions producing legal or similarly significant effects about participants.

we may verify identity and ask for information needed to locate records. we will respond within the period required by applicable law and explain any refusal.

15. EU and UK representatives and regulators

if the EU GDPR or UK GDPR applies to our handling of your personal data, you may lodge a complaint with the supervisory authority in the country where you live or work, or where you consider an infringement occurred. in the United Kingdom, the supervisory authority is the Information Commissioner's Office at ico.org.uk. you may also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

16. complaints, contact and changes

send privacy questions, requests or complaints to hello@hardlysolo.com. please describe the issue and preferred resolution. we will acknowledge and investigate within a reasonable time.

we may update this policy to reflect legal, service or technology changes. the current version will be posted on our website with its update date. we will give additional notice where a material change requires it.