Last updated: October 2026

1. Who we are

Tabletop Travels CIC is a Community Interest Company that uses culture, creativity and travel-inspired experiences to support connection, participation and wellbeing.

Through our culturally themed travel boxes, facilitated activities, community projects and partnerships, we aim to reduce loneliness and isolation and make cultural experiences more accessible.

We respect your privacy and are committed to protecting your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This statement explains what personal information we collect, why we collect it, how we use and protect it, when we may share it and what rights you have.

Tabletop Travels CIC is the data controller for the personal information we collect and use for our own purposes.

2. What information do we collect?

The information we collect depends on how you interact with Tabletop Travels. This may include:

Website visitors and enquiries

• Your name and contact details when you contact us.

• Information you provide in an enquiry or correspondence.

• Information you provide when subscribing to our newsletter.

• Technical information collected through our website, where applicable, such as information relating to website usage or cookies.

Participants in our activities

• Names and contact details where needed to organise activities.

• Registration and attendance information.

• Relevant access requirements or dietary information needed to support participation.

• Feedback, evaluation responses and information about your experience of our activities.

Photographs, stories and creative contributions

• Photographs, audio or video recordings.

• Personal stories, memories, quotations or creative work shared through our activities.

• Permissions and preferences relating to how this material may be used.

Community partners, volunteers, freelancers and suppliers

• Professional contact details and information about your role.

• Partnership correspondence, agreements and project arrangements.

• Relevant contractual, payment, expense and financial records.

We aim to collect only the information necessary for the relevant purpose. We do not routinely require detailed medical information or other sensitive personal information.

Where information about health, disability or other special categories of personal data is necessary, we will take additional care to ensure that its collection and use are lawful and appropriate.

3. How do we use your information?

We may use personal information to:

• Respond to enquiries and communicate with you.

• Send newsletters or updates where you have subscribed or where another lawful basis applies.

• Organise and deliver travel-box experiences, workshops and community activities.

• Coordinate activities with partner organisations.

• Make reasonable arrangements for relevant accessibility or dietary requirements.

• Collect feedback and evaluate the reach, quality and impact of our projects.

• Prepare reports for funders and project partners, using anonymised or aggregated information wherever possible.

• Share photographs, stories or creative contributions in agreed publicity, exhibitions, reports or other communications.

• Manage our staff, volunteers, freelancers, suppliers, contracts and finances.

• Meet our legal, accounting and regulatory obligations.

We will not use your information for purposes that are incompatible with the reasons it was collected without an appropriate lawful basis and, where required, informing you.

4. What is our lawful basis for using your information?

Data protection law requires us to have a lawful basis for processing personal information. Depending on the circumstances, we may rely on:

Consent: For activities such as optional newsletters, promotional photography or the publication of personal stories where consent is the appropriate basis.

Legitimate interests: For necessary organisational activities, such as managing professional relationships, responding to relevant enquiries or communicating with partners, where our interests do not override your rights and freedoms.

Contract: Where processing is necessary to enter into or fulfil a contract, for example with a supplier or freelancer.

Legal obligation: Where we need to process information to comply with legal requirements, including relevant accounting and financial obligations.

We will determine the appropriate lawful basis for each activity and explain it where required.

Where we process special category data, such as health information, we will also identify an applicable additional condition under data protection law.

5. Working with community partners

Tabletop Travels works with care homes, libraries, community organisations, housing providers, HIVE and other partners to make cultural experiences accessible and meaningful.

These organisations generally collect and hold personal information about their own service users, members or participants. They remain responsible for managing the information they hold in accordance with their own legal obligations.

We do not assume that being referred by a partner, attending a partner's service or taking part in a joint activity automatically gives us permission to use your personal information for our own purposes.

Where a partner shares personal information with us, this must be necessary, proportionate and lawful. We will explain how we intend to use the information and establish the appropriate lawful basis.

Where we need information directly from you, we will explain why it is needed and collect only what is necessary.

If we and a partner jointly determine how personal information is used, or a partner processes information on our behalf, we will clarify the respective responsibilities and put appropriate arrangements in place.

6. Photographs, stories and creative contributions

Personal stories, memories and creative contributions are an important part of Tabletop Travels' work. They can help people connect, share experiences and contribute to the cultural life of their communities.

We may invite participants to be photographed, recorded or to share stories and creative work as part of an activity.

Before using identifiable photographs, recordings, quotations or personal stories for publicity or other optional purposes, we will explain how the material may be used and seek separate consent where consent is the appropriate lawful basis.

Taking part in a Tabletop Travels activity does not automatically mean that you agree to be photographed, recorded or featured in promotional material.

You can decline optional publicity and still participate in our activities. We will respect your wishes and make reasonable arrangements to accommodate them.

Where consent is the lawful basis, you can withdraw it at any time. Withdrawal does not affect processing that took place lawfully before you withdrew consent. We will explain what can reasonably be done about material already published or distributed.

We aim to treat personal stories and contributions with dignity and respect, and to use them in ways that reflect the context in which they were shared.

7. How do we share your information?

We do not sell your personal information.

We may share information with:

• Community partners where necessary and lawful for a specific activity.

• Funders and evaluators where required for project reporting, using anonymised or aggregated information wherever possible.

• Service providers who support our operations, such as relevant website, email or file-storage providers.

• Professional advisers or public authorities where necessary to meet legal obligations or protect individuals' rights and safety.

We will share only the information necessary for the relevant purpose and take appropriate steps to protect it.

We will not share identifiable participant information with funders or partners simply because they are involved in a project. Any sharing must have an appropriate purpose and lawful basis.

Where a service provider processes personal information on our behalf, we will put appropriate contractual and security arrangements in place.

If personal information needs to be transferred outside the UK, we will ensure that the transfer complies with applicable data protection requirements.

8. How do we protect your information?

We take appropriate organisational and technical measures to protect personal information against unauthorised access, loss, alteration or disclosure.

These measures may include restricted access to records, secure digital accounts, appropriate password protection, secure storage of paper records and confidentiality arrangements for people working with us.

Access to personal information is limited to those who need it to carry out their authorised responsibilities.

No method of electronic storage or transmission is completely secure, but we take reasonable and proportionate steps to protect the information we hold.

9. How long do we keep your information?

We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of legal, contractual, accounting and funding requirements.

Retention periods vary according to the type of information and how it is used. For example:

• Website enquiries are retained for as long as necessary to respond and manage any relevant follow-up.

• Newsletter details are retained while you remain subscribed, with appropriate records maintained to manage preferences and withdrawals.

• Participant registration and attendance information is retained only for the period justified by the activity and any necessary follow-up.

• Accessibility and other sensitive participant information is retained only for as long as necessary for the relevant purpose.

• Photographs, recordings and publicity permissions are reviewed in line with their intended use and our ongoing lawful basis.

• Financial and contractual records are retained for the applicable legal and accounting periods.

• Evaluation information is anonymised or aggregated wherever possible when identifiable information is no longer required.

When information is no longer needed, we will securely delete it, destroy it or irreversibly anonymise it, as appropriate.

10. Your data protection rights

Under data protection law, you may have the right to:

• Be informed about how your personal information is used.

• Access the personal information we hold about you.

• Rectify inaccurate or incomplete information.

• Request erasure of your information in circumstances where the law provides for this.

• Restrict processing in certain circumstances.

• Object to certain types of processing.

• Data portability, where the relevant legal conditions apply.

• Withdraw consent where we rely on consent as our lawful basis.

These rights are subject to applicable conditions and exemptions.

You can exercise your rights by contacting us using the details below. We may need to verify your identity before responding. We will respond within the applicable legal timeframe, normally one calendar month.

You can also unsubscribe from our newsletters using the unsubscribe facility provided or by contacting us directly.

11. Cookies and website technology

Our website may use cookies or similar technologies to support its operation, understand website usage or provide particular features.

Where applicable, we will provide information about the cookies and technologies used, their purposes and how you can manage your preferences. Non-essential cookies will be used only in accordance with applicable requirements.

Please refer to the cookie information and settings available on our website for details of the technologies currently in use.

12. Changes to this Privacy Statement

We may update this statement to reflect changes to our activities, the way we use personal information, our website or applicable legal requirements.

The latest version will be published on our website, with the date of the most recent update shown at the top of the page.

13. Contact us

If you have questions about this Privacy Statement, want to exercise your data protection rights or have concerns about how your personal information is handled, please contact:

Tabletop Travels CIC

Email: contact@tabletoptravels.co.uk

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: https://ico.org.uk/

We encourage you to contact us first if you have a question or concern, so that we have an opportunity to address it.