Legal
Privacy Policy
Last updated: August 2026
1. Who We Are
8 Lakes Tours is operated by Robert Zaher. Our contact email is info@8lakestours.com. We are the data controller for personal data collected through this website.
2. What Data We Collect
When you submit the booking form on our website, we collect the following personal data: your first and last name, email address, phone number, nationality, emergency contact details, riding experience level, preferred tour date, dietary restrictions, and any additional notes you provide. We also collect your typed digital signature as confirmation of your agreement to our liability waiver.
3. Why We Collect It (Legal Basis)
We collect and process your personal data on the following legal bases under GDPR: (a) Contractual necessity — to process your booking enquiry and communicate with you about your trip; (b) Legitimate interests — to follow up with people who have expressed interest in our tours; (c) Legal obligation — to maintain records of liability waiver agreements for safety and legal compliance purposes.
4. How We Use Your Data
We use your personal data solely to: respond to your booking enquiry, confirm and manage your tour reservation, contact you with pre-departure information, and follow up if your enquiry was not completed. We do not use your data for marketing purposes without your explicit consent, and we do not sell or share your data with third parties for commercial purposes.
5. Third-Party Services
We store bookings and newsletter subscriptions in our private 8 Lakes Tours operations database hosted on Supabase. We use Resend (resend.com) to send transactional emails such as booking confirmations and internal booking notifications. We use Stripe (stripe.com) to process payments — Stripe handles payment data directly and we never receive or store your card details. Google Consent Mode may send limited cookieless consent and measurement pings while optional storage is denied. With your permission, Google Analytics and non-personalized Google Ads conversion measurement may additionally use measurement identifiers to help us understand site traffic and whether an advertisement leads to a real enquiry or booking. Vercel Web Analytics and Vercel Speed Insights provide basic privacy-focused traffic and performance measurement. Please refer to Supabase, Resend, Stripe, Google, and Vercel's respective privacy policies for details on how they handle data.
6. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and for a minimum of two years after your tour date (or enquiry date if no tour took place) for legal and safety record-keeping purposes. Signed liability waiver records are retained for seven years in line with standard legal practice.
7. Your Rights Under GDPR
If you are based in the European Economic Area (EEA) or United Kingdom, you have the following rights: the right to access your personal data, the right to rectification of inaccurate data, the right to erasure ("right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing. To exercise any of these rights, contact us at info@8lakestours.com. We will respond within 30 days.
8. Cookies
Necessary site functions work without optional Google storage. Google Consent Mode defaults analytics and advertising storage to denied. In this denied state, Google may still receive limited cookieless consent and measurement pings but cannot use optional analytics or advertising cookies. If you choose Allow measurement, Google Analytics and non-personalized Google Ads conversion measurement may store or read measurement identifiers; ad personalization remains disabled. Choose Necessary only to keep optional Google storage denied. You can withdraw or change your choice at any time using the Privacy choices control on the site; withdrawing also removes Google Analytics cookies that this site can access. Vercel Web Analytics and Speed Insights provide privacy-focused performance measurement, and Stripe payment scripts may load where required for payment functionality.
9. Data Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. All data transmission is encrypted via HTTPS.
10. Contact & Complaints
For any privacy-related questions or to exercise your rights, contact us at info@8lakestours.com. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.