Last updated: 12 November 2026
This policy explains how OTW Travels collects, uses and protects your personal information when you visit otwtravels.com, sign up for our emails, book a trip, buy a trip kit or otherwise get in touch with us.
1. Who we are
OTW Travels Limited (“OTW”, “we”, “us”) is a company registered in England and Wales with company number 15677296. Our registered office is 20 Wenlock Road, London, N1 7GU.
We are the controller of your personal information, which means we decide how and why it is used.
If you have any questions about this policy or your information, contact us at:
- Email: [email protected]
2. The information we collect
We only collect what we need to run our trips and services. Depending on how you deal with us, this may include:
- Contact details: name, email address, phone number, country of residence and social media handle.
- Booking and trip details: the trip or service you’re interested in, travel dates, room preferences, referral or discount codes, and notes from any call with us.
- Identity and travel documents: date of birth, nationality, and passport details or copies where needed to book accommodation, domestic transport, permits or visas (for example, restricted area permits in parts of India).
- Emergency contact: the name and phone number of someone we can contact in an emergency. Please let them know you’ve shared their details with us.
- Health and wellbeing information: medical conditions, allergies, dietary requirements, accessibility needs and fitness information that affect your safety or comfort on a trip. This is “special category” data and we treat it with extra care (see section 3).
- Payment information: records of payments, deposits and refunds. Card details are handled directly by our payment providers and we never see or store your full card number.
- Marketing preferences: whether you’ve signed up to our emails and how you interact with them, for example whether you open them or click links.
- Website and device information: IP address, browser and device type, pages you visit and how you arrived on our site, collected through cookies and similar technologies (see section 8).
- Communications: messages you send us by email, Instagram, WhatsApp or through our forms, and feedback or reviews after a trip.
- Photos and videos: images taken on trips that you appear in. We will ask before using identifiable images of you in our marketing.
How we collect it. Mostly directly from you, through our website forms, booking calls, emails and messages. Some comes from third parties, such as payment providers confirming a payment, referral partners who introduce you to us, and Meta (Facebook and Instagram) if you respond to one of our adverts.
Age. Our group trips are for adults. We do not knowingly collect information from anyone under 18.
3. How we use your information and our legal basis
UK data protection law requires us to have a legal reason (a “lawful basis”) for each way we use your information.
| What we use it for | Lawful basis |
|---|---|
| Responding to enquiries and booking calls | Steps before entering a contract with you, or our legitimate interest in answering questions about our services |
| Taking your booking, arranging your trip and running it, including sharing details with local suppliers | Performance of our contract with you |
| Processing payments, deposits and refunds | Performance of our contract with you |
| Delivering trip kits and bespoke planning services you buy | Performance of our contract with you |
| Keeping you safe on a trip, including using health information and contacting your emergency contact | Your explicit consent for health information; vital interests if you are unable to consent in an emergency |
| Sending marketing emails and WhatsApp updates about trips and offers | Your consent, or for past customers, our legitimate interest in telling you about similar trips (you can opt out at any time) |
| Showing you relevant adverts on Facebook and Instagram and measuring how they perform | Your consent, given through our cookie banner |
| Improving our website, trips and services, including post-trip feedback | Our legitimate interest in running and improving our business |
| Using photos and videos from trips in our marketing | Your consent |
| Keeping financial and booking records, and meeting tax, insurance and other legal requirements | Legal obligation |
| Dealing with complaints, claims or legal disputes | Our legitimate interest in protecting our business, or legal obligation |
Health information. We only collect health information that’s relevant to your trip, and only with your explicit consent, which we ask for when we collect it. We share it only with trip leaders and suppliers who need it to keep you safe (for example, a guide who needs to know about an allergy). You can withdraw your consent at any time, but if we don’t have information we need for your safety, we may not be able to take you on the trip.
Legitimate interests. Where we rely on legitimate interests, we have considered your rights and expectations and believe the use is reasonable. You can ask us for more detail or object at any time (see section 9).
We do not use your information to make decisions about you by purely automated means, and we do not sell your personal information.
4. Who we share your information with
We only share what each organisation needs for its role, and we require our service providers to keep your information secure and use it only on our instructions.
| Who | Examples | Why |
|---|---|---|
| Trip suppliers in the destination country | Local tour operators, guides, accommodation, transport providers, activity providers, permit and visa offices | To book and deliver your trip |
| OTW trip leaders | Our trip leaders, who may be volunteers | To run the trip and look after the group |
| Payment providers | Stripe, WooCommerce payment gateway | To take payments and process refunds |
| Email and messaging | Klaviyo, WhatsApp | To send booking information and, if you’ve agreed, marketing |
| Forms and booking tools | Tally, Calendly | To collect sign-ups and schedule calls |
| Website and storage | HostGator (hosting), WordPress and its plugins, Google Workspace | To run our website and store records |
| Advertising | Meta (Facebook and Instagram) | To show and measure our adverts, if you’ve consented to advertising cookies |
| Accounting | FreeAgent, our accountant | To keep financial records |
| Insurers and professional advisers | Insurers, brokers, lawyers | For insurance, claims and legal advice |
| Referral partners | Partners who introduced you to us | To confirm your booking so we can pay their commission (we only share your name and booking status) |
| Authorities | Police, regulators, embassies, emergency services | Where the law requires it, or in an emergency to protect you or others |
If OTW is ever sold or restructured, your information may be transferred to the new owner, who would have to use it in line with this policy.
5. Sending information outside the UK
Because we run trips abroad, we need to share some of your information with suppliers in the countries you’ll be visiting, such as Nepal, India, Sri Lanka, Kazakhstan and Kyrgyzstan. These countries may not have the same data protection laws as the UK. We share only what is needed to deliver the trip you’ve booked, and we do this because it is necessary to perform our contract with you.
Some of our service providers, such as Klaviyo, Stripe, Meta and Google, may store or process data in the United States or elsewhere. Where this happens, we rely on UK-approved safeguards, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement and Addendum, to protect your information.
6. How long we keep your information
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to a booking | 6 years from your last contact with us |
| Booking, payment and trip records | 6 years after your trip, for tax, accounting and legal claims |
| Health information and passport copies | Deleted within 3 months after your trip ends, unless needed for an incident, insurance claim or legal matter |
| Emergency contact details | Deleted within 3 months after your trip ends |
| Email marketing data | Until you unsubscribe, after which we keep your email on a suppression list so we don’t contact you again |
| Website and advertising data | In line with our cookie settings, typically up to 2 years |
7. Keeping your information secure
We use reputable service providers with strong security, protect our accounts with strong passwords and two-factor authentication where available, and limit access to people who need it. Trip leaders only receive the information they need for their trip and are asked to delete it afterwards. No system is completely secure, but if a data breach puts your rights at risk, we will tell you and the ICO where the law requires us to.
8. Marketing and cookies
Marketing. We’ll only send you marketing emails or WhatsApp messages if you’ve signed up, or if you’ve booked with us before and we’re telling you about similar trips. Every email has an unsubscribe link, and you can leave our WhatsApp community or email us to opt out at any time.
Cookies. Our website uses cookies and similar technologies. Some are essential to make the site work, such as keeping items in your basket. Others are optional and only used if you agree through our cookie banner:
- Analytics cookies, which help us understand how people use our website.
- Advertising cookies, including the Meta pixel, which help us show you relevant adverts on Facebook and Instagram and measure whether they work.
- Affiliate cookies, which let partner booking sites (such as hotel and activity platforms we link to) know that you came from OTW, so we may earn a small commission at no extra cost to you.
You can change your choices at any time through the cookie settings link in our website footer, or block cookies in your browser.
9. Your rights
You have the right to:
- Access the personal information we hold about you
- Correct information that’s wrong or incomplete
- Delete your information in some circumstances
- Restrict how we use your information in some circumstances
- Object to us using your information based on legitimate interests, and to direct marketing at any time
- Move information you gave us to another organisation (data portability)
- Withdraw consent at any time, where we rely on consent
To use any of these rights, email [email protected]. There’s normally no charge. We may ask you to confirm your identity, and we’ll respond within one month, or tell you if we need longer because the request is complex.
10. Complaints
If you’re unhappy with how we’ve handled your personal information, please tell us first at [email protected] with the subject line “Data protection complaint”, explaining what happened. You don’t need to use any particular wording. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
If you’re not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or by calling 0303 123 1113.
11. Changes to this policy
We may update this policy from time to time, for example when we start using a new service provider. The latest version will always be on this page, with the date it was last updated at the top. If we make significant changes, we’ll let you know by email or on our website.