Privacy Policy

Santé Frontiers Group Ltd ("Santé", "we", "us", "our") operates the activity-first travel marketplace at sante.travel, which connects travellers with curated properties and with the creators, coaches and guides who host sports-oriented trips.

We are the data controller for the personal data described in this notice.

— Legal entity: Santé Frontiers Group Ltd — Registered in England and Wales, company no. 16204077 — Registered office: Kiln Farm, Maidstone Road, Marden, Tonbridge, TN12 9AP, United Kingdom — ICO registration: ZC021526 — Privacy contact: privacy@sante.travel

If you are a traveller booking through Santé, we are the controller of your data. The properties, creators and operators on the platform are independent controllers of the data we pass to them to fulfil your booking, and their own privacy notices govern what they do with it.

Information you give us:

— Account data — your name, email address, password (stored only as a salted hash) or Google Sign-In identifier, profile photo and display name — Traveller profile — the sports you are interested in, ability level, dietary requirements, accessibility needs, emergency contact details and any other preferences you choose to add — Booking data — dates, party size, the property or trip selected, guest names, special requests, and messages you exchange with a property or creator — Creator and operator data — business details, tax and payout information, identity verification documents, insurance and qualification certificates, listing content, photography and video. This includes photographs uploaded as evidence for a facility badge, which are checked automatically and may also be reviewed by Santé staff — Communications — support requests, in-platform messages, survey responses and feedback

Information we collect automatically:

— Technical data — IP address, device and browser type, operating system, language and timezone — Usage data — pages viewed, searches run, listings opened, features used, referring URL and session timestamps — Cookies and similar technologies — see Cookies below

Special category data: some information you may choose to give us — dietary requirements, accessibility needs, or medical and fitness information relevant to an activity — is special category data under UK GDPR. We collect it only where you provide it, and we process it on the basis of your explicit consent so that a property or creator can accommodate you safely. You can withdraw that consent at any time, though we may then be unable to run the booking.

DRAFT v1, pending solicitor review. This section covers UK GDPR Article 14 — personal data we obtained from a source other than you — and was added because the two categories above ("information you give us" and "information we collect automatically") did not describe it.

If you run an accommodation business and have never used Santé, we may still hold information about that business, and we may have written to you about it. This section explains what, why, and how to stop it.

What we hold. Business contact details (a name where the site publishes one, a business email address, a website address) and descriptive information about the property itself — its location, rooms or pitches, facilities, published rates and photographs. Where a listed contact is a named individual rather than a generic address, that name and address are personal data and this section applies to them.

Where it came from. Your own publicly accessible website. Our crawler stays on your own domain and does not follow links off it, so nothing here is drawn from a review site, a booking platform, a social media profile or a directory. Some records are instead entered by hand by Santé staff from details a business has published, or from an introduction by someone who knows it. We do not buy contact lists and we do not use third-party data brokers. Every descriptive claim we generate is recorded against the specific page it was taken from, and any claim we cannot evidence that way is discarded rather than published.

Why we do it, and our legal basis. To build a preview of how the business would appear on Santé and invite the owner to claim it, correct it or remove it. Our legal basis is legitimate interests — introducing an accommodation business to a marketplace relevant to it, using information that business has itself published for exactly that kind of contact. We have assessed that this does not override your rights, and you can ask us for that assessment. Where the business is a sole trader or a non-LLP partnership, we treat the contact as an individual subscriber under PECR and do not send marketing email without consent or a soft opt-in.

How long we keep it. A preview page expires roughly ten days after we send it and is deleted in full shortly afterwards if it is not claimed — the property record, the research notes and the source citations all go. We retain only a minimal record that the business existed and was not taken forward, so that we do not research and contact the same business again.

How to stop it. Every preview page carries a one-click removal link that needs no account and no reply to us. Using it takes the page down and adds the business to a suppression list that outlives the deleted record, so a later crawl will not rebuild the page or write to you again. You can also reply to any email we send and ask us not to write again, or email privacy@sante.travel.

Your rights are the same as for anyone else whose data we hold, including the right to object to processing based on legitimate interests and the right to complain to the ICO — see Your rights below.

Santé offers Google Sign-In as a way to create and access your account. This section explains exactly how we handle data obtained through Google APIs.

What we request. We request only the following non-sensitive OAuth scopes:

— openid — a stable identifier for your Google Account — email — your email address, and whether Google has verified it — profile — your name and profile picture

What we receive and store. We store your Google Account identifier, email address, name and profile picture in our user database, and we hold the OAuth tokens Google issues so that you can stay signed in. Your profile picture is copied once, at first sign-in, into our own file storage rather than being loaded from Google each time it is shown.

What we use it for. Solely to create and authenticate your Santé account, to populate your profile, and to send you transactional email about your bookings.

What we do not do. We do not request access to your Gmail, Drive, Calendar, Contacts or any other Google service. We do not sell Google user data, use it for advertising, use it to train machine-learning models, or transfer it to third parties except to the infrastructure providers listed under Service providers below, acting on our instructions.

Revoking access. You can disconnect Santé from your Google Account at any time at myaccount.google.com/permissions. Revoking access prevents further sign-in via Google; it does not by itself delete your Santé account. To delete the account, see Your rights below.

Santé's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That policy is published at developers.google.com/terms/api-services-user-data-policy.

— Creating and managing your account, and authentication — performance of a contract — Taking and fulfilling bookings, and passing details to the property or creator — performance of a contract — Processing payments and payouts, and handling fraud and chargebacks — performance of a contract; legal obligation — Verifying creator and operator identity, insurance and qualifications — legitimate interests (platform safety and trust); legal obligation — Reviewing evidence submitted for a facility badge — legitimate interests (only claims we can evidence reach a guest) — Customer support and dispute resolution — performance of a contract; legitimate interests — Accommodating dietary, accessibility or medical requirements — explicit consent — Product analytics, error monitoring and platform improvement — legitimate interests — Marketing email and newsletters — consent, withdrawable at any time — Accounting, tax and statutory record-keeping — legal obligation — Investigating misuse, enforcing our Terms and defending legal claims — legitimate interests

Where we rely on legitimate interests, we have assessed that our interest in running a safe, working marketplace does not override your rights and freedoms. You can ask us for that assessment, and you can object at any time.

Santé is a three-sided marketplace, so some sharing is inherent to the service:

— With properties and accommodation providers — when you book, we share the guest names, dates, party size, contact email and any requirements needed to host you — With creators, coaches and guides — for a creator-led trip, we share participant details, ability level and any safety-relevant information you have given us — Between travellers on the same trip — your display name and profile photo may be visible to others on a shared trip — Publicly — reviews you write, and any profile information you choose to make public. Where you confirm whether a property really had a facility you used, your answer is shown to that property only as an anonymous count, never attributed to you

We do not sell your personal data, and we do not share it with third parties for their own marketing.

We use the following providers to run Santé. Each processes personal data only on our instructions, under a written data processing agreement.

— Vercel Inc. — application hosting and CDN (EU / US) — Supabase Inc. — database, authentication and file storage (EU, Ireland) — Stripe Inc. and Stripe Payments Europe Ltd. — payments, payouts, identity and KYC checks (EU / US) — Mux Inc. — video hosting and streaming (EU / US) — PostHog Inc. — product analytics (EU) — Functional Software Inc. (Sentry) — error and performance monitoring (EU / US) — Google LLC — Sign-In authentication (EU / US) — Anthropic PBC — automated review of uploaded verification evidence, and generating listing content from a business's own public website (US) — Mapbox Inc. — maps on search and listing pages (US) — Resend — transactional and marketing email (EU / US)

Automated review of uploaded evidence. Where a property claims a facility badge, the photograph or document it uploads as evidence is sent to Anthropic's Claude API to check that it shows what was claimed. Anthropic does not use data submitted through its API to train its models. This check can only accept or reject a piece of evidence; it never makes a decision with legal or similarly significant effects about a person, and a human reviewer decides anything it cannot rule on.

Payment cards. Card details are captured directly by Stripe and never reach Santé's servers. We hold only a token, the last four digits and the card brand.

We may also disclose data to professional advisers (lawyers, accountants, insurers), to regulators or law enforcement where legally required, and to an acquirer if the business is sold or reorganised.

Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework, together with supplementary safeguards where required. You can request a copy of the relevant transfer mechanism from privacy@sante.travel.

We use:

— Strictly necessary cookies — session and authentication tokens, security and load balancing. These cannot be turned off; without them the site does not work — Analytics cookies — PostHog, to understand how the platform is used. These run only if you have explicitly opted in, which we ask when you join. The default is no, and if you did not opt in the analytics tool is never started at all — nothing is set and nothing is sent. If you are signed out, or have no account, you are never tracked, because nothing has asked you. To change your answer either way, email privacy@sante.travel — Preference cookies — remembering your language, currency and search settings

We do not use advertising or cross-site tracking cookies. Analytics data is held in PostHog's EU region, and we do not build a profile against a named person unless you are signed in. There is no self-serve toggle yet, so email us and we will action it.

Under UK GDPR and the Data Protection Act 2018, you have the right to:

— Access a copy of the personal data we hold about you — Rectify inaccurate or incomplete data — Erase your data, subject to records we must keep by law — Restrict processing while a dispute is resolved — Portability — receive your data in a structured, machine-readable format — Object to processing based on legitimate interests, and to direct marketing at any time — Withdraw consent where consent is the basis, without affecting processing already carried out — Not be subject to solely automated decisions with legal or similarly significant effects — we do not make any

To exercise any of these, email privacy@sante.travel. We respond within one month; complex requests may take up to three, and we will tell you if so. There is no charge unless a request is manifestly unfounded or excessive.

Account deletion. If you run a property on Santé, you can request export and erasure from your property settings. For every other account, email privacy@sante.travel and we will action it. In both cases we remove your profile and personal data, other than records we are required to retain and anonymised analytics. Where erasure would strand a confirmed booking that has not yet happened, we will complete or cancel that booking first and tell you.

Complaints. If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. If you are in the EEA, you may complain to your local supervisory authority.

— Account and profile data — while your account is active, then 12 months after closure — Booking and transaction records — 7 years from the end of the relevant tax year — Payment and payout records — 7 years — Creator and operator verification and compliance documents — the duration of the relationship, then 7 years — In-platform messages — 3 years from the end of the booking — Support correspondence — 3 years — Marketing consent records — until withdrawn, then 3 years as proof of consent — Analytics and error logs — 24 months, pseudonymised — Server access logs — 90 days

We protect your data with encryption in transit and at rest, row-level security policies enforced at the database layer, hashed passwords, role-based access controls limiting staff access to what each role needs, private storage for verification documents and compliance certificates, audit logging of administrative actions, and regular dependency and vulnerability scanning.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, notify you directly without undue delay.

Santé is intended for use by adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. Where a booking includes minors travelling in your party, you provide their details as their parent or guardian and confirm that you are entitled to do so. If you believe we hold a child's data in error, contact privacy@sante.travel and we will delete it.

We may update this notice as the platform develops. The date at the top of this page will change, and for material changes we will email registered users and display a notice in the app at least 14 days before the change takes effect. Continuing to use Santé after that means you accept the updated notice.