Book
Privacy

Privacy policy

What we collect when you book, why we collect it, where it lives, how long we keep it, and what you can ask us to do with it. The short version: we use your details to run your booking and nothing else, unless you tick the box asking for news.

Version 2026-09-03. The data controller is All Terrain Academy Limited, registered in the Isle of Man, No. 135181C. Registered office: 1st Floor, St James Chambers, 64A Athol Street, Douglas, Isle of Man, IM1 1JE. Contact: info@allterrainacademy.com.

1.What we collect

When you book a session, order a voucher, or send us a team day or training enquiry, we collect:

  • Who you are: your name, email address and phone number.
  • The booking: the session or course, the date and block you asked for, the number of spectators, anything you write in the notes box, and the price, deposit and payment status.
  • For gift vouchers: the recipient's name and your message, both of which are printed on the voucher, and the voucher code and expiry date.
  • Your consent record: whether you confirmed you hold a full driving licence, the date, time and version of the booking terms you accepted, whether you opted in to marketing, and the network (IP) address the form was sent from.
  • Correspondence: emails and messages you send us, and our replies.

On the day, every participant signs a paper participant disclaimer, which records their name, signature, date, and for under-18s the parent or guardian's details. On training courses we also record attendance and assessment results for the certificate.

We do not ask for, and please do not send us, bank card numbers. Deposits are paid by bank transfer directly to our account; we see the payment reference and the sender name your bank shows, and nothing more.

2.Why we use it

  • To run your booking (the contract between us): confirming the date and start time, sending the deposit details, putting you in the diary, issuing a voucher, contacting you if the weather turns, and taking payment.
  • To meet our legal obligations: keeping accounting records, keeping safety and incident records, keeping training records for certificates, and being able to show that you accepted the booking terms.
  • To keep the site safe and working (our legitimate interest): the booking function limits how many requests one network address can send in ten minutes, and blocks obvious automated submissions. That is the only thing we use the IP address for beyond the consent record.
  • Marketing, only with your permission: if you tick "Email me about new dates, offers and gift vouchers", we email you occasionally about exactly that. The box is unticked by default. You can unsubscribe at any time by replying to any email or writing to info@allterrainacademy.com, and we stop.

We do not sell your data, share it with advertisers, or use it to build profiles.

3.Where it is stored

  • Booking database: Supabase, hosted in the European Union. Only our server-side booking system can read or write it; the website in your browser never talks to the database directly.
  • Website and booking functions: Netlify, which runs the website and the code that handles your form. Netlify keeps short-lived function logs for troubleshooting.
  • Email: Google Workspace (Gmail) for info@allterrainacademy.com. Booking confirmations and our replies to you live there.
  • Paper: signed disclaimers and training records are kept in a locked file at our unit in Douglas.

Those providers process data on our behalf under their own contracts and safeguards. Supabase (EU) and Google (which offers UK and EU data processing terms) may process data outside the Isle of Man; where that happens, it is under contractual protections recognised under Isle of Man and UK law.

4.Who we share it with

  • The providers above, only so they can store or transmit it for us.
  • Our accountant, for booking and payment records.
  • For professional training courses, the candidate's name and course details may be shared with the British Off Road Driving Association (BORDA) where that is needed to issue a certificate.
  • Our insurer, or the emergency services, if there is an incident.
  • Anyone we are legally required to share it with.

A gift voucher shows the recipient's name and your message to whoever holds the voucher. Your own contact details are not shown to the recipient.

5.How long we keep it

Booking records
Six years from the end of the financial year of the booking, because our accounts have to be kept that long. That includes the consent record.
Signed disclaimers and incident records
Six years, or longer if a claim or an incident involving an under-18 requires it.
Training records
Six years, so we can confirm a certificate if an employer asks.
Enquiries that do not become bookings
Twelve months, then deleted.
Marketing consent
Until you unsubscribe. We keep a note that you unsubscribed so we do not email you again.
Function logs
Netlify keeps these for a short period (currently around 24 hours) and then discards them.

6.Your rights

The Isle of Man Data Protection Act 2018, together with the GDPR as applied on the island by the Data Protection (Application of GDPR) Order 2018, gives you the right to:

  • ask for a copy of the personal data we hold about you;
  • ask us to correct anything that is wrong;
  • ask us to delete your data, where we no longer need to keep it (we cannot delete booking records that the accounting rules require us to keep, but we will tell you what we are keeping and why);
  • ask us to stop, or restrict, how we use it;
  • object to marketing at any time, and we will stop;
  • receive the data you gave us in a machine-readable format;
  • withdraw any consent you have given, without it affecting anything we did before you withdrew it.

Email info@allterrainacademy.com. We reply within a month, and there is no charge. We may ask you to confirm who you are first.

If you are not happy with how we have handled your data, you can complain to the Isle of Man Information Commissioner at inforights.im. We would rather you told us first so we can put it right.

7.Cookies and tracking

This website sets no cookies and runs no analytics or advertising trackers, which is why there is no cookie banner. Two things to know:

  • The admin page for staff stores a login in your browser's session storage for that tab only. It is not used for visitors.
  • The site loads its typeface (Montserrat) from Google Fonts, so your browser requests that file from Google, which sees your IP address in the same way it does for any web request. Google's own privacy policy covers that.
  • The map links on the contact section open Google Maps or Apple Maps in a new tab. What happens there is governed by their policies, not ours.

8.Children

Drivers must hold a full driving licence, so our booking forms are not aimed at children. Where a child takes part as a passenger or attends as a spectator, we only collect their details on the paper disclaimer, signed by a parent or guardian, and photos of children are only used with that parent or guardian's express permission.

9.Changes to this policy

If we change how we use your data, we will update this page and the version number at the top. Changes that matter to existing bookings will be emailed to you.

Version 2026-09-03. Questions: info@allterrainacademy.com or 07624 406952. See also the booking terms and conditions.