Sailia's Privacy Policy

Last updated: July 2026

This Privacy Policy explains how Sailia Limited ("Sailia", "we", "us", "our") collects, uses, and protects personal information when you visit our website or use our services. We are committed to safeguarding privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Sailia Limited is registered in England and Wales with its registered office at Senna Building, Gorsuch Place, London E2 8JF, and is registered with the UK Information Commissioner's Office (ICO).

Who This Policy Covers

Sailia works with two groups of people:

Platform users are our customers (experience businesses such as activity venues, attractions, and tour operators) and their staff, who use the platform to manage bookings, operations, and customers.

End users are individuals who make bookings, sign waivers, purchase memberships, or otherwise interact with services provided by our customers through the Sailia platform.

Our roles:

• For end user data processed through the platform (such as bookings and waivers), Sailia usually acts as a data processor on behalf of the relevant customer, who is the data controller. If you are an end user and want to exercise your rights over this data, your first point of contact should normally be the business you booked with. We will assist them in responding.

• For website visitors, account administration, billing, support, marketing, and our direct relationships with customers, Sailia acts as a data controller.

What Personal Information We Collect

Contact information: name, email address, phone number, and business details.

Account and booking information: login details, booking details, payment status, membership information, waiver information, and other information submitted through the platform.

Demographic and safety information: where relevant to the activity being booked, this may include age, date of birth, address, emergency contact details, and relevant medical or accessibility information provided by you or your parent or guardian.

Payment information: payments are processed by relevant card processors. We do not store full card details on our systems.

Usage information: how users interact with our website and services.

Technical information: device, browser, IP address, cookies, and similar technologies.

We collect personal information directly from platform users, from end users making bookings, and from third parties where relevant to providing our services, such as payment or integration providers.

How We Use Personal Information

To provide and manage services: to fulfil requests, process bookings and waivers, provide management tools, process payments, and deliver customer support.

To improve our services: to analyse usage patterns, improve functionality, and develop the platform.

To send communications: service-related messages and, where appropriate and lawful, marketing messages, updates, and newsletters. You can opt out of marketing at any time.

To keep the platform secure: to detect, prevent, and investigate fraud, abuse, and security incidents.

To comply with legal obligations: to meet requirements under applicable laws and regulations.

Lawful Bases for Processing

Where we act as a data controller, we rely on the following lawful bases under UK GDPR:

• Contract: where processing is necessary to provide our services or fulfil bookings

• Legitimate interests: where processing is necessary for operating, improving, securing, and supporting Sailia and its services

• Legal obligation: where processing is required to comply with applicable law

• Consent: where consent is required, including for certain marketing communications or optional cookies

Data Storage and International Transfers

Personal information is stored securely on infrastructure provided by Amazon Web Services (AWS). We use appropriate technical and organisational measures to protect personal information, including encryption in transit, access controls, and monitoring.

Where personal data is transferred outside the UK or EEA, we use appropriate safeguards, including approved transfer mechanisms such as the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum, where required.

Sharing Personal Information

We may share personal information with trusted third parties, including:

Service providers: providers of hosting, analytics, error logging, email delivery, and payment processing, including AWS, Stripe, PostHog, Sentry, and Cloudflare, where relevant to the services provided. These providers act under contracts that restrict their use of personal data.

Business partners and integrations: where required to provide services requested by our customers or users.

Legal authorities: where required by law or where necessary to establish, exercise, or defend legal claims.

We do not sell personal information.

Aggregated and Anonymised Insights

We may use information processed through the Sailia platform to create aggregated, anonymised, or statistical insights about bookings, participation, demand, utilisation, revenue, activity trends, and sector performance. We may use these insights to improve our services, provide benchmarking and reporting, and support approved partners, group administrators, governing bodies, or industry organisations.

Where we share insights externally, we take steps designed to prevent individual end users from being identified, unless sharing identifiable information is authorised by the relevant customer and permitted by law.

Cookies and Tracking Technologies

We use cookies and similar technologies to enhance browsing experience, understand usage of our website and services, and improve performance. You can manage cookie preferences through your browser settings and, where shown, our cookie banner. For more details, please see our Cookie Policy.

Data Retention

We retain personal information only for as long as necessary for the purposes described in this policy. As a guide:

• Booking and transaction records: retained for the duration of the customer relationship and for up to 7 years afterwards, to meet accounting, tax, and legal requirements.

• Waiver and safety records: retained in line with the retention settings and legal obligations of the relevant customer, who is the controller of this data.

• Account information: retained while the account is active and deleted or anonymised within a reasonable period after closure, subject to the export window described in our Terms and Conditions.

• Marketing data: retained until you opt out or we no longer have a lawful basis to use it.

When personal information is no longer required, it is securely deleted or anonymised.

Your Rights

Under the UK GDPR, you may have the following rights:

• Access: obtain a copy of your personal information

• Rectification: correct inaccurate or incomplete information

• Erasure: request deletion of personal data in certain circumstances

• Restriction: request that processing is limited in certain circumstances

• Data portability: receive personal data in a machine-readable format where applicable

• Objection: object to certain types of processing, including direct marketing

• Withdraw consent: withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at info@sailia.com. We will aim to respond within one month.

Where Sailia acts as a processor on behalf of one of our customers, we may need to direct your request to that customer as the data controller, and we will help facilitate this.

Data Breaches

We maintain procedures for identifying, assessing, and responding to personal data breaches. Where a breach is likely to result in a risk to individuals, we will notify the ICO and, where required, affected individuals and customers without undue delay.

How to Contact Us

Sailia Limited Senna Building, Gorsuch Place, London E2 8JF Email: info@sailia.com

If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Changes to This Privacy Policy

This policy may be updated from time to time. The latest version will always be available on our website, with the date of the last update shown at the top. Material changes will be communicated more prominently, for example by email or a notice on the platform.