Privacy Policy

Last updated on 7 October 2026.

This policy explains what personal data this website collects about you, why it is collected, what is done with it and what you can do about it. It covers this website only.

Who is responsible for your data

The controller of the personal data described here is David García-Carazo García, who owns and runs this website. There is no company; he is responsible in his own name.

Address — 20 Hazelfield Gardens, Lowton, Greater Manchester, WA3 2UL, United Kingdom
Email — contact@cruiseswithdavid.com
Telephone — +44 7827 063045

We have not appointed a data protection officer. We are not required to have one.

What we collect, why, and on what basis

We only collect what we actually need. Below is every use we make of personal data on this website, what the lawful basis for it is under the UK GDPR, and how long we keep it.

When you buy a course

What we collect — your email address, your first name, and your surname if you choose to give it. Your surname is optional.
Why — to take your order, to give you access to the course, to send you your receipt and to keep a record of the sale.
Lawful basis — performance of a contract with you, under Article 6(1)(b) of the UK GDPR. We cannot sell you a course without this information, so if you do not provide it the purchase cannot go ahead.
How long — we keep the record of your order for as long as we are required to keep business and tax records, and no longer. We are confirming the exact period that applies to us and we will state it here once we have it. If you want to know what we hold about your order in the meantime, ask us and we will tell you.

Your account on this website

What we collect — a username, your email address and an encrypted version of your password. We never see or store your actual password.
Why — an account is created for you automatically when you buy, because that is how you get back into your course.
Lawful basis — performance of a contract with you, under Article 6(1)(b).
How long — for as long as you have access to a course. You can ask us to close your account at any time.

Signing in and resetting your password

What we collect — your email address or username, and a temporary link sent to your email if you ask to reset your password.
Why — to let you into your account and to let you back in if you forget your password.
Lawful basis — performance of a contract with you, under Article 6(1)(b).
How long — password reset links expire by themselves after a short time.

The emails we send you

When you buy, we send you a receipt and the details you need to reach your course. These are service messages about a purchase you have made. They are not marketing and we do not send marketing emails from this website.

Lawful basis — performance of a contract with you, under Article 6(1)(b).
How long — sent emails are not stored on the website beyond the order record described above.

When you contact us

If you email David, or write to him through the WhatsApp button on this site, we hold whatever you choose to tell us for as long as it takes to deal with your enquiry.

Lawful basis — our legitimate interests under Article 6(1)(f), namely answering people who get in touch. If your message is about buying or booking something, the basis is taking steps at your request before entering into a contract, under Article 6(1)(b).
WhatsApp — the button on this site opens WhatsApp. From that point your conversation is handled by WhatsApp, which is run by Meta, under their own terms and privacy policy. We see the messages you send us; Meta handles the service itself.
How long — enquiries are kept while they are live and for a reasonable period afterwards, then deleted.

Paying by bank transfer

What we collect — your name as it appears on the transfer and the reference you use, which reach us through the bank.
Why — to match your payment to your order and release your course.
Lawful basis — performance of a contract with you, under Article 6(1)(b).

Paying by card or PayPal

PayPal is being set up as a payment option and is not connected yet. When it is, payment will be handled by PayPal on their own systems. We will never see or hold your card details. PayPal will act as a controller of the data you give them and their own privacy policy will apply. We will receive confirmation that the payment succeeded and the amount.

Technical records kept by the server

What is collected — your IP address, the time of your visit, the page requested and your browser type, recorded automatically by the web server.
Why — to keep the site running, to diagnose faults and to protect it from abuse.
Lawful basis — our legitimate interests under Article 6(1)(f), namely keeping the website secure and working.
How long — these logs are kept by our hosting provider for the period they set, and we do not keep separate copies of them. If you need to know that period, ask us and we will find out for you.

Cookies

This website uses cookies that are necessary for it to work, including keeping you signed in and remembering what is in your basket. Details of the cookies used will be set out in the cookie policy.

Who else sees your data

We do not sell your personal data and we do not share it for anyone else’s marketing. It is seen only by the services needed to run this website.

BanaHosting — our hosting provider. They store the website and its database on our behalf, on servers in the Netherlands, and they run the mailbox used for the emails described above, including your receipt.
PayPal — once connected, for payments.
Meta — if you choose to message us through WhatsApp.
Anyone we are legally required to tell — for example a tax authority or a court, if the law obliges us.

Sending data outside the United Kingdom

Some of the services above may store or process data outside the United Kingdom. Where that happens, we rely on the transfer being to a country covered by UK adequacy regulations, or on the appropriate safeguards set out in Article 46 of the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum. You can ask us for details of the safeguards that apply.

The website, its database and our mailbox are all held by BanaHosting on servers in the Netherlands. If you want to know where a particular provider stores your data, ask us and we will tell you.

Your rights

Under the UK GDPR you have the following rights over your personal data. They are not absolute and some only apply in certain circumstances, but we will always tell you why if we cannot do what you ask.

to be told what we do with your data, which is what this policy is for
to ask for a copy of the data we hold about you
to have inaccurate data corrected
to have data erased, in some circumstances
to ask us to restrict what we do with it, in some circumstances
to object to processing we carry out on the basis of our legitimate interests
to receive data you gave us in a portable form and have it sent to someone else, where it is processed by automated means on the basis of consent or a contract

We do not make any decision about you by automated means alone, and we do not profile you.

To use any of these rights, email us at contact@cruiseswithdavid.com. We will respond within one month. There is no charge.

If you are unhappy with us

You have the right to complain to us directly under section 164A of the Data Protection Act 2018. If you do, we must acknowledge your complaint within 30 days. Please email us and say that you are making a complaint, so that we treat it as one.

You also have the right to complain to the regulator, the Information Commission, under section 165 of the Data Protection Act 2018. You can reach them at ico.org.uk or on 0303 123 1113. You do not have to complain to us first.

Changes to this policy

We may update this policy. The date at the top tells you when it last changed.