Privacy Policy

1. Who I am
I am Nana Tomova, trading as Nana Tomova Storyteller. I am the "data controller" for the personal information collected through this website and in connection with my events, vouchers and book sales. This means I decide how and why your information is used.

2. What information I collect
As an activity organisation, I need certain details to fulfil my contract with you. Depending on how you use my website and services, I may collect:

Contact details: your name, email address, phone number and postal address.
Booking information: which events or sessions you book, dates, ticket details and any messages you send me.
Story Walk booking details: if you complete a booking form for a Story Walk, I ask for your name, email address, address, phone number, any medical conditions that may affect your safety, and emergency contact details.
Order information: the books or vouchers you buy, delivery address and order details. Card payments are handled by PayPal and Stripe, and I do not see or store your card details.
Mailing list information: your name and email address, if you subscribe to my newsletter.
Enquiries: anything you send me through a contact form, by email or on social media.
Technical information: if you browse this website, cookies may collect your operating system, browser, device type, general demographic information (such as age band, gender and country), IP address and how you use the site (for example pages viewed and links clicked). See section 8.
Photos and recordings: images or recordings of you if you attend an event where these are taken, as explained at the event.

3. How and why I use your information
Under UK data protection law, I must have a lawful basis for using your information. These are mine:

Taking bookings, selling vouchers and books, and delivering orders. I use your contact, booking, order and payment details. The lawful basis is contract, because I need them to provide what you've bought.
Internal record keeping. I use booking and order records. The lawful basis is legitimate interests, so that I can run my business properly.
Replying to your enquiries. I use your contact details and your message. The lawful basis is legitimate interests, so that I can respond to you.
Keeping you safe on Story Walks and making events accessible. I use the health, access and emergency contact information you give me, so that I or any other guide can look after you safely in a nature environment. The lawful basis is explicit consent for health information (see section 4), and legitimate interests for emergency contacts.
Improving my products and services. I use booking and website information. The lawful basis is legitimate interests.
Sending my newsletter and event news. I use your name and email address. The lawful basis is consent, which you can withdraw at any time.
Keeping accounting and tax records. I use order and payment details. The lawful basis is legal obligation.
Running the website. I use technical information. The lawful basis is consent for non-essential cookies, and legitimate interests for essential ones.
Photos and recordings of events. I use images and audio. The lawful basis is legitimate interests, or consent where appropriate.
Protecting against fraud, enforcing my terms and resolving disputes. I use the relevant records. The lawful basis is legitimate interests.

4. Health information and emergency contacts
Information about health is "special category" data and needs extra care. I collect it only when you choose to give it to me, to keep you safe or to make an event accessible, and I ask for your explicit consent first. I use it only for that purpose and share it only with people who need to know to keep you safe, such as another guide or venue staff or medical professionals should you require medical care at any point during attending an event with me. You can withdraw your consent at any time by emailing me, although this may mean I cannot safely include you in an activity.

If you give me the details of an emergency contact, please make sure they know you have done so. I use their details only if there is an emergency involving you.

5. Who I share your information with
I do not sell, trade or otherwise transfer your personal information to outside parties for their own purposes. I only share it with services that help me run my work, who must keep it secure and use it only on my instructions, such as:

PayPal and Stripe, to process payments. Their own privacy policies are on their websites.
Booking or ticketing platform, e.g. Eventbrite, Ticket Tailor
Email newsletter service, e.g. Mailchimp, Wix, Substack
Website host and platform, Wix
Video platform for online events, e.g. Zoom
Couriers and postal services, to deliver your orders
My accountant and professional advisers
Venues, if sharing a name or access need is necessary for your booking

I may also release information when I believe it is appropriate to comply with the law, enforce my website and booking terms, or protect my rights, property or safety, or those of others, for example if requested by the police or another authority.

6. Transfers outside the UK
Some of the services above may store or process data outside the UK, for example in the USA. Where this happens, I make sure appropriate safeguards are in place, such as the UK's approved data transfer arrangements or standard contractual clauses.

7. How long I keep your information

Transaction and accounting records: 6 years after your booking or purchase, for tax and financial reasons.
Health information from booking forms: 3 years after the event, in line with health and safety practice and the usual time limit for bringing a personal injury claim. After that it is deleted.
Other booking and enquiry records: 2 years after the event or last contact.
Mailing list: until you unsubscribe.
Photos and recordings: as long as they are useful for promoting my work, and I will remove an image if you ask me to.

8. Cookies
My website uses cookies, which are small files stored on your device.

Essential cookies are needed for the site to work, for example for the checkout, and don't need your consent.
Analytics cookies show me how people use the site, for example through [Google Analytics / other]. I only use these if you accept them.
Third-party cookies may be set by embedded content such as videos or social media feeds. [List, if any.]

You can change your cookie choices through the cookie banner or in your browser settings.

9. Your rights
Under UK data protection law, you have the right to:

Be told how your information is used (which this policy does).
Ask for a copy of the information I hold about you.
Ask me to correct anything that is wrong or incomplete. I will correct it promptly.
Ask me to delete your information, in some circumstances.
Ask me to restrict how I use your information, in some circumstances.
Object to my using your information, including for direct marketing.
Ask for your information in a portable format, in some circumstances.
Withdraw your consent at any time, where I rely on it. This does not affect anything I did before you withdrew it.

To use any of these rights, email me at [email address]. I will respond within one month. I may need to check your identity first.

10. Marketing
I will only send you my newsletter or event news if you have chosen to receive it. Every email includes an unsubscribe link, or you can ask me to remove you at any time. I will not pass your details to anyone else for marketing.

11. Security
I will take all reasonable steps to keep your personal data secure and to prevent unauthorised access to it. All information you provide is stored securely. Sending information over the internet is never completely secure, so I cannot guarantee the security of anything you send to this website, and any transmission is at your own risk.

I limit the amount of data I keep on paper. Paper documents that need to be kept, such as booking forms, are converted to electronic form and the original is then destroyed.

If you suspect a breach of security, or receive a suspicious message from someone claiming to be me, please tell me immediately.

12. Children
My website and bookings are intended for adults. If a child attends an event, any information about them should be given by a parent or guardian, and I will use it only for the event.

13. Links to other websites
My website may contain links to other websites of interest. Once you leave this site, I have no control over those websites and cannot be responsible for how they protect any information you give them. They are not covered by this privacy policy, so please read the privacy statement of any site you visit.

14. Complaints
If you are unhappy with how I have used your information, please contact me first so I can put things right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.

15. Changes to this policy
I may update this policy from time to time. The latest version will always be on this page, with the date at the top.