Legal · Working draft
Privacy Notice
Draft information about the current inquiry flow and site analytics, including a GDPR-related rights overview. Requires operator and qualified legal review before it is treated as final.
Draft date: [INSERT DATE AFTER LEGAL REVIEW] · Effective date: [TO BE COMPLETED BY THE OPERATOR]
1. Who is responsible for your information
This is a draft privacy notice. The controller or other responsible legal entity has not yet been identified in the information available for this draft.
[OPERATOR / LEGAL REVIEW REQUIRED: insert the controller's full legal name, entity type, registered address, privacy contact email and telephone, establishment, and any required representative or data-protection officer details. Confirm the roles of any joint controllers.]
2. Information the site may process
If you submit a private-briefing inquiry, the current form asks for your name, email address, phone number, country of residence, number of seats requested, preferred contact method, and a short message. It also includes an optional companion name and optional LinkedIn profile URL, plus acknowledgements that you are 18 or older, understand that this is a demanding full-length expedition, and agree to be contacted about the inquiry.
The current public form is for an inquiry only. It does not request passport details or images, date of birth, medical history, source-of-funds documents, or payment-card details. Please do not include sensitive information in the message field.
The site also loads PostHog analytics when its storefront analytics key is configured. The current code is set to capture page views and autocaptured interactions and to use browser local storage and cookies. [OPERATOR / LEGAL REVIEW REQUIRED: confirm whether analytics is enabled in production, exactly what event and device data is collected, cookie/local-storage names and lifetimes, IP handling, any masking or exclusions, and the available user controls before publishing this notice as final.]
The site stylesheet also requests fonts from Google Fonts. [OPERATOR / LEGAL REVIEW REQUIRED: confirm the provider, request details, and any associated processing or transfer disclosures.]
[OPERATOR / LEGAL REVIEW REQUIRED: confirm any server, hosting, security-log, or other technical data processed when visitors use the site, and describe the categories accurately.]
3. Why information is used and legal bases
Inquiry information is transmitted to the expedition team so it can receive and respond to a private-briefing request. If you provide a LinkedIn profile URL, the team may review it in connection with your inquiry. The current site sends inquiry submissions through the MadeThis platform's signed notification service, which routes the request to the business and may send a response to the submitted email address. Analytics may be used to understand site visits and interactions when configured.
These are descriptions of current intended uses, not a determination of a lawful basis. [OPERATOR / LEGAL REVIEW REQUIRED: identify and document the applicable lawful basis for each purpose and data category, including inquiry handling, follow-up communications, site analytics, and any security or technical processing. Confirm how consent is obtained where required.]
4. Who may receive information
Inquiry submissions are processed through the MadeThis platform notification service. PostHog may process analytics data when the storefront analytics integration is configured. The site stylesheet requests font files from Google Fonts. Website infrastructure and other vendors may process technical information as needed to operate the site.
[OPERATOR / LEGAL REVIEW REQUIRED: identify each actual provider and recipient, its role, the data it receives, processing location, applicable contractual safeguards, and whether it acts as a processor or independent controller. Do not publish a list until verified against production configuration and vendor agreements.]
5. Retention and international transfers
[OPERATOR / LEGAL REVIEW REQUIRED: specify a retention period or objective criteria for each data category and purpose. Do not publish a period until the operator has set and implemented it.]
[OPERATOR / LEGAL REVIEW REQUIRED: identify whether personal data is transferred outside the relevant country or region; name the destinations and recipients; and, if applicable, state the transfer mechanism and how a copy can be obtained. Do not imply a transfer safeguard is in place until verified.]
6. Your choices and how to contact us
[OPERATOR / LEGAL REVIEW REQUIRED: provide a working privacy-request channel and describe how identity and authority are checked, how requests are handled, any applicable timelines or exceptions, and how a person can complain. Do not send sensitive identity documents through an unverified public channel.]
7. Changes and policy date
[OPERATOR / LEGAL REVIEW REQUIRED: describe how material changes will be communicated and insert the approved publication and effective dates.]
Draft informational content · Not a compliance statement
GDPR-related information and individual rights
Depending on where you are, which privacy laws apply, and the circumstances of the processing, you may have rights concerning your personal data. The overview below is general draft information only. It is not a determination that GDPR applies to a particular person or that this business meets any legal requirement; rights can be subject to conditions and exceptions under applicable law.
Access
You may have a right to ask whether personal data about you is processed and, where applicable, to request access to it and related information.
Rectification
You may have a right to ask for inaccurate personal data to be corrected and incomplete data to be completed.
Erasure
You may have a right to ask for personal data to be erased in circumstances provided by applicable law.
Restriction
You may have a right to ask for processing to be restricted in certain circumstances.
Data portability
Where the applicable legal conditions are met, you may have a right to receive certain data you provided in a structured, commonly used, machine-readable format or ask for it to be transmitted to another controller.
Object to processing
You may have a right to object to certain processing, depending on its purpose and legal basis and the circumstances set out in applicable law.
Withdraw consent
If a particular processing activity relies on your consent, you may have a right to withdraw that consent. Withdrawal does not affect processing carried out before withdrawal.
Automated decisions
You may have rights relating to decisions based solely on automated processing, including profiling, where the applicable legal conditions are met. [OPERATOR / LEGAL REVIEW REQUIRED: confirm whether any such decisions are made.]
Complain to a supervisory authority
You may have a right to lodge a complaint with a data-protection supervisory authority, including in the country where you live, work, or where you believe an issue occurred. [OPERATOR / LEGAL REVIEW REQUIRED: identify the competent authority or explain how a person can identify it.]
[OPERATOR / LEGAL REVIEW REQUIRED: confirm which rights apply to the operator's actual processing and identify any local variations, restrictions, and exceptions before publication.]
Privacy requests: [INSERT VERIFIED PRIVACY CONTACT AND REQUEST METHOD]. Controller identity: [INSERT VERIFIED CONTROLLER DETAILS]. Applicable supervisory authority: [CONFIRM WITH QUALIFIED COUNSEL].
Legal basis by purpose: [TO BE COMPLETED]. Retention periods: [TO BE COMPLETED]. International transfer destinations and safeguards, if any: [TO BE COMPLETED]. These details have not been established by this draft.