Privacy Policy

Version: 1.3
Effective Date: 23 January 2026
Last Updated: 16 October 2026

1. Who We Are

Company Name: OKInvent Limited
Trading As: Tripsdock
ICO Registration: ZC216872
Contact Email: help@tripsdock.com
Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Tripsdock is a Software-as-a-Service (SaaS) platform that helps clubs and groups organise and manage trips.

2. What This Policy Covers

This Privacy Policy explains how we collect, use, store, and protect your personal information when you:

• Create an account on Tripsdock
• Join a club or group that uses our platform
• Register for trips
• Provide emergency contact information
• Use any features of our platform

This policy applies to all users, including club organisers, administrators, and trip participants.

3. What Personal Data We Collect

3.1 Account Information

When you create an account (either yourself or when invited by a club), we collect:

• Full name
• Email address
• Phone number (group owners only, when registering their group)

You sign in with a link or code we email you. We don't ask for or hold a password.

3.2 Emergency Contact Information (ICE - In Case of Emergency)

For trip safety, you provide emergency contact details that will be shared with your assigned ICE holder on each trip:

• Emergency Contacts: Up to 3 contacts (e.g., spouse, family member, friend) with name, phone number, relationship to you, and an optional note
• Home address
• Travel Insurance: Insurance company name, emergency contact number, and an optional notes field
• Breakdown Cover: Company name, emergency contact number, and an optional notes field
• Vehicle Insurance: Insurance company name, emergency contact number, and an optional notes field

The optional notes fields let you add anything your ICE holder might need to quote when they call on your behalf (e.g. an account or policy number) — they're free text because insurers vary widely in what they ask for. Please don't put passwords, PINs, or banking security answers in them.

ICE Holder Assignment: For each trip, the trip organiser assigns you an ICE holder (another trip participant). Your ICE holder can view all your emergency information ONLY when you're both registered on the same trip. This ensures someone physically present knows how to contact your next of kin and insurers if you're injured or in an accident.

Important: We do NOT ask for medical information, health conditions, medications, allergies, or insurance policy numbers — your insurance company already has your complete medical records, and your ICE holder usually just needs to know how to contact them with your name. If your own insurer needs more than that to route a call (for example, an account number on a bank-administered policy), you can optionally add it to that section's notes field — this is your choice, not something we require.

3.3 Trip Participation Data

When you register for trips:

• Trip registration: Which trips you're attending and the parts you choose; your mobile number, postcode and country; room and sharing preferences; any special requirements you tell the organiser
• Vehicle details (if the trip asks): Make, model and registration plate
• A passenger (if you bring one): Their name, and optionally their email and mobile
• If you cancel: Your reason, if you give one
• Payment records: What your organiser records about your payments (amounts, dates, references). You pay the group directly; Tripsdock doesn't take your trip payments and never sees your card details
• After the trip: Your rating of the trip, and any photos and write-ups you add to its journal

3.4 Financial Information (Group Owners Only)

For groups receiving participant payments:

• Bank account name
• Sort code
• Account number

Note: These are stored encrypted and shown to the group's participants so they can pay the group directly. Tripsdock never handles participants' trip money; it charges groups a platform fee through Stripe.

3.5 Photos

• Trip journal photos: Photos you add to a trip's journal after the trip

Photo Ownership: When you upload photos to trip journals, you transfer ownership of those photos to the group. This allows groups to maintain complete trip documentation and memories. By uploading, you confirm you have the right to transfer ownership and that the photos don't infringe anyone else's rights.

Appearing in Photos: By participating in trips, you consent to appearing in group photos taken by other participants. Trip photos are owned by the group and may remain in the trip's journal even after you leave. If you have concerns about appearing in specific photos, contact privacy@tripsdock.com and we'll work with the group organiser to address your request.

3.6 Technical Information

We automatically collect:

• IP addresses, browser and device type (in our hosting's request logs; when we check a form is sent by a person; and with the records we keep of sign-ups, accepted invitations, data downloads, contact form messages and views of emergency details)
• Pages visited (page-view statistics that don't identify you)
• Errors and slow pages (error reports and a sample of page timings, with record ids; email addresses are removed)
• Sign-ins (the email address, IP address and browser of each sign-in link used, kept for 30 days to look into sign-in problems)

This helps us keep the platform secure and running smoothly.

4. Why We Collect This Data (Purpose)

4.1 Service Delivery

Legal Basis: Contract necessity (GDPR Article 6(1)(b))

We need your information to:

• Create and manage your account
• Let you register for trips
• Enable club organisers to plan trips (headcount, vehicle details where applicable)
• Record trip payments, and charge groups our platform fee
• Send you notifications about trip updates

4.2 Emergency Coordination

Legal Basis: Vital interests (GDPR Article 6(1)(d)) and Contract necessity

Your emergency contact information allows:

• Your ICE holder on each trip to contact your next of kin if you're injured or in an accident
• Emergency services to reach your insurance company with your name (they already have your medical records)

Privacy by Design: Only your assigned ICE holder can see your emergency contact details—not club admins, not platform admins, not other participants. ICE holders are assigned by trip organisers from the people registered on the trip (which can include an organiser who is going), and can only view your emergency information when you're both registered on the same trip. Your ICE holder also sees your name and mobile number.

4.3 Platform Improvement

Legal Basis: Legitimate interests (GDPR Article 6(1)(f))

We use page-view statistics that don't identify you, and error reports (with record ids; email addresses removed), to:

• Improve features
• Fix bugs
• Understand which features are most valuable
• Make the platform easier to use

4.4 Legal Compliance

Legal Basis: Legal obligation (GDPR Article 6(1)(c))

We keep financial records for 7 years to comply with HMRC requirements.

4.5 Photos and Trip Documentation

Legal Basis: Legitimate interests (GDPR Article 6(1)(f))

Trip photos serve the club's legitimate interest in documenting activities and building community. Your interest in privacy is balanced by:

• Photos being used only for club documentation and memories (not commercial purposes)
• Photos requiring admin review before publication
• Your ability to request removal of photos where you appear
• Approved photos and write-ups appearing in the trip's journal for the group's members, and on the group's public trip page without the name of who added them

5. How Long We Keep Your Data

We don't delete inactive accounts automatically. Your account stays until you delete it, so it's there when you come back for another trip.

You can delete your account via Privacy & Data → Delete My Account (section 7.3 says when we do it with you instead).

6. Who Can Access Your Data

6.1 You

You can see your data on the Privacy & Data page (and download it there), edit your name and email with Edit Your Profile, and change a trip registration on its trip page until the organiser locks it. For anything else, ask your group's organiser or email privacy@tripsdock.com.

6.2 Club Organisers and Trip Admins

Can see (for their club only):

• Your name, email, phone number
• Trip registrations and preferences, special requirements and any passenger's details
• Vehicle details (if provided)
• Payments, and your reason if you cancel
• Your trip ratings
• Cannot see: Your emergency contacts, insurance details, home address (unless they're your ICE holder on the trip)

Other People in Your Group

Your group's members can see who's going on a trip: names, vehicles, passengers and who's sharing a room. People registered on the same trip also see each other's vehicle registration plates. Your contact details and payments are shown only to the organisers (and you). Members can also see each member's name, role, when they joined and how many trips they've been on (the Members page).

Anyone (Public Trip Pages)

A group's public trip pages show approved journal photos and write-ups after the trip, without the name of who added them. To have one removed, email privacy@tripsdock.com.

6.3 Your ICE Holder (Assigned by Trip Organiser)

Only when you're both registered on the same trip:

• Can view all your emergency contact information (contacts, insurance details, home address)
• Every view is logged in an audit trail
• Assignment is controlled by trip organiser, not by you

Note: Your ICE holder changes for each trip based on organiser assignments. You cannot choose your own ICE holder.

6.4 Tripsdock Team

Very limited access:

• Platform administrators can view account data only when necessary for support requests or technical issues
• Emergency contact (ICE) data is NOT accessible through admin interfaces
• Database-level access to ICE data only in exceptional technical circumstances (e.g., data corruption, disaster recovery)
• Changes our admins make to groups, fees and pricing are logged

6.5 Third-Party Service Providers

We use trusted services to run the platform. Each processes data for us under its standard data processing terms, which commit it to UK GDPR:

Important: These providers process your data to provide their service to us, under their standard terms.

7. Your GDPR Rights

You have the following rights under UK GDPR:

7.1 Right to Access (Article 15)

Request a copy of your data.

How: Privacy & Data → Download My Data gives your main data (account, registrations, emergency details, payments, memberships) as a JSON file. For everything else we hold about you, email privacy@tripsdock.com and we'll send it.

7.2 Right to Rectification (Article 16)

Correct inaccurate or incomplete data.

How: Edit Your Profile (name and email), your trip registration (until the organiser locks it), or ask your group's organiser

7.3 Right to Erasure / “Right to be Forgotten” (Article 17)

Delete your account and personal data.

How: Privacy & Data → Delete My Account

What Happens:

• You can delete your account yourself unless you have a place on a trip that isn't yet marked completed or cancelled (even a cancelled place: a refund may still be due), you are a trip's representative, or you run a group as an owner or admin. Then email help@tripsdock.com and we'll do it with you
• Deleted straight away: your account and our record of your sign-ups and data downloads, your group memberships and profiles, your emergency (ICE) details, your profile photos, and the emails we sent you. On your trip registrations your name becomes “Deleted User”, and your contact details, vehicle and registration plate, your passenger's name and contact details, special requirements and any cancellation reason are removed, as are your vehicle change requests
• Kept:
  • your trip registrations and payments, under “Deleted User” (the trip's accounts need them, and financial records are kept for 7 years)
  • your trip ratings, and the photos and write-ups you added to trip journals, shown as by “A member”
  • records of changes to trips and groups that involve you (for example registering, or being invited to a group), with your name, email address and the details you entered (such as your vehicle, plate and passenger's name), for 2 years; and when you viewed someone's emergency details as their ICE holder, without your name but with the IP address, for 2 years
  • emails we sent to organisers about you (for example, that you registered), until they delete their account
  • your name and contact details on someone else's registration, if they gave them as their passenger
  • sign-in diagnostic records, for up to 30 days; and the sign-in log our sign-in provider (Supabase) keeps, for its own log period
  • anything you sent without signing in (a contact form message, interest in a trip), and invitations to join a group that you accepted, which aren't linked to your account
  Ask us at privacy@tripsdock.com and we'll delete or anonymise any of these that the law doesn't require us to keep
• Copies in our database provider's daily backups are kept as long as our plan keeps them (currently 7 days), then removed automatically; copies in our providers' own logs (for example email delivery logs) for their log periods

7.4 Right to Data Portability (Article 20)

Export your data in a machine-readable format.

How: Privacy & Data → Download My Data (JSON format)

7.5 Right to Object (Article 21)

Object to processing based on legitimate interests.

How: Email privacy@tripsdock.com with specific objection

7.6 Right to Restrict Processing (Article 18)

Temporarily freeze your data.

How: Email privacy@tripsdock.com

7.7 Right to Withdraw Consent

For any processing requiring consent, you can withdraw it anytime.

How: Email privacy@tripsdock.com

Response Time: We'll respond to all requests within 30 days (or explain why we need more time).

Photo Appearance: If you have concerns about appearing in specific trip journal photos (e.g., safety reasons, privacy concerns), email privacy@tripsdock.com with details. We'll work with the club organiser to address your request where reasonably possible, though removal cannot be guaranteed for all historical group photos.

8. Data Security Measures

We take security seriously:

8.1 Encryption

• In transit: All data encrypted with TLS/HTTPS
• At rest: Database encryption for all stored data
• Bank details: A group's bank details are encrypted again on top of that
• No passwords: You sign in with a link or code we email you, so there's no password to steal

8.2 Access Controls

• Server-side checks: Every request is checked on our servers against who you are and which group and trip it's for. Browsers can't reach the database directly
• Role-based access: Members, admins, and owners have different permission levels

8.3 Audit Logging

• Every view of emergency (ICE) details is logged with the time and who viewed them
• Changes to trips, groups, payments, fees and pricing are logged with who made them
• Sign-ups, accepted invitations and data downloads are logged; sign-ins are kept for 30 days

8.4 Infrastructure Security

• Our database and files are stored in the UK (Supabase, London)
• Daily backups by our database provider, kept as long as our plan keeps them (currently 7 days)
• The denial-of-service protection our hosting provider (Vercel) includes

No system is 100% secure. If we experience a data breach, we'll tell the ICO within 72 hours where the law requires it, and tell you without delay if it puts you at high risk (section 13).

9. International Data Transfers

Primary hosting: Our database and files are stored in the United Kingdom (Supabase, London region - AWS eu-west-2).

UK Adequacy: The UK has been granted an adequacy decision by the EU Commission, meaning UK data protection standards are recognised as equivalent to GDPR. Data stored in the UK benefits from the same protections as EU-stored data.

Third-party services: Sentry stores error reports in the EU (Germany). Some providers (Stripe, Vercel, Resend, Cloudflare) may process data globally but have Standard Contractual Clauses (SCCs) and GDPR compliance guarantees ensuring adequate protection for international transfers.

We do NOT transfer data to countries without adequate data protection laws unless we have specific safeguards in place.

10. Cookies and Tracking

We only use the cookies that keep you signed in (set by our sign-in provider, Supabase). Display preferences, such as dark mode, are kept in your own browser's storage, not in a cookie.

No advertising or tracking cookies. Our page-view statistics (Vercel Analytics) don't use cookies. We don't sell your data or track you across other websites.

Cookie Settings: You can disable cookies in your browser, but you won't be able to sign in.

11. Children's Privacy

Tripsdock is for adults: you must be 18 or over to use it (our Terms of Service, section 2). We do not knowingly collect data from children. If you believe a child has created an account, email privacy@tripsdock.com and we'll delete it immediately.

12. Changes to This Policy

We may update this policy from time to time. When we do, we update the Version and Last Updated at the top:

1. Minor changes (clarifications, corrections): the version number goes up (e.g. 1.1 → 1.2). You don't need to do anything.
2. Material changes (new data we collect, or a new use of it): a new major version (e.g. 1.x → 2.0). We'll email you at your registered address before it takes effect and ask you to agree to it again.

The effective date is shown at the top of this policy. Continued use after the effective date means you accept the changes.

13. Data Breach Notification

If we experience a data breach that affects your rights and freedoms, we will:

1. Notify the ICO within 72 hours (legal requirement)
2. Notify you without undue delay via email if high risk to you
3. Explain what happened, what data was affected, and what we're doing about it
4. Provide advice on protecting yourself (e.g., watching for suspicious emails)

You have the right to lodge a complaint with the ICO if you're unhappy with how we handle a breach.

14. Contact Information

For privacy questions, data requests, or concerns:

Email: privacy@tripsdock.com
Response Time: Within 5 business days

For general support:

Email: help@tripsdock.com

Postal Address:
OKInvent Limited
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

ICO Registration: ZC216872

To lodge a complaint with the UK regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk/make-a-complaint/
Phone: 0303 123 1113

15. Legal Entity Information

Data Controller:
OKInvent Limited
Company No. 13699446
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
ICO Registration Reference: ZC216872

Governing Law:
This Privacy Policy is governed by the laws of England and Wales.

Jurisdiction:
Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.