PRIVACY POLICY

1. Overview & Data Controller

This Privacy Policy outlines how Top Tlly Pure Quest Expeditions Ltd. ("we," "our," or "us"), operating under the digital property toptllypurequst.yachts, collects, processes, and protects personal data obtained from visitors and expedition participants.

We are committed to operating transparently, in full compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

Data Controller contact information:
Top Tlly Pure Quest Expeditions Ltd. (Registration #14892019)
74 Summit Pass Way, Highland Ridge, Inverness, IV2 4TX, United Kingdom
Email: [email protected]

2. Categories of Information Collected

We strictly limit our data collection to technical and communication data necessary to deliver our content, process inquiries, and ensure digital security:

• Directly Provided Information: When you complete our contact or expedition inquiry form, we collect your full name, email address, inquiry topic, and message contents.
• Technical & Telemetry Data: When browsing our pages, server logs automatically capture your anonymized Internet Protocol (IP) address, browser family and version, operating system, referring URL, time spent per page, and access timestamps.
• Device & Preference State: We store local device preferences regarding your cookie consent status via browser local storage.

3. Legal Bases for Processing

We process your personal information under the following legal frameworks established by Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): You have provided explicit consent when submitting an inquiry or agreeing to optional browser cookies.
• Contractual Necessity (Art. 6(1)(b)): Processing necessary to respond to pre-contractual requests regarding our guided expeditions or workshop consultations.
• Legitimate Interests (Art. 6(1)(f)): Securing our web servers against denial-of-service attempts, preventing spam, and auditing platform performance.
• Legal Obligation (Art. 6(1)(c)): Compliance with statutory accounting and administrative reporting requirements under UK corporate law.

4. Third-Party Data Processors

We do not sell, rent, or trade your personal data to data brokers or advertising networks. To ensure reliable digital operations, we work with vetted infrastructure service providers who operate under strict Data Processing Agreements (DPAs):

• Web Hosting & Edge Infrastructure: Static delivery networks and secure UK/EU-based data centers providing TLS encryption.
• Email Dispatch: Encrypted transactional mail services used strictly to transmit contact requests to our desk.

5. International Data Transfers

Where technical data is transferred outside the United Kingdom or European Economic Area, we ensure adequate protections through the UK International Data Transfer Addendum or European Commission Standard Contractual Clauses (SCCs), ensuring equivalent levels of data subject protection.

6. Data Retention Schedule

Inquiry submissions through our contact interface are retained for a period of eighteen (18) months following the conclusion of correspondence, unless ongoing contractual or insurance relationships require extended archiving. Server access logs are routinely purged after ninety (90) calendar days.

7. Your Statutory Rights (GDPR & CCPA/CPRA)

Under applicable privacy statutes, you maintain enforceable rights regarding your personal records:

• Right of Access: You may request copies of personal data we retain concerning you.
• Right to Rectification: You may require us to correct inaccurate or incomplete contact records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal records where no overriding legal mandate requires retention.
• Right to Restrict Processing: You may limit how we process your personal data during formal disputes.
• Right to Data Portability: You may obtain your provided data in a structured, machine-readable format.
• Right to Non-Discrimination: California residents will not experience price penalties or service alterations for exercising privacy rights.

To exercise any of these statutory rights, please submit a verified request to our Data Protection Officer at [email protected]. We verify applicant identity and respond within thirty (30) days without administrative charge.

8. Data Security Measures

We implement rigorous technical and organizational safeguards including 256-bit TLS protocol transport encryption, static code architecture free from dynamic database vulnerabilities, strict principle-of-least-privilege staff access, and continuous intrusion monitoring.

9. Policy Updates

We may amend this Privacy Policy periodically to reflect changes in expedition offerings or statutory data requirements. Changes will be posted to this URL with an updated revision date.