GDPR Compliance

Last Updated: July 8, 2026

General Data Protection Regulation Compliance

Neo-prairie is committed to compliance with the General Data Protection Regulation (GDPR) and UK data protection laws. This page outlines how we meet these obligations and respect your data rights.

Data Controller

Neo-prairie acts as the data controller for personal information collected through our website and services. We are responsible for ensuring your data is processed lawfully, fairly, and transparently.

Contact details:
Neo-prairie
42 Kensington Gardens
London SW7 2AP
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Contract: Processing necessary to fulfill our travel services agreement with you
  • Consent: Where you have given explicit permission for specific processing activities
  • Legitimate Interests: Processing necessary for our business operations, provided your rights are not overridden
  • Legal Obligation: Processing required to comply with legal requirements

Your Data Protection Rights

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for additional copies beyond the first request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You may request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes it was collected or if you withdraw consent.

Right to Restrict Processing

You can request that we limit how we use your personal data in specific situations.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Right to Data Portability

You can request transfer of your personal data in a structured, commonly used, and machine-readable format.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected] with:

  • Your full name and contact information
  • Description of the right you wish to exercise
  • Any relevant details to help us locate your data

We will respond to your request within one month. In complex cases, we may extend this period by an additional two months and will inform you of any such extension.

Data Protection Principles

We process personal data in accordance with these principles:

  • Lawfulness, fairness, and transparency: We process data legally and inform you about our practices
  • Purpose limitation: Data is collected for specific, explicit, legitimate purposes
  • Data minimization: We collect only data that is necessary
  • Accuracy: We take steps to ensure data is accurate and up to date
  • Storage limitation: Data is kept only as long as necessary
  • Integrity and confidentiality: We implement appropriate security measures

Data Security Measures

We employ technical and organizational measures to protect your personal data, including:

  • Encryption of sensitive data in transit and at rest
  • Access controls limiting data access to authorized personnel
  • Regular security assessments and updates
  • Staff training on data protection practices
  • Secure disposal procedures for data no longer needed

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Third-Party Processing

When we share data with third-party service providers, we ensure they:

  • Process data only according to our instructions
  • Implement appropriate security measures
  • Comply with GDPR requirements
  • Have data processing agreements in place

International Data Transfers

When transferring data outside the UK or European Economic Area, we ensure adequate protection through:

  • Adequacy decisions by relevant authorities
  • Standard contractual clauses approved by the European Commission
  • Other legally recognized transfer mechanisms

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority.

In the United Kingdom, the relevant authority is:
Information Commissioner's Office (ICO)
Website: ico.org.uk

Updates to This Page

We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. Please check this page regularly for updates.