OrlandoDaysPrivacy Policy
This policy explains what personal data OrlandoDays (“we”, “us”, “our”) collects, how and why we use it, and the rights you have. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
OrlandoDays is the “controller” of the personal data described in this policy and is operated from the United Kingdom. For any privacy question, or to exercise your rights, contact us at [email protected].
What we collect
- Account details: name, email address, and a hashed (never plain-text) password.
- Payment references: Stripe customer and payment identifiers needed to take and record your one-off payment. We never see or store your full card number.
- Trip content: your itinerary, family-member names and details, dining reservations, flight details, photos, messages, polls, and game activity you and your group add.
- Location data: if you switch on location sharing, your device’s approximate position while sharing is on (see “Location data” below).
- Notifications: if you enable push notifications, a browser push subscription token so we can send wait alerts and reminders to your device.
- Blog comments: the name and comment text you submit if you comment on a blog post.
- Usage and technical data: basic server logs (such as IP address and request information) needed to run, secure, and troubleshoot the service.
How and why we use your data
We use your data only where the law allows. Our legal bases under UK GDPR are:
- Performance of a contract — to create and run your account, process your payment, and provide the trip-planning features you ask for.
- Consent — for optional features you actively turn on, such as location sharing and push notifications, and for trip content that includes photos and details of other people. You can withdraw consent at any time.
- Legitimate interests — to keep the service secure, prevent abuse, fix problems, and understand overall usage. We balance these interests against your rights.
- Legal obligation — where we must keep certain records (for example, for tax or to respond to lawful requests).
Photos and children
Trips often include photos and details of family members, including children. Please only upload photos and information you have consent to share — and, for children, the consent of their parent or guardian. Trip content is visible to anyone who has that trip’s join code, so share the code carefully. You can delete any photo from the gallery, and the organiser can request full deletion of a trip and its content at any time. If you believe a photo of you or your child has been uploaded without consent, contact us and we will remove it promptly.
Location data
Location sharing is off by default and only operates when you switch it on. While it is on, your device sends its position so other members of your trip can see it on the map. Positions are short-lived — they are treated as stale after a couple of minutes — and turning sharing off deletes your stored position. We do not use your location for advertising or build a history of your movements.
Who we share data with
We do not sell your data. We share it only with service providers (“processors”) who help us run the service, and only as far as needed:
- Stripe — payment processing.
- Backblaze B2 — photo storage, served via Cloudflare as our content-delivery network.
- Our email provider — to send account and service emails.
- Browser push services (such as those operated by your browser or device vendor) — to deliver push notifications you have enabled.
- themeparks.wiki (wait times & Lightning Lane), Open-Meteo (weather), and aviation data providers (flight schedules) — these supply information to us; we do not send them your personal data.
- Simple Analytics — privacy-first website analytics that does not use cookies or collect personal data.
We may also disclose data where required by law or to protect our rights, users, or the public.
International transfers
Some of our providers (including Stripe and Backblaze B2) process data outside the UK, including in the United States. Where data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law — such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — so that your data continues to receive an equivalent level of protection.
Cookies
We use only essential cookies needed to keep you signed in and to keep the service secure. We do not use advertising or tracking cookies, and our analytics provider (Simple Analytics) is cookieless.
Retention
We keep trip content while your account or trip is active. When you delete a trip or your account, its content is removed from our systems and storage. We may keep limited records for longer where we have to — for example, payment and tax records, and security logs — and only for as long as the law requires or our legitimate interests reasonably need.
Security
We take reasonable technical and organisational measures to protect your data, including hashing passwords, encrypting data in transit, and restricting access. No online service can be completely secure, but we work to keep your data safe and will tell you and the relevant authority about a serious data breach where the law requires.
Your rights
Under UK GDPR you have the right to access, correct, delete, restrict, or object to our use of your data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these rights, or to delete your account and all associated trips, email [email protected]. We will respond within the time limits set by law, normally within one month.
Complaints
We hope to resolve any concern you raise. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling 0303 123 1113.
Changes to this policy
We may update this policy from time to time. We will change the “last updated” date above and, where changes are significant, take reasonable steps to let you know.