This page is a structural draft. It sets out the sections a compliant notice must contain and must be completed and reviewed by BTX's UK data-protection adviser before publication. It is not yet a valid privacy notice.
Who we are
The data controller, registered address, contact details for data-protection enquiries, and the identity of any appointed representative or data protection officer.
What we collect
Contact details submitted through the pre-screen form, and — where you choose to complete the optional medical section — information about your health, medical history, medication, allergies and lifestyle.
Health information is special category data under UK GDPR Article 9. It is collected only where you provide explicit consent, and the medical section of the pre-screen can be skipped entirely.
Why we collect it, and our lawful basis
The purpose of each category of processing, the Article 6 lawful basis, and for health information the Article 9(2)(a) explicit consent condition.
Who we share it with
Whether and when information is shared with participating medical partners, accommodation and transport providers, and any processors used to operate this website or store enquiries. International transfer arrangements to Colombia, and the safeguards relied upon.
How long we keep it
Retention periods for enquiry data and for health information, and the criteria used to set them.
Your rights
Access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time without affecting processing already carried out. How to exercise each, and the right to complain to the Information Commissioner's Office.
Security
The technical and organisational measures protecting your information, including access controls on the systems where enquiries are held.