How Moonlight Adventures collects, uses and protects your personal information in accordance with UK data protection law.

Last updated: 15 August 2026

Contents

1.Introduction2.Data Controller3.Personal Data We Collect4.How We Collect Your Personal Data5.How We Use Your Personal Data and Our Lawful Basis6.Sharing Your Personal Data7.International Transfers8.Data Retention9.Your Rights Under UK GDPR10.Cookies11.Data Security12.Third-Party Links13.Children's Data14.Changes to This Privacy Policy15.Contact Us

This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The data controller is Richard Elborough of Moonlight Adventures.

1

Moonlight Adventures ('we', 'us', 'our') is committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy sets out how we collect, use, store and share your personal information when you visit our website make an enquiry, or enter into a hire agreement with us.

This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully. By using our website or making a booking, you acknowledge that you have read and understood this policy.

2

The data controller responsible for your personal information is:

Richard Elborough, Moonlight Adventures, Moonlight Barn, 30 Burfitt Road, Castle Cary, Somerset, BA7 7FP.

Email: hire@moonlightadventure.co.uk

Telephone: 07813 083 822 or 01963 361 808

ICO Registration Number: ZC223416

3

We collect and process the following categories of personal data:

Identity and contact data: full name, email address, telephone number(s) and postal address.

Booking and transaction data: details of the hire package enquired about or booked, hire dates, payment information, correspondence and booking history.

Driver and licence data: driving licence number and details, DVLA check codes, licence category, years of driving experience, and insurance questionnaire responses required to arrange motor insurance cover.

Identity verification data: copies of driving licences and supporting identification documents such as utility bills or bank statements (dated within 90 days), provided to verify your identity before commencement of hire.

Criminal offence data: details of current and previous motoring convictions, endorsements and penalty points, which we are required to collect under our insurance obligations. This constitutes data relating to criminal convictions and offences under UK GDPR Article 10 and is processed only to the extent necessary to arrange lawful insurance cover.

Vehicle usage data: data collected from the vehicle during the hire period, which may include telematics, GPS location data and vehicle diagnostic information, where applicable.

Technical data: IP address, browser type and version, device information, pages visited and referring URLs, collected automatically when you use our website.

Communications data: records of correspondence with us by email, telephone or post.

4

Directly from you: when you submit an enquiry form on our website, make a booking, correspond with us by email or telephone, or provide documents at the time of hire.

Automatically: through cookies and similar tracking technologies when you browse our website. Please see Section 10 (Cookies) for further detail.

From third parties: from our insurers and insurance brokers (in connection with arranging cover), the DVLA (via the check codes you provide to us), and payment processors in connection with your booking.

5

We only process your personal data where we have a lawful basis to do so under UK GDPR. The table below sets out our processing activities and the lawful basis we rely on for each.

Processing your enquiry and booking — Lawful basis: Contract (Article 6(1)(b)). We process your identity, contact and booking data to respond to your enquiry and to enter into and perform the hire agreement with you.

Arranging motor insurance cover — Lawful basis: Legal obligation (Article 6(1)(c)) and, for criminal offence data, substantial public interest under Schedule 1 DPA 2018 (insurance purposes). We are required by law and by our insurers to verify your driving history, licence status and any motoring convictions before permitting you to drive our vehicle.

Verifying your identity — Lawful basis: Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)). We verify your identity to fulfil our contractual and regulatory obligations.

Processing payments and the security bond — Lawful basis: Contract (Article 6(1)(b)). We process payment data to collect hire charges and the refundable security bond.

Managing the hire period, damage claims and incidents — Lawful basis: Contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)). We process relevant data to manage the hire, handle any damage or incident claims and protect our assets.

Complying with legal and regulatory obligations — Lawful basis: Legal obligation (Article 6(1)(c)). This includes responding to requests from law enforcement, processing penalty charge notices, and maintaining financial and business records.

Improving our services and website — Lawful basis: Legitimate interests (Article 6(1)(f)). We use technical and usage data to analyse how our website is used and to improve our services, provided this does not override your rights and interests.

Sending marketing communications — Lawful basis: Consent (Article 6(1)(a)). We will only send you marketing communications about our services where you have given us your explicit consent to do so. You may withdraw your consent at any time by contacting us at hire@moonlightadventure.co.uk.

6

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients, and only to the extent necessary for the purposes described in this policy:

Insurers and insurance brokers: to arrange, administer and manage the motor insurance cover included in your hire, including disclosure of driving licence details and motoring conviction data as required by our insurers.

Payment processors: to process hire payments and the security bond securely. Payment card data is processed by our payment provider and is not stored by us.

The DVLA: we use DVLA check codes provided by you to verify your driving licence details directly with the DVLA.

Law enforcement and regulatory authorities: where we are required or permitted to do so by law, for example in connection with penalty charge notices, traffic offences, fraud investigations or court orders.

IT and website service providers: trusted third-party suppliers who provide IT infrastructure, website hosting and email services on our behalf, who are bound by contractual data processing agreements and are not permitted to use your data for their own purposes.

Professional advisers: solicitors, accountants and insurers who provide professional services to us, subject to duties of confidentiality.

7

We do not routinely transfer your personal data outside the United Kingdom. Where any service provider processes data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or equivalent adequacy decisions.

8

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law.

Booking and hire records (including payment records and correspondence): retained for 7 years from the end of the hire period to comply with financial, tax and legal obligations.

Driving licence and identity verification documents: retained for the period required by our insurers and applicable law (typically 3 years from the date of hire), and securely and permanently deleted thereafter.

Criminal offence data (motoring convictions): retained only for the duration of the insurance arrangement to which it relates and deleted promptly once no longer required.

Website technical data: retained for up to 12 months in aggregate or anonymised form.

Enquiry data where no booking results: retained for up to 12 months, after which it is securely deleted.

9

Under UK data protection law you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions in certain circumstances.

Right of access (Subject Access Request): you have the right to request a copy of the personal data we hold about you, together with information about how we process it. We will respond within one calendar month.

Right to rectification: you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to erasure ('right to be forgotten'): you have the right to request that we delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected.

Right to restriction of processing: you have the right to request that we restrict how we process your personal data in certain circumstances, for example whilst we verify the accuracy of data you have contested.

Right to data portability: where we process your data by automated means on the basis of your consent or a contract, you have the right to receive that data in a structured, commonly used and machine-readable format.

Right to object: you have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Right to withdraw consent: where we rely on your consent as the lawful basis for processing (for example, for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Rights in relation to automated decision-making: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. We do not carry out automated decision-making of this nature.

To exercise any of these rights, please contact Richard Elborough at hire@moonlightadventure.co.uk or by post to Moonlight Adventures, Moonlight Barn, 30 Burfitt Road, Castle Cary, Somerset, BA7 7FP. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing your request.

If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk, by telephone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10

Our website uses cookies — small text files stored on your device — to enable the website to function and to help us understand how visitors use it.

Strictly necessary cookies are essential for the website to operate and cannot be disabled. They do not require your consent.

Analytics and performance cookies help us understand how visitors interact with our website in aggregate. These cookies are not strictly necessary and we will seek your consent before placing them, where required by the Privacy and Electronic Communications Regulations (PECR).

You can control and delete cookies through your browser settings at any time. Disabling certain cookies may affect the functionality of our website. For more information about cookies and how to manage them, visit allaboutcookies.org.

11

We have implemented appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration or disclosure. These measures include secure encrypted connections (HTTPS) for all data transmitted via our website and restricted access to personal data within our organisation.

Whilst we take all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

12

Our website may contain links to third-party websites, including insurance providers, booking platforms and other services. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any third-party website you visit before providing any personal information.

13

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us immediately and we will take steps to delete it.

14

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements or business operations. The date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically. Where changes are material, we will take reasonable steps to bring them to your attention.

15

If you have any questions, concerns or requests regarding this Privacy Policy or the way we handle your personal data, please contact our data controller:

Richard Elborough — Moonlight Adventures

Email: hire@moonlightadventure.co.uk

Telephone: 07813 083 822 or 01963 361 808

Post: Moonlight Barn, 30 Burfitt Road, Castle Cary, Somerset, BA7 7FP