Legal
Privacy notice
What we collect when you apply to join an expedition, why we hold it, and how to get it removed.
Who we are
Barefoot Conservation Ltd, a company incorporated in England, Company Registration No. 8237883, registered office 63 Portland Ave, Gravesend, Kent, DA12 5HJ, United Kingdom. We are the data controller for the information described here.
What we collect
When you submit an application to join an expedition we ask for:
- Your name, email address and mobile or WhatsApp number
- Date of birth, nationality and postal address
- Your diving qualification, agency, logged dive count and last dive date
- Dietary requirements, a medical declaration and an insurance acknowledgement
- An emergency contact name and number
- Passport number, place of issue and expiry date, and a scan of your passport
- How you heard about us, and anything else you choose to tell us
When you use the contact form we collect only your name, email address, optional phone number and your message.
Why, and on what basis
We use this information to assess your application, to arrange your place on an expedition, to meet the identity and immigration requirements that apply to visitors to Raja Ampat, and to keep you safe on site. Emergency contact and medical information exists so that we can act if something goes wrong in a remote location.
Our lawful basis is the performance of a contract with you, and our legitimate interest in running a safe expedition. Health information is special category data, handled on the basis of protecting your vital interests.
Passport data
Passport numbers and scans are the most sensitive thing we hold. We treat them accordingly:
- Scans are stored in private object storage, never in a public folder
- They are visible only to authenticated Barefoot administrators, and only through a link that expires after five minutes
- They are never attached to or quoted in any email
- Location and camera metadata is stripped from every upload
- There is an administrative action that permanently purges passport number and scan from a record once it is no longer needed
How long we keep it. Passport details are deleted within three months of your expedition ending. If your application is declined or you withdraw it, they are deleted within two weeks. The rest of the application is kept so that we have a record of who has been on site.
Where it is stored
Application records are held in a Postgres database hosted by Railway. Uploaded files are held in S3-compatible object storage. Email is sent from our own mailbox on our web host's mail server, with a transactional email service (Resend) as a backup if that server is unavailable.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. You can also complain to the Information Commissioner's Office. We will respond to a request within one month.
Analytics and cookies
This site uses a session cookie, which exists only so that administrators can stay logged in. It is not used to track visitors.
We do not use advertising or tracking cookies, and there is no cookie banner on this site because there is nothing to consent to. Any visitor analytics we add will be a privacy-first service that sets no cookies and does not identify you.
Photographs
We photograph expeditions, and those photographs are used on this site and on our social channels. We ask for written consent from identifiable people, and specific guardian consent for any child. If you appear in a photograph and want it removed, tell us and we will remove it.
Contacting us
For anything in this notice, including access and erasure requests, email info@barefootconservation.org or write to Barefoot Conservation Ltd, 63 Portland Ave, Gravesend, Kent, DA12 5HJ, United Kingdom.