Privacy Policy

Last updated: 4 August 2026. This policy replaces all previous versions.

Who we are

WanderRock LLC is the controller of the personal information described in this policy. We are a California limited liability company and a registered California seller of travel, CST 2142228.

Mailing address: 2443 Fillmore St. #380-2362, San Francisco, CA 94115.
Email: info@wanderrock.com

What we collect

When you browse the site. IP address, device and browser type, pages viewed, referring site, and cookie identifiers.

When you join our email list or make an enquiry. Name, email address, phone number, and anything you choose to tell us in a message.

When you apply for a trip. Name, date of birth, gender, email, phone, location, and your answers to our application questions — which include whether you have a diagnosis of autism, ADHD or a related condition.

When you book a trip. Passport details, emergency contact details, travel insurance details, and information about your health, medication, allergies, dietary requirements and support needs. Payment card details are collected and processed by Stripe and are never stored by us.

Health information and other sensitive data

Some of what we collect is treated as more sensitive than ordinary personal information.

Information about your health, your diagnosis, your medication and your support needs is special category data under UK and EU data protection law, and sensitive personal information under the California Consumer Privacy Act. Passport and government identifier data is also sensitive personal information under California law.

We collect and use this information only with your explicit consent, which you give when you submit an application or a pre-departure health form. We use it for one purpose only: to operate your trip safely and to respond in an emergency. We do not use health information for marketing, and we do not sell or share it with advertisers.

You may withdraw that consent at any time by emailing us. If you withdraw it before or during a trip we may be unable to continue your booking, and the cancellation terms in the Booking Agreement will apply.

Why we use your information, and our legal basis

To operate your trip — booking accommodation, transport and activities, and arranging your arrival. Legal basis: performance of a contract.
To keep you safe in an emergency — sharing what a medical provider or consular official needs to know. Legal basis: explicit consent, and vital interests where you are unable to consent.
To assess applications — deciding whether a trip is suitable for you. Legal basis: steps taken at your request before entering a contract, and explicit consent for the health element.
To take payment and prevent fraud. Legal basis: performance of a contract, and our legitimate interests.
To send you marketing about our trips, where you have asked us to or are an existing customer. Legal basis: consent, or legitimate interests. You can unsubscribe from any email.
To measure and improve our advertising. Legal basis: consent.
To meet legal obligations — including seller of travel, tax and accounting requirements. Legal basis: legal obligation.

We share personal information with the following categories of recipient:

Trip suppliers — airlines, accommodation providers, activity operators, vessel operators and local guides, where they need it to deliver your trip.
Emergency and medical providers — hospitals, doctors, insurers, emergency services and consular officials, in an emergency.
Service providers who process data on our behalf — Stripe (payments), Zoho (email and website chat), Formspree (contact forms), Calendly (call scheduling), Google (analytics and advertising), and Meta (advertising).
Professional advisers and authorities — where we are required to disclose by law.

Your booking record, your application answers and any health, medication or dietary information you give us are held in our own systems. They are not stored in a third-party customer relationship or marketing platform, and they are not used for marketing.

We do not sell your personal information for money.

We use Google and Meta advertising tools on this site. To measure how well our advertising works, we share limited contact information — which may include your name, email address and phone number — with Google, which matches it against its own records.

Under California law this counts as “sharing” for cross-context behavioral advertising, and you have the right to opt out. You can do so by emailing info@wanderrock.com with the subject line “Do Not Sell or Share My Personal Information”. We will action it within 15 business days and it costs you nothing.

We never include health information, diagnosis information or passport data in anything shared with an advertising platform.

International transfers

We are based in the United States and our suppliers are all over the world. If you are in the UK or the EU, your information will be transferred outside the UK or EEA in order to operate your trip.

Where we transfer information to a service provider, we rely on Standard Contractual Clauses or the UK International Data Transfer Addendum. Where we transfer information to a trip supplier or a medical provider in the country you are traveling to, we rely on the fact that the transfer is necessary to perform your contract, and on your explicit consent for health information.

How long we keep it

Most of our travelers come back, and we would rather you did not have to fill in the same forms twice. So we keep your details on file between trips rather than making you start again.

Your traveler profile — your contact details, travel documents, and the answers you gave us about how you travel — is kept for as long as you are traveling with us, so that booking your next trip is a matter of confirming what we already hold. You can ask us to delete it at any time.
Health, medication and dietary information is kept on the same basis, but only if you have agreed to it being kept for future trips. You are asked separately when you first give it to us, you can say no without it affecting your booking, and you can withdraw at any time. If you do not agree, or you withdraw, it is deleted within 90 days of your trip ending.
Booking and trip records — 7 years after the trip. This is the period in which a claim could be brought against us, and it matches our tax and seller of travel record-keeping obligations. We keep these even if you ask us to delete everything else.
Enquiries that never become bookings — deleted once it is clear you are not traveling with us.
Marketing preferences and unsubscribe records — kept indefinitely, so that we do not contact you again after you have asked us not to.

You do not have to wait for any of these. Ask us to delete your profile at any time and we will, keeping only what the law requires us to keep.

Once we have passed information to a trip supplier — an airline manifest, a hotel registration, a medical provider — that copy is held under that supplier's own policy and its own retention rules, and deleting our copy does not delete theirs.

Your rights

If you are in the UK or the EU, you have the right to access your information, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. You also have the right to complain to a supervisory authority — in the UK that is the Information Commissioner's Office, ico.org.uk.

If you are a California resident, you have the right to know what we collect and why, to request a copy, to request correction, to request deletion, to opt out of sale or sharing, and to limit our use of sensitive personal information. We will not discriminate against you for exercising any of these rights.

To exercise any right, email info@wanderrock.com. We will verify who you are before we act, and we will respond within 45 days. You may use an authorized agent.

Cookies

A cookie is a small file placed on your device that lets a website recognize you between visits.

We use necessary cookies, which make the site work and cannot be switched off. We use analytics cookies through Google Analytics to understand which pages are useful. We use advertising cookies through Google and Meta to measure our advertising and show you relevant ads.

You can block or delete cookies in your browser settings. Blocking necessary cookies may stop parts of the site working. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout, and manage Meta ad preferences in your Facebook or Instagram account settings.

How we protect your information

We use encryption in transit, access controls that limit who inside the company can see what, and vetted service providers under written data processing terms. Health information is restricted to the staff who need it to run your trip.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your rights we will notify you and the relevant regulator as the law requires.

Children

Our trips are for adults aged 18 and over. We do not knowingly collect information from anyone under 16. If you believe we hold information about a child, email us and we will delete it.

Automated decision-making

We do not make decisions about you by automated means. Every application is reviewed by a person.

Changes to this policy

We may update this policy. If a change materially affects your rights we will tell you by email as well as updating this page. The date at the top always shows when it last changed.

Contact and complaints

Email info@wanderrock.com or write to WanderRock LLC, 2443 Fillmore St. #380-2362, San Francisco, CA 94115.

If you are not satisfied with our response, UK and EU residents may complain to the Information Commissioner's Office or their local supervisory authority. California residents may complain to the California Privacy Protection Agency or the California Attorney General.