Privacy Notice
What personal data 100 Crosses Ltd collects, why we collect it, our lawful bases, how long we keep it and the rights you have.
1. Who we are
100 Crosses Ltd is the data controller for the personal data described in this notice. Data protection queries should be sent to [email protected], marked Data protection.
2. What we collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, job title, organisation, email address, telephone number, preferred contact method. |
| Enquiry data | The description of your Cross, service required, urgency, how you heard about us. |
| Travel data | Traveller names, dates of birth where a supplier requires them, passport and visa details where you provide them for a booking, itinerary and booking references. |
| Commercial and transaction data | Product requirements, specifications, quantities, delivery locations, quotations, contracts, invoices and payment records. |
| Due-diligence data | Corporate identity information, beneficial ownership, details of directors and authorised representatives, authority to contract, sanctions screening results, source of funds information, licences and registrations held by suppliers and customers. |
| Technical data | IP address, browser type and version, and analytics data where cookies are accepted. |
| Marketing data | Newsletter subscription status and consent records. |
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and assessing whether we can assist | Legitimate interests; steps prior to entering a contract |
| Delivering the services you engage us for | Performance of a contract |
| Making bookings and coordinating with suppliers on your behalf | Performance of a contract |
| Counterparty and due-diligence checks, including sanctions screening | Legal obligation; legitimate interests in preventing financial crime and unlawful supply |
| Invoicing, accounting and record keeping | Legal obligation |
| Handling complaints and defending legal claims | Legitimate interests; legal obligation |
| Website analytics | Consent, via the cookie banner |
4. Special category data
We do not routinely collect special category data. Where a travel supplier requires health, accessibility or dietary information, we collect and pass it on only with your explicit consent and only for that purpose.
5. Who we share it with
- Suppliers and providers engaged to deliver your Cross — airlines, hotels, tour operators, transfer companies, visa application centres, software vendors, inspection and testing providers, transport and logistics operators, customs agents and product suppliers.
- Professional advisers — accountants, insurers, solicitors, where necessary.
- Service providers — IT, hosting, email and communications providers acting as processors under contract.
- Authorities and regulators where we are required by law to disclose, including in connection with customs, excise, sanctions and financial-crime obligations.
We do not sell personal data and we do not share it with third parties for their own marketing.
6. International transfers
Delivering travel and petroleum services often requires transferring data outside the United Kingdom. Where we do so, we rely on UK adequacy regulations or, where none applies, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required.
7. How long we keep it
| Record | Retention |
|---|---|
| Enquiries that do not become a Cross | 12 months from last contact |
| Client and engagement records | 6 years from closure of the Cross |
| Accounting and tax records | 6 years from the end of the relevant accounting period |
| Due-diligence and sanctions screening records | Minimum 5 years from the end of the business relationship or the transaction |
8. Your rights
Subject to the conditions in applicable data protection law, you have the right to be informed; to access your data; to rectification; to erasure; to restrict processing; to data portability; to object to processing based on legitimate interests; and to withdraw consent at any time where processing is based on consent.
To exercise a right, email [email protected]. We will respond within one month, and will tell you if we need to extend that period.
Some rights are limited where we are legally required to retain records — for example due-diligence and sanctions screening records, which cannot be erased on request during their statutory retention period.
9. Cookies and analytics
See the Cookie Policy for what we set, why, and how to change your choices.
10. Security
We apply technical and organisational measures appropriate to the risk, including access controls, encryption in transit, and need-to-know handling of client and counterparty information.
Web forms and ordinary email are not secure channels. Please do not send identity documents, banking details or proof of funds through them; we will provide an approved secure channel once your Cross is open.
11. Complaints to the regulator
If you are unhappy with how we have handled your personal data you may complain to the Information Commissioner’s Office (ico.org.uk). We would ask you to raise it with us first so we have the chance to put it right.
12. Changes to this notice
We may update this notice. The version number and effective date at the top of this page indicate the current version.