Privacy Policy

Last updated: 19 April 2026

This Privacy Policy explains how Catnach Ltd ("MCH", "we", "us", "our") collects, uses, shares and protects personal data when you use motorcycleholiday.com (the "Site") or otherwise interact with us.

It should be read alongside our Cookie Policy and Terms and Conditions.

1. Who we are

Data controller: Catnach Ltd, a company registered in England and Wales (company number 15886326), trading as Motorcycle Holiday (MCH).

Privacy contact: ride@motorcycleholiday.com

If you are in the EEA and wish to raise a data protection matter, you may also write to us at the email address above. We will appoint an EU representative under Article 27 GDPR if and when required by the scale of our EU-facing activities.

2. Core principles

The core principles behind this policy are simple:

1. We only use your data to do what you came to MCH for — whether that's browsing tours, receiving our newsletter, making an enquiry, or (for operators) running your listings.
2. We never sell your personal data to third parties.
3. We may create anonymised or aggregated data (which no longer identifies you) and use it freely, for example to understand trends, improve the Site, report to partners, or train models.
4. We keep data only as long as we need it for the purpose it was collected, or as required by law.

3. Who this policy covers

This policy applies to:

• Riders — visitors and users of the Site, newsletter subscribers, and people who submit enquiries to operators through us
• Operators — tour providers and their staff with MCH accounts
• Others — suppliers, partners, applicants and anyone else who contacts us

4. Personal data we collect

4.1 Riders

We may collect:

• Technical and usage data — IP address, device and browser type, operating system, referring URL, pages viewed, clicks, session data and approximate location derived from IP
• Newsletter data — email address, name (if provided), preferences, engagement data (opens, clicks)
• Enquiry data — your name, email, phone number (if provided), the tour(s) you enquire about, and any message content you send
• Cookie and tracking data — see the [[0001 - Cookie Policy|Cookie Policy]]
• Correspondence — any messages you send us directly

We do not currently process payments from riders, so we do not collect payment card data.

4.2 Operators

We may collect:

• Account data — contact name, role, email, phone, password (hashed), login and account activity
• Business data — company name, registered address, trading address, company/tax number, business website, insurance details, licence details
• Listing content — tour descriptions, photos, videos, itineraries, pricing, availability, and other content you upload
• Correspondence and support data — messages exchanged with us
• Performance data — clickouts, enquiries, and other engagement metrics on your listings

If and when MCH begins processing bookings, we will update this policy and notify operators before collecting any payout or banking data.

4.3 Other categories

We collect basic contact and correspondence data for suppliers, partners, and anyone who contacts us.

5. How we collect personal data

• Directly from you — when you sign up, submit an enquiry, contact us, create an operator account, or upload listing content
• Automatically — through cookies, pixels, analytics and server logs when you use the Site
• From third parties — such as advertising platforms (e.g. Google, Meta), analytics providers, payment providers (in the future), and publicly available sources (for operator verification)

6. Why we use personal data and our legal bases

Under UK and EU GDPR we must have a legal basis for each use of your personal data. These are ours:

Where we rely on legitimate interests, we have carried out a balancing test and consider our interests not to override your rights. You can ask for details or object — see Section 11.

7. Sharing personal data

We share personal data only where necessary and always under appropriate safeguards:

• Operators — when you submit an enquiry about a tour, we forward the enquiry and your contact details to the relevant operator so they can respond. They then become an independent controller of that data.

• Service providers (processors) — hosting, email delivery, analytics, CRM, support, error tracking, cloud storage, advertising platforms, and similar providers acting on our instructions. Examples currently in use or likely to be used: Google (Ads, Analytics, Cloud, Workspace), Meta (Facebook, Instagram), Microsoft, LinkedIn, Mailchimp or similar email platform, Stripe (in the future, for payments), Vercel (hosting and cookieless web analytics — see below), CRM providers, AI/LLM providers for support tooling. This list is indicative and not exhaustive.

  Vercel Web Analytics is a cookieless analytics service we use to count page views and understand basic usage trends. It does not set cookies, does not collect personal identifiers, and does not track you across sites. Visitor IPs are hashed server-side by Vercel and discarded. Because no personal data is stored on your device, Vercel Web Analytics is treated as an always-on processor and is not gated by the cookie consent banner.

• Professional advisers — lawyers, accountants, auditors and insurers, where reasonably needed.

• Authorities — regulators, courts and law enforcement, where legally required.

• Business transfers — in the event of a merger, acquisition, reorganisation or sale of assets, data may be transferred to the acquirer under equivalent protections.

We do not sell your personal data to third parties, and we do not share personal data with third parties for their own independent marketing purposes without your consent.

8. International transfers

MCH is based in the UK and primarily operates in the UK and EU. Some of our service providers are based outside the UK/EEA (for example, in the United States). Where this happens, we rely on safeguards recognised under UK and EU GDPR, such as:

• Adequacy decisions (including the UK-US Data Bridge and EU-US Data Privacy Framework, where applicable)
• Standard Contractual Clauses (and the UK International Data Transfer Addendum)
• Other transfer mechanisms permitted by law

You can request details of the specific safeguards used for any given transfer by contacting us.

9. Retention

We keep personal data only as long as necessary:

• Browsing and analytics data — typically up to 26 months
• Cookie data — for the lifetime set out in the [[0001 - Cookie Policy|Cookie Policy]]
• Newsletter subscribers — until you unsubscribe, plus a short suppression record to honour your opt-out
• Enquiries — typically up to 24 months after the last interaction, unless a longer period is needed (e.g. to resolve a dispute)
• Operator accounts and records — for the duration of your account, plus up to 7 years after closure for tax, accounting and legal purposes
• Correspondence — up to 6 years, in line with the limitation period for contract claims in England and Wales

Where we anonymise data, we may retain the anonymised version indefinitely, as it is no longer personal data.

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, logging, secure hosting, and staff training. No system is completely secure — if we detect a breach that is likely to affect you, we will notify you and the relevant authorities as required by law.

11. Your rights

Under UK and EU GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") in certain circumstances
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests or direct marketing
• Portability of data you have provided to us
• Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
• Not be subject to decisions based solely on automated processing that significantly affect you (we do not currently carry out such processing)
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EU, your local data protection authority

To exercise any right, email ride@motorcycleholiday.com. We will respond within one month (extendable by two months for complex requests). We may ask you to verify your identity. These services are free unless your request is manifestly unfounded or excessive.

12. Marketing communications

• Rider newsletter — opt-in; you can unsubscribe via the link in every email or by emailing us.
• Operator communications — we may send platform updates, product news and marketing to operators based on our legitimate interests or our contractual relationship; opt-out is always available for non-essential marketing, but we may still need to send service and account messages.

13. Cookies and similar technologies

See our [[0001 - Cookie Policy|Cookie Policy]] for full detail.

14. Children

The Site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Third-party sites

The Site links to operator websites and other third-party sites. This policy does not apply to those sites. Once you click through, you are on someone else's domain and subject to their privacy practices.

16. Changes to this policy

We may update this policy from time to time. Material changes will be notified on the Site and, where appropriate, by email. The "Last updated" date at the top shows when it was most recently changed.

17. Contact

For any questions about this policy, or to exercise your rights:

Catnach Ltd Email: ride@motorcycleholiday.com Company number: 15886326