LEGAL

PRIVACY & COOKIE POLICY

Overland Discovery Expo Ltd, trading as ODX

Effective from: 23 October 2026

Next scheduled review: October 2028

Your privacy matters to us. This policy explains what personal information ODX collects, why we need it, how we keep it safe and the choices you have. It covers our website, buying tickets, attending the event, and our dealings with exhibitors, sponsors, speakers and partners. It also explains the rights UK data protection law gives you.

1. About us and this policy

What this policy covers

This policy explains how we handle personal information you give us when you:

visit overlanddiscoveryexpo.com
buy a ticket or join our mailing list
send us an enquiry about visiting, exhibiting, sponsoring or speaking
attend the Overland Discovery Expo, including camping and taking part in activities.

It also covers information we gather in the normal course of running the business, for example when we meet you at another show, speak to you on the phone or exchange emails.

From time to time we may give you a separate, more specific privacy notice for a particular purpose, such as a waiver for a driving activity. Please read it alongside this one. It adds to this policy rather than replacing it.

Who is responsible for your data

Overland Discovery Expo Ltd (“ODX”, “we”, “our” or “us”) is the data controller. That means we decide how and why your personal information is used, and we’re accountable for it.

How to reach us

Registered company name: Overland Discovery Expo Ltd
Company number: 16735814
Data protection contact: Jazz Wheelhouse
Email: hello@odx-uk.com
Post: Overland Discovery Expo Ltd, 22 The Haven, Leeds, LS15 7AT

If you’re unhappy

You can complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at any time at ico.org.uk. We’d welcome the chance to put things right first, though, so please contact us before going to the ICO.

Updates to this policy

We review this policy at least every two years, and sooner if the law or our practices change. The date at the top shows when it was last updated.

Please help us keep your details accurate. If anything changes, such as your email address or phone number, just let us know.

Links to other websites

Our website links to other sites, including our ticketing partner. Those sites may gather information about you. We don’t control them and aren’t responsible for how they handle your data, so it’s worth checking their own privacy notices.

2. The information we hold about you

“Personal data” is any information that can identify you as an individual. Information stripped of anything identifying (anonymised data) doesn’t count.

Depending on how you deal with us, we may collect, store and use:

Identity details: your name, and the name of the business you represent.
Contact details: your email address, phone number and postal address.
Ticket and booking details: the tickets you’ve bought, including any child or dog add-on tickets, the name of each adult ticket holder, name changes, check-in records and wristband or vehicle pass details.
Payment details: records of payments and refunds. Card details are handled by our payment provider, Stripe, and we never see or store your full card number.
Vehicle details: your vehicle registration, where needed for parking, camping or security.
Activity details: sessions you book, waivers you sign and, for driving on The Trail, the driving licence details our vehicle partner needs for insurance.
Event safety records: details of any accident, first aid treatment, lost child or incident on site.
Photos and film: images and footage of you taken at the event.
Business details: if you’re an exhibitor, sponsor, speaker, partner or supplier, your job title, business contact details and our correspondence with you.
Technical details: your IP address, browser, device and similar information about how you reach our website.
Usage details: how you use our website and emails.
Marketing preferences: whether you want to hear from us, and how.

Children

Our website and ticket sales are for adults. Child tickets are bought as an add-on to an adult’s booking, and we don’t collect children’s names or other personal details. If a child needs first aid or is involved in an incident on site, we’ll record only what’s needed to look after them.

Sensitive information

We don’t ask for “special category” data, such as health, race, religion or sexual orientation, as part of buying a ticket. We will only hold health information if:

you tell us about access needs so we can help plan your visit, or
you need first aid or are involved in an incident on site, and we need to record what happened.

We treat this information with extra care, keep it only as long as we need to, and only share it where needed for your care, safety or a legal claim.

Combined and statistical data

We also use combined figures, such as how many visitors came from each region or how many people looked at a page. These may come from personal data but can’t identify you, so they aren’t personal data in law. If we ever link them back to you, we treat the result as personal data under this policy.

If you choose not to give us information

Some details are needed to sell you a ticket or let you take part in an activity. If you don’t provide them, we may not be able to complete your booking or let you take part, and we’ll tell you at the time.

3. How we get your information

What you tell us directly: when you buy tickets, fill in a form on our website, join our mailing list, email or phone us, check in at the event, sign a waiver, or talk to us at a show.
Automatically, when you use our website or emails: we collect technical and usage details using cookies, pixels and similar tools. Section 8 explains these.
From third parties and public sources: our ticketing and payment providers, analytics providers and social media platforms. For exhibitors, sponsors and partners, we may also use business contact data from public sources such as company websites, LinkedIn and Companies House, and from business data providers.

4. How and why we use your information

Our legal grounds

We only use your personal data where the law gives us a valid reason. Usually that’s one of these:

Contract: we need it to sell you a ticket and run the event you’ve booked, or to carry out an agreement with you as an exhibitor, sponsor or supplier.
Legitimate interests: it’s needed for our genuine business interests, such as keeping the site safe, promoting ODX or contacting businesses about exhibiting, and your rights don’t outweigh them.
Legal obligation: we need it to meet a legal, tax, health and safety or regulatory requirement.
Vital interests: in an emergency, to protect someone’s life or health.
Consent: for example, for marketing emails and non-essential cookies. You can withdraw consent at any time.

What we use it for

We may use your personal data to:

process your ticket order, take payment, issue tickets and handle name changes and refunds
tell you about your booking and anything that changes, including arrival information and any cancellation
check you in, run the campsite and manage activity bookings
pass the details our vehicle partner needs to check you’re insured to drive on The Trail
keep everyone safe on site, including looking after lost children, giving first aid and recording incidents
handle enquiries and agreements with exhibitors, sponsors, speakers, partners and suppliers
respond to messages on our website and social channels
run competitions, giveaways and surveys you take part in
run and protect our website, including troubleshooting, analysis, testing and hosting
promote ODX using photos and film from the event
show you relevant content and adverts, and measure how well our advertising works
improve the event, our website and our marketing.

Photos and filming at the event

ODX is filmed and photographed, and we use the footage to promote future events. We rely on our legitimate interests to do this. If you’d rather not appear, tell the photographer or our team on the day, or contact us afterwards and we’ll stop using an image of you where we reasonably can. We’ll ask a parent or guardian before featuring a child prominently.

Marketing: your choices

We’ll only send you marketing emails if you’ve signed up to hear from us. Founders Circle tickets need a mailing list sign-up, but you can unsubscribe afterwards and it won’t affect your ticket.

We will never sell your details, or pass them to another company for its own marketing, unless you’ve clearly opted in first. We won’t share attendee details with exhibitors or sponsors without your consent.

You can unsubscribe at any time using the link in any email, or by contacting us. Once you’ve opted out, we keep a minimal record of your email address so we don’t contact you again.

If you’re a business we’d like to work with, we may contact you about exhibiting, sponsoring or speaking. You can tell us to stop at any time.

Using your data for a new purpose

We only use your personal data for the reason we collected it, or for a reason that fits with it. If we need to use it for an unrelated purpose, we’ll tell you first and explain the legal basis for doing so.

5. Who we share your information with

We may share your personal data with the following, for the purposes in section 4:

Ticketing and payments: Ticket Tailor, which runs our ticket sales, and Stripe, which processes payments.
IT and systems providers: our website host, email, file storage, customer relationship management and accounting systems.
Email marketing and survey tools, to send newsletters and ask for feedback.
Social media platforms, for our pages, adverts and pixels.
Event partners and contractors: our vehicle partner for The Trail, activity and training partners, security, stewarding, medical and first aid providers, only as much as they need to do their job on site.
The Glanusk Estate, where needed to report an incident on its land.
Professional advisers, such as solicitors, accountants, insurers and banks.
Emergency services, police, HM Revenue & Customs and other authorities, where we have to, or where it’s needed to protect someone.
A buyer or new owner of our business. If we sell, transfer or merge any part of our business, the new owner may use your personal data in the way this policy describes.

Everyone we work with must keep your personal data secure and handle it lawfully. Our service providers can only use it for the purposes we set and on our instructions, not for their own purposes.

Sending data outside the UK

Some of our providers are based outside the UK, so your personal data may be transferred overseas. When that happens, we make sure it gets a similar level of protection by using at least one of these safeguards:

transferring it only to countries the UK Government has confirmed give an adequate level of protection
using contracts approved for UK data transfers, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
for US-based providers, relying on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), where the provider is certified under it.

6. Keeping your information safe, and for how long

Security

We have suitable measures in place to stop your personal data being lost, misused, accessed without permission, changed or disclosed. Access is limited to people who need it for their work, who must keep it confidential and only use it on our instructions.

We have a process for dealing with any suspected data breach. Where the law requires, we’ll tell you and the ICO.

How long we keep it

We keep personal data only as long as we need it for the reasons we collected it, including legal, tax and accounting requirements. As a guide:

Ticket orders, payments and refunds: 6 years from the end of the financial year they relate to
Accident, first aid and incident records, and activity waivers: 3 years after the event, or for a child, until they turn 21
Access needs: Until after the event, unless you ask us to keep them for future events
Mailing list details: Until you unsubscribe
Exhibitor, sponsor and partner contacts: While we’re working together or might reasonably do so, unless you ask us to stop
Photos and film from the event: Kept in our archive and may be used in future promotion, subject to your right to object

7. Your rights

Under UK data protection law, you can:

See your data: ask for a copy of the personal data we hold about you (a “subject access request”).
Have it corrected: ask us to fix anything that’s wrong or incomplete.
Have it deleted: ask us to erase your personal data where there’s no good reason for us to keep it. There may be legal reasons we can’t delete some information, and we’ll explain if so.
Object: to us using your data where we rely on legitimate interests, including photos used to promote ODX. You can always object to direct marketing.
Restrict how we use it: ask us to pause using your data while we check it’s accurate, or while we consider an objection, or where you need it kept for a legal claim.
Take it elsewhere: ask us to send data you gave us to you, or to someone else, in a commonly used format.
Withdraw consent: where we rely on your consent, you can withdraw it at any time. This doesn’t affect anything we did before.

To use any of these rights, contact us using the details in section 1. There’s normally no charge. We may ask you to confirm who you are first, and we aim to reply within one month. If your request is complex, it may take longer, and we’ll keep you updated.

8. Cookies

What cookies are

A cookie is a small text file saved in your browser or on your device when you visit a website. Apart from strictly necessary cookies, we only set cookies once you’ve agreed through our cookie banner. You can change your choices at any time.

The cookies we use

Strictly necessary: essential for the website to work, such as keeping it secure and remembering your cookie choices.
Analytics and performance: these count visitors and show us how people use the site, so we can improve it.
Functionality: these remember your settings when you come back.
Targeting and advertising: these record which pages you visit, so we can show you relevant adverts and measure how they perform.

Third-party cookies and pixels

Some third parties, such as our ticketing provider, analytics providers and advertising networks, may set their own cookies. We may also use pixels from social media platforms such as Facebook and Instagram to measure our adverts and show you more relevant ones.

Managing cookies

You can set your browser to refuse some or all cookies, or to delete them when you close it. If you block strictly necessary cookies, parts of our website, including ticket buying, may not work.

9. Key terms explained

Legitimate interests: our interest in running and promoting ODX and keeping people safe. Before relying on this, we weigh up the effect on you and your rights. We won’t use your data where our interests are outweighed by the impact on you. Contact us if you’d like to know how we’ve balanced this for a particular activity.

Performing a contract: using your data where it’s needed to carry out a contract you’re part of, such as your ticket, or to take steps you’ve asked for before entering into one.

Legal obligation: using your data where it’s needed to meet a legal or regulatory duty.

Vital interests: using your data where it’s needed to protect someone’s life or health, for example in a medical emergency.