Privacy Policy

Version 1.2 — updated 18 October 2026 (first published 9 September 2026)

FINDYOURDREAMSPACE LTD (company number 17024024, registered office 167-169 Great Portland Street, London, England, W1W 5PF) ("FYDS", "we") is the controller of personal data processed on findyourdream.space. Contact us about privacy at privacy@findyourdream.space.

This policy explains what we collect, why, who we share it with, and your rights. It applies to participants, organisers and visitors. Cookies are covered in the Cookie Policy.

1. What we collect

Account data: name, email, password, language, country; for organisers, business name, company details and the onboarding declarations described in the Organiser Terms.

Booking and enquiry data: the experiences you enquire about or book, dates, amounts, booking status, cancellations and refunds.

Messages: communications sent through the Platform between participants and organisers, and with FYDS support.

Reviews and content you publish.

Payment data (once Platform payments launch): handled by Stripe, our payment processor — we receive booking amounts, payout status and the last digits/brand of your card, never full card numbers.

Technical data: IP address, device and browser information, and usage data, as described in the Cookie Policy.

Questions you type in your own words: if you describe what you are looking for in the search on our homepage, we keep that question, the date and, if you are signed in, your account, so that we can answer it and improve search.

Organisers we contact: before someone joins as an organiser, we may collect their name, business name, business email address and website from public sources — their own website and public social media profiles — to invite them to list their experiences on FYDS.

What we ask you not to send us: health, dietary and accessibility information belongs directly with your organiser, through the contact route they provide — not in Platform messages or reviews. We do not want this data and do not knowingly process it; if you include it in a message, you do so at your own choice.

2. Why we use it, and the legal basis

Running the Platform — accounts, listings, enquiries, bookings, messages, reviews: performance of our contract with you.

Passing your details to the organiser you book with (section 3): performance of your contract.

Payments and refunds (when enabled): performance of contract and legal obligation (financial records).

Safety, fraud prevention and enforcing our Terms, including reviewing messages where we have reason to (for example, reports of abuse or fraud): legitimate interests in a safe, honest marketplace.

Service emails (booking confirmations, changes to terms): performance of contract.

Marketing emails: consent, or the "soft opt-in" for our own similar services where you've booked with us — every email has an unsubscribe link.

Legal compliance and defending claims: legal obligation and legitimate interests.

Analytics through Google Analytics: your consent, given through our cookie notice — you can withdraw it at any time through "Cookie settings". Our own visit statistics (section 3): legitimate interests in understanding how the Platform is used and keeping it secure.

Answering questions typed in your own words: legitimate interests in helping you find a suitable experience.

Filling in the event form from an organiser's own text, and translating event descriptions: performance of our contract with the organiser.

Inviting organisers we have found through public sources: legitimate interests in growing the marketplace. You can ask us to stop at any time; we then keep only a record not to contact you again.

We do not sell personal data, and we do not use it for automated decisions with legal effects.

3. Who we share it with

Organisers. When you enquire about or book an experience, we give the organiser your name, contact details and booking information — they need it to respond to you and deliver the experience. The organiser is then an independent controller of that data: their use of it is governed by their own privacy practices and the limits in our Organiser Terms (delivery of your experience only; no marketing to you without your separate consent given to them).

Service providers (processors) acting on our instructions: platform hosting and software (Hetzner — server infrastructure; TAMARANGA — platform software provider, with server access granted for support and maintenance), email delivery (Google Workspace), maps (Google Maps — loaded only when you open a map, at which point Google receives your IP address), analytics (Google Analytics, provided by Google Ireland Limited and Google LLC — used only if you accept analytics cookies, with Google's advertising features switched off. We also keep our own visit statistics on our server: they use no cookies, store your IP address only in scrambled (hashed) form, and are not shared with anyone), AI services (Anthropic — its Claude model reads the questions typed into our homepage search, the text an organiser pastes to fill in the event form, and the event descriptions we translate; under its commercial terms Anthropic does not use this data to train its models), our organiser records (Notion — where we keep notes on organisers we work with or contact), customer support (handled directly through the Platform — no separate third-party support tool at present), and — once payments launch — Stripe for payment processing (Stripe also acts as an independent controller for its own regulatory obligations).

Authorities and advisers where the law requires or to establish, exercise or defend legal claims.

A buyer or successor if our business is sold or reorganised, with notice to you.

4. International transfers

FYDS operates internationally, and organisers may be located outside the UK and EEA. Where personal data leaves the UK/EEA — to an organiser abroad or a service provider — we rely on UK adequacy regulations or appropriate safeguards (the UK International Data Transfer Agreement or EU Standard Contractual Clauses, as applicable). Ask us at privacy@findyourdream.space for details of the safeguard applying to a specific transfer. Google LLC, which processes Google Analytics data, is in the United States; those transfers rely on the UK Extension to the EU–US Data Privacy Framework, under which Google LLC is certified. Anthropic, PBC and Notion Labs, Inc. are also in the United States; those transfers rely on the safeguards in their data processing terms (the EU Standard Contractual Clauses with the UK International Data Transfer Addendum).

5. How long we keep it

Account data: while your account is open, then up to 12 months.

Booking, enquiry, payment and refund records: 6 years from the booking (limitation periods and financial rules).

Messages: 2 years from sending, or longer where linked to a dispute.

Reviews: while the listing exists; anonymised on account deletion.

Analytics data in Google Analytics: 14 months, then deleted automatically.

Our own visit statistics: up to 18 months (records of automated traffic: 30 days).

Questions typed into homepage search: up to 18 months.

Records of organisers we have contacted: up to 2 years after our last contact if they do not join; if they ask us to stop, only a record not to contact them again.

Marketing preferences: until you withdraw consent, plus a suppression record so we don't contact you again.

6. Your rights

You can ask us to: access your data; correct it; delete it; restrict or object to processing (including objecting to marketing at any time, which we always honour); and receive a portable copy. Where processing is based on consent, you can withdraw it at any time.

Write to privacy@findyourdream.space — we respond within one month.

Complaints. If you are unhappy with how we handle your personal data, please complain to us first at privacy@findyourdream.space. We acknowledge every complaint within 30 days, look into it properly, keep you informed while we do, and tell you the outcome without undue delay. You also have the right to complain to the UK Information Commissioner (ico.org.uk) or, if you are in the EU, to your local data protection authority.

7. Security and children

We protect personal data with appropriate technical and organisational measures, including encryption in transit and access controls. FYDS is for adults: we do not knowingly collect data from anyone under 18, and we delete it if we learn we have.

8. Changes

We'll post updates here and, for significant changes, tell you by email or on the Platform before they take effect.

This policy is written in English. Where we publish a translation, it is for convenience; if the two differ, the English version applies.