Privacy Policy

Last updated: 22 May 2026

1. Who We Are

Wizarding Edinburgh is a trading name of Magical Edinburgh Ltd (company number SC888897), the data controller for personal data collected through this website and our booking process. We are registered and based in Edinburgh, Scotland, United Kingdom.

Contact: info@magicaledinburgh.com · +44 7517 841617

2. What Data We Collect and Why

We collect only the information needed to handle your booking or enquiry:

• Name and email address — to send you booking confirmations and pre-tour information.
• Phone number — for WhatsApp or phone contact if you selected that preference, or in case of last-minute tour changes.
• Preferred tour date and tour type — to reserve your place and organise departure groups.
• Group size and special requirements — to prepare an appropriate experience and ensure any accessibility needs are met.
• Payment details — for pre-paid tours, payment is processed securely by Stripe. We never see or store your card details. Stripe's privacy policy applies to the checkout process: stripe.com/gb/privacy.

We do not collect data for marketing purposes and we do not send unsolicited emails beyond those directly related to your booking.

3. Legal Basis for Processing

• Contract performance — processing your booking and communicating about it (Article 6(1)(b) UK GDPR).
• Legitimate interests — keeping basic records of completed tours for accounting and operational purposes (Article 6(1)(f) UK GDPR).

4. How Long We Keep Your Data

Booking records are retained for 3 years from the date of the tour, in line with standard accounting and dispute-resolution requirements. Enquiries that did not result in a booking are deleted within 12 months.

5. Who We Share Your Data With

We do not sell or rent your personal data. Data may be shared with the following sub-processors, each acting on our instructions:

• Stripe Inc. — payment processing for pre-paid bookings.
• Google (Gmail / Google Workspace) — used as the SMTP relay to deliver booking confirmations, pre-tour information and review-request emails. Google processes the recipient address and the email body as a data processor on our behalf. Google's privacy notice: policies.google.com/privacy.
• IONOS (1&1 IONOS SE) — our web hosting provider. The site files and the database that stores bookings and enquiries live on IONOS servers located in the European Union. IONOS acts as a data processor on our behalf. IONOS privacy notice: ionos.co.uk/terms-gtc/terms-privacy.
• Freelance guides — first name, tour date and group size only, to coordinate departures. No contact details are shared with guides.

No data is transferred outside the UK/EEA except to Stripe and Google, both of which operate under standard contractual clauses and are certified under the UK International Data Transfer Agreement framework.

6. Cookies and Local Storage

This website uses a small number of strictly necessary and functional cookies — never for advertising, cross-site tracking, or profiling:

• wizlang — remembers your language choice (English or Spanish) so the bilingual site loads correctly on every page. Functional / preference.
• __Host-we_csrf — a per-session security token that protects the booking and contact forms against cross-site request forgery. Strictly necessary.
• we_no_analytics — set only if you opt out of our self-hosted analytics (see section 6a below), so our server can honour that choice on every page. Functional / preference.

Because every cookie above is strictly necessary or functional — none of them track you — they are exempt from the prior-consent requirement under the UK Privacy and Electronic Communications Regulations (PECR) and the UK GDPR. The brief “Got it” notice is shown for transparency, not as a consent gate.

We also use your browser’s local storage — which stays on your device and is never sent to our server — to remember your language choice (we_lang) and whether you have dismissed the cookie notice (we_cookie_consent). Like the cookies above, this is purely functional: no tracking, no identifiers.

We use no third-party analytics tools, no advertising trackers, and no third-party pixels on this website. When you proceed to Stripe Checkout you are redirected to Stripe's domain, where Stripe's own cookie policy applies.

6a. Analytics

We measure visits to this website using our own self-hosted analytics system. No third-party services (Google Analytics, Plausible, Fathom, etc.) are involved. No cookies are set. No personal data leaves our servers.

For each page request we record: the page path, the page you arrived from (when your browser supplies one — query strings are stripped), your language preference, a category of device (mobile, tablet, desktop, bot), and a daily-rotating one-way hash derived from your IP address and browser type. The hash exists so we can count unique visits per day; it cannot be reversed to identify you, and it changes every 24 hours so visits cannot be correlated across days.

If your browser sends the Do Not Track header, we log the page visit anonymously without computing any visitor hash.

Optionally, a small script measures roughly how long pages stay open in your browser and logs events such as "tour modal opened" so we can improve the site. This script uses no cookies and stores no identifier. Disabling JavaScript or enabling a privacy extension blocks it without affecting the rest of the site.

Raw analytics records are kept for 90 days then deleted. Daily aggregate counts are kept indefinitely.

We also derive an approximate country code from your IP address using a locally-hosted MaxMind GeoLite2 database. The lookup happens entirely on our server with no external API call. Your IP is briefly read in memory to perform the lookup and is then discarded — only the two-letter country code is stored against the visit record. This data is aggregated for geographic statistics and cannot be used to identify you. GeoLite2 data is provided by MaxMind under their licensing terms (https://www.maxmind.com/en/end-user-license-agreement).

If you opt out using the button below, we store a single functional cookie (we_no_analytics) in your browser so our server can honour your choice on every page you visit — it is what stops the measurement described above. It holds no identifier, is used for nothing else, and is removed if you opt back in or clear your cookies.

Turn off analytics

7. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal retention obligations).
• Portability — receive your data in a structured, commonly used format.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to restrict processing in certain circumstances.

To exercise any of these rights, email us at info@magicaledinburgh.com with the subject line Data Request. We will respond within 30 days.

8. Right to Complain

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.

9. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the site after a change constitutes acceptance of the updated policy.