Throughout your time at SORCE it is necessary for us to obtain, process and retain legitimate personal information about you. We, our representatives, or appropriate third parties, may need such information. Normally this is to fulfil contractual provisions such as providing accommodation for your booking or meeting dietary or medical requirements. We must also use it to fulfil legal obligations such as submitting our accounts or ensuring you have the correct visa.
Less frequently, we may have an additional, legitimate interest in collecting and processing such data. This could be to measure the ethnic diversity of our customerbase, age ranges, gender equality etc. We will anonymise such information where possible. No decision that affects you personally is made relying solely on automated processing of such information. Decisions that affect you personally are always made by appropriate managerial input.
We are accountable for the personal data we collect and will:
- Process it lawfully, fairly and in a transparent manner;
- Collect it only for specified, explicit and legitimate purposes;
- Confirm it is adequate, relevant and limited to what is necessary for the purpose;
- Ensure it is accurate and, where necessary, up to date;
- Keep it in a format which identifies data subjects for no longer than necessary;
- Process it in a manner that ensures appropriate security.
When you join us we establish a personnel file for you. This contains relevant personal details. Typically, it will contain your booking information, medical forms and payment records. It may also contain induction details, personal contact information and the identity of your next of kin. We inevitably add relevant information during the course of your time with us. This could be training records, medical incidents, project work etc.
We and/or our representatives retain such personal data and other relevant information on HR systems. Such data may be collected, processed and retained securely in paper form or electronically. We only collect and process the minimum amount of personal information necessary to fulfil each specific purpose.
Privacy considerations are uppermost in the design and operation of our HR systems. We retain all information confidentially with strictly restricted access and only for as long as necessary. It is securely destroyed or erased when its use has been fulfilled.
Services we use to run this website. Payments are processed by Stripe; we never see or store your card details. Messages sent through our website forms are delivered to us by Web3Forms. When you send a form, it includes your answer to where you first heard about SORCE and an enquiry reference number. If you have agreed to let our website remember how you found us, it also includes that record: the links or websites that brought you to us, and when. Our Cookies Policy explains what is recorded and how to change your mind. We use this information, which is linked to your enquiry once you send it, to understand how people find us and to check referrals from partners we pay commission to; we rely on our legitimate interest in doing both accurately. When we pay a partner for a booking, we share with them only the details they need to confirm it. Enquiries sent through our website are also saved in a secure enquiry system, hosted by Cloudflare, that only our directors can open. We keep enquiry records, including this referral information, for six years after the enquiry or, for a booking, six years after the expedition ends. This lets us recognise people who come back to us, settle any question about a referral or a past booking, and keep our financial records. The website is hosted by Cloudflare, which also counts visits anonymously without cookies. The map on our Field Sites page is provided by Google and only loads if you choose to open it. The approximate rupiah prices on our expedition pages use a daily exchange rate from Frankfurter, which receives nothing from you beyond the request itself. Each provider handles your information under its own privacy policy and only to provide that service to us.
We appreciate that an inadvertent breach of security may lead to destruction, loss, alteration, unauthorised disclosure or access of personal data. In the event of a significant breach to your personal data (e.g. by hacking) we will advise you directly. A significant breach is typified as one that would potentially have detriment to your rights or freedoms. In such circumstances we will advise you of the breach as promptly as possible. We may also have to inform the appropriate supervisory authority.
You have the right to seek access to personal information we hold about you without charge. You should set out in writing the specific information you want and pass the request to one of the company Directors.
We will respond within one month. This period can be extended by up to two months where requests are complex or numerous. We can refuse manifestly unfounded or excessive requests; particularly those which are clearly repetitive. Alternately, we may charge reasonable fees reflecting our administrative costs in facilitating their provision. We may also charge for further copies of the same information, previously supplied.
If you believe information we hold is incorrect or no longer retained for a relevant purpose, please advise us immediately. You may ask us to erase personal data you believe no longer fulfils an appropriate purpose.
We will advise you if we believe there is still a legitimate interest in maintaining such data. Where we do not propose to take any action regarding your request, we will tell you why. You may then be able to raise your concern with the appropriate supervisory authority. In the UK this is normally the Office of the Information Commissioner.
Where we rectify incorrect or incomplete information we will also advise any relevant third parties (e.g. HMRC).
If you wish to view a copy of our full Privacy Policy please request this in writing (via email) from enquiries@sorce.org.
Registered in England and Wales: 11363501. Version 2.0. Last reviewed 12 November 2026.