Version: 2026-10-12.2 · Notice for the enquiry form.
Who is the data controller?
Henrik Le-Botos, a UK-based sole trader operating as Beyond My World. For privacy requests and contact: kischan1988@gmail.com.
What data do we process, and why?
We process your name, email address, phone number, chosen trip, party size, answers about travel experience and expectations, and optional comments. We store the submission time, identifier, discussion status and the version of the notice you acknowledged.
The purposes are to contact you as requested, discuss the trip and your participation requirements, and prepare an agreement. The legal basis is taking pre-contractual steps at your request, under GDPR / UK GDPR Article 6(1)(b). We cannot process an application without the required fields; other answers are optional.
Do not enter medical diagnoses, passport details, card details or detailed information about another person. Any later processing of health data requires separate information. For children, we ask only for a headcount here.
Who can access the data, and where is it stored?
The organiser accesses answers through a protected admin area. Hosting and the database are provided through ChatGPT Sites by OpenAI and its infrastructure providers, including Cloudflare. OpenAI acts as a processor for operating the site.
Processing may take place outside the United Kingdom and EEA, including in the United States. There is no guarantee of exclusively British or European storage. The applicable Sites Data Processing Addendum requires an adequacy decision or standard contractual clauses for European data, and standard contractual clauses with the UK Addendum for UK data. The provider list is available here.
We do not sell application answers or use them for automated AI suitability scoring. Before an agreement, you will receive separate information about any necessary later sharing with local service providers.
Email notifications
Once email delivery is connected, we send an acknowledgement to you and a notification to the organiser from kischan1988@gmail.com. These messages support your enquiry and are not newsletters. Google Gmail and Apps Script process the recipient’s email address, name, trip information and message text. We do not email the full set of form answers. The delivery log is retained as part of the application record. Data may be transferred to the United States; Google’s processing terms and transfer safeguards are described in the Google Privacy Policy and the information on data transfer frameworks . No emails are sent until the service is connected.
Retention
We process application data for as long as needed to discuss and prepare the trip. An enquiry that does not become a booking is considered for deletion once discussions have ended and the data is no longer needed to resolve legal claims. Contractual, invoicing and legal records arising from an agreement follow separate retention rules; this form does not collect payment details.
Your rights and contact
Under the applicable law and legal basis, you may request a copy, correction or deletion of your data, restriction of processing and a portable copy. Statutory obligations or legal claims may limit deletion. Send requests to the email address above; we may need to verify your identity.
You may complain to the UK Information Commissioner’s Office, or, under the applicable law, the data protection authority where you live; in Hungary, the NAIH.
Newsletters, sign-in and technical data
Submitting does not subscribe you to a newsletter. We do not use your contact details to advertise later trips without separate consent. The application has no advertising trackers. Aggregate analytics operate as described below. The hosting provider may process technical data, such as IP addresses and logs, for operation and security.
The application form requires no sign-in. The organiser’s admin area uses ChatGPT sign-in. The provider then shares a user identifier, email address and optional name to verify access. The application does not use these to create a separate traveller profile. OpenAI describes processing for its own services and sign-in in the OpenAI Privacy Policy .
Aggregate website analytics
To improve the site’s operation and content, we aggregate daily page views, source categories (such as Facebook or search), internal and application-link clicks, 50/90% scroll milestones and 30/120-second active-reading milestones. We also count trip cards becoming at least half visible, starting a form, submission attempts, browser validation signals and successful server-side saving of new applications. No field values enter these counters. The admin area also shows period totals for saved applications.
BMW’s analytics database contains no visitor identifiers, IP addresses, device fingerprints, full referrer URLs, identifiers embedded in URLs, form answers or personal event logs. We increment aggregate counters directly. We do not connect anyone’s browsing with their application or share analytics with advertising platforms. Source classification does not prove that a visit came from a paid advertisement. Tagged paid links have a separate category. Between our own pages, only this fixed source category is passed in the bmw_src parameter, never a personal or visitor identifier.
Detailed aggregates are retained for up to 90 days; historical daily landing-page and form-view totals continue to be retained. The hosting provider may independently process technical network data for operation. The organiser’s own visits, reloads and bot traffic may also be counted.
Analytics do not use an identifying cookie or browser storage. You can disable them for this website at any time using the “Analytics privacy” footer link. Only your opt-out is remembered in a one-year preference cookie containing no identifier. We also respect Global Privacy Control and Do Not Track signals. Contact and application data are processed separately.