Privacy Policy

Oshi Okomilo, trading as Paradise Beyond, is the data controller for the personal data described here. We are a sole trader established in the United Kingdom, at 34 Lynton Road, London, NW6 6BL, United Kingdom.

For anything about your data — a copy of it, a correction, a deletion — email paradisebeyond@guestlist.net. That address reaches us directly and is the fastest route.

We handle personal data under the UK GDPR and the Data Protection Act 2018. Where we serve guests and hosts in the EU, the EU GDPR applies to that processing too.

• To take and run your booking — confirmations, balance reminders, trip information, passing what the host needs to run your retreat. Basis: performance of our contract with you.
• To run your account — signing in, resetting a password, showing your trips and saved experiences. Basis: performance of our contract.
• To take payment and pay hosts — including our commission split and refunds. Basis: performance of our contract, and legal obligation for records.
• To review and verify hosts — assessing applications, checking insurance and permits, keeping guests safe. Basis: legitimate interests in a safe, curated marketplace.
• To improve the site and prevent abuse — diagnostics, security logs, fraud prevention. Basis: legitimate interests.
• To publish your review alongside the experience. Basis: legitimate interests, and consent for any photo you attach.
• To send marketing — occasional emails about new experiences. Basis: consent, or the soft opt-in for existing customers. Every one has an unsubscribe link.
• To meet legal and tax obligations — keeping transaction records. Basis: legal obligation.

Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object at any time (section 8).

Our lawful basis is your explicit consent. You give it by ticking a box next to those two questions, and we record when you gave it. The box is never pre-ticked, and if you leave it unticked we do not store the answers at all — you can still complete the rest of the questionnaire.

You do not have to give this information, but a host cannot cater for a need they do not know about. To withdraw, untick the box on your trip page — that clears your dietary and medical answers straight away. To have them deleted at any other time, or to ask what we hold, email paradisebeyond@guestlist.net.

We also clear these two answers by ourselves once your trip has ended, without waiting for you to ask. Keeping them past the trip serves no purpose, so we don’t. The rest of your questionnaire — experience level, emergency contact, notes — stays with your booking record.

We share these details only with the host running your retreat, and with emergency services or medical staff if your safety requires it.

We never sell your personal data. We share it only in these cases:

We will also disclose data where the law requires it, to establish or defend legal claims, or to protect someone’s safety. If the business is ever sold or transferred, data moves with it, and we will tell you first.

Some of our providers process data outside the UK, including in the United States, and your host is likely to be in your destination country — Tanzania, for our Zanzibar retreats. Where data leaves the UK we rely on UK adequacy regulations where they exist, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed.

• Booking and payment records: 7 years after the trip, to meet UK tax and accounting rules.
• Account data: while your account is open, then 12 months after you close it.
• Trip questionnaires — health and dietary answers: cleared once your trip has ended, automatically, because the reason we held them has passed. You can also remove them sooner by unticking the consent box on your trip page, or ask us to delete them at any time.
• Trip questionnaires — the rest (experience level, emergency contact, notes): kept with your booking record, and deleted on request.
• Messages between you and your host: 3 years after the trip, so we can resolve disputes.
• Reviews and trip memories: published until you ask us to remove them.
• Host applications that are not approved: 12 months, then deleted.
• Server and security logs: up to 12 months.
• Marketing consent records: until you unsubscribe, plus 2 years as proof of consent.

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate or incomplete;
• delete your data, where we have no continuing reason to keep it;
• restrict how we use it while a concern is investigated;
• send your data to you, or another provider, in a portable format;
• stop processing based on legitimate interests, including profiling;
• stop sending marketing, at any time and without a reason; and
• withdraw a consent you gave — for health information, or for a photo — without affecting what we did lawfully before you withdrew it.

Email paradisebeyond@guestlist.net and we will respond within one month. We may ask you to confirm your identity first. There is no charge unless a request is clearly excessive.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would rather hear from you first, so we can put it right.

We keep this light. We do not run advertising cookies and we do not track you across other websites.

If we ever add analytics or marketing cookies, we will ask for your consent first and give you a way to change your mind.

The site runs over HTTPS. Passwords are hashed, never stored in readable form. Database access is restricted by row-level security so accounts only reach their own records, and admin areas require a verified staff role. Payment card details never touch our servers.

No system is perfect. If a breach ever puts your rights at risk, we will tell you and the ICO without undue delay.

Paradise Beyond is for adults. You must be 18 or over to hold an account or make a booking. Where a child travels as part of a booking, the adult who booked provides their details and is responsible for them. If you believe a child has given us data directly, email paradisebeyond@guestlist.net and we will delete it.

We update this policy when what we do with data changes. The date at the top shows the current version. If a change materially affects you, we will email you before it takes effect.

Oshi Okomilo, trading as Paradise Beyond
34 Lynton Road, London, NW6 6BL, United Kingdom
paradisebeyond@guestlist.net

For the terms that govern bookings, see our Terms & Conditions.