Privacy Policy

Who we are

Riding the Magic (https://ridingthemagic.uk) is operated and owned by Xiliant Ltd (trading as Riding the Magic), registered company in England at 12 Queens Rd, Chester, CH3 5HA, United Kingdom. Company number 15818439.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.

• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.

• Your right to erasure – You have the right to ask us to delete your personal information. You can read more about this right here.

• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. You can read more about this right here.

• Your right to object to processing – You have the right to object to the processing of your personal data. You can read more about this right here.

• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.

• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice.

What personal information we collect, use and why

We may collect the following types of personal information:

Newsletter

• Email address

• IP address

If you choose to subscribe to our newsletter we will collect your email address so we can send you emails and your IP address for opt-in compliance. This information is kept private and cannot be used by any third party to contact you. If you unsubscribe, we’ll stop emailing you within 24 hours, the data will be removed from our database within 30 days and from our backups within 3 months.

Web Analytics

• IP address

Your IP address will be shared with our analytics partners however it is anonymised before processing so that you cannot be directly identified from it.

Support

• Name

• Email address

When getting in touch with us through our contact form, email or in writing you may share personal information - including but not limited to your name and email address. This information will be deleted 12 months after resolution of your query, unless we are legally required to retain it for longer.

Technical Operations

• IP address

When you interact with our services your IP address may be logged for operational purposes. Wherever possible it will be anonymised. When this is not possible it will be deleted within 30 days.

Who we share information with

We use a number of data processors who are tasked to perform specific tasks or services on our behalf which involve processing, storing or transmitting your personal information. Before engaging the services of a data processor we perform due diligence to ensure compliance with UK GDPR and appropriate safeguards are in place.

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Current Data Processors

This list includes our current data processors.

Our data processors may change from time to time and this list will be updated accordingly.

Disclosure

We will disclose information:

• If we are required to by law or a court order

• In response to a law enforcement agency

• To the extent permitted under other provisions of law

• For a investigation in to a matter affecting public safety

• If our website or organisation is taken over, sold or involved in a merger or acquisition, your details may be disclosed to our advisors and any prospective purchasers and will be passed on to the new owners

Third Party Websites

Our privacy policy does not apply to third party websites connected by links on our website. You should read the privacy policy on these websites prior to using them.

Children

Our website is not designed to attract children and it is not our intent to collect personal data from children under the age of consent in their country of residence. We request that children under the age of consent do not submit any personal data to us.

Complaints

If you have any concerns about our use of your personal data, you can make a complaint to us using the following details:

Email dpo@xiliant.com or write to the following address:

Data Protection Officer
Xiliant Ltd t/a Riding the Magic
12 Queens Rd, Chester, CH3 5HA, United Kingdom

Our data protection registration reference is ZB739051.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the Information Commissioners Office.

You can write to:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, SK9 5AF, United Kingdom

Call 0303 123 1113

Or find more information on the website at https://www.ico.org.uk/make-a-complaint.

Updated 3rd October 2025