LEGAL
Privacy Policy 

Privacy Policy

 

1. Who we are

[Business name] (“we”, “us”, “our”) runs children’s craft and event sessions, including glow-in-the-dark themed activities.

We are the data controller for the personal data you provide to us through our website, ticket booking pages, email communications, and subscription forms.

2. What this policy covers

This privacy policy explains how we collect, use, store and share personal data when you:

  • visit our website;
  • contact us by email;
  • buy tickets or book places at our events;
  • join our mailing list or subscribe for updates;
  • complete forms or surveys we use in connection with our services.

3. The personal data we collect

Depending on how you interact with us, we may collect:

  • your name;
  • your email address;
  • your phone number;
  • billing and payment-related information;
  • booking and ticket information;
  • attendee details you provide when booking;
  • answers you submit through forms, surveys or subscription forms;
  • communications you send to us;
  • technical information collected through our website, such as IP address, browser type, device information and cookie-related data.

For children’s events, we ask that a parent or guardian provides information on behalf of a child unless clearly stated otherwise.

4. How we collect your data

We collect personal data:

  • directly from you when you email us, book tickets, fill in forms, or subscribe for updates;
  • from the third-party platforms we use to operate the business;
  • automatically through website technologies such as cookies or server logs where applicable.

5. How we use your personal data

We use personal data to:

  • respond to enquiries;
  • manage bookings and attendance;
  • send booking confirmations and service messages;
  • provide customer support;
  • manage subscriptions and send updates where you have asked to receive them;
  • improve our website, events and services;
  • keep appropriate records for business, accounting and legal purposes;
  • protect our business, website and users against misuse or fraud.

6. Our lawful bases for processing

Under UK data protection law, we rely on one or more of the following lawful bases:

  • Contract – where we need your data to process a booking, provide tickets, or respond to a request related to our services.
  • Consent – where you choose to subscribe to updates or marketing communications.
  • Legitimate interests – where we use data to run and improve our business, respond to enquiries, maintain records, and keep our services secure, provided this does not override your rights.
  • Legal obligation – where we need to keep certain records for tax, accounting or other legal reasons.

Where we rely on consent, you can withdraw it at any time.

7. Marketing and subscriptions

If you subscribe to updates, we may use your email address to send you news about future sessions, availability, and related announcements.

We currently use SmartSurvey to manage subscriptions and related form responses. SmartSurvey states that, for data collected by its users, the user is the data controller and SmartSurvey acts as the data processor for respondent data.

You can unsubscribe at any time by:

  • clicking the unsubscribe link in any email, where available; or
  • contacting us at [insert email address].

8. Ticket sales and event bookings

We use Ticket Tailor to sell tickets and manage event bookings. Ticket Tailor states that event organisers own their ticket buyer and attendee data, and that organisers should provide their own privacy policy to attendees. Ticket Tailor also says the servers and databases powering its service are located in the EU in Ireland, while some supporting third parties may be outside the EU.

When you book through Ticket Tailor, information you provide during booking may be processed through their platform in accordance with both their terms and ours.

9. Email communications

We use Google for business email communications. This means emails you send to us, and our replies to you, may be stored and processed through Google systems. Google explains that its Privacy Policy covers how it collects, uses, and manages data across its services.

10. Website hosting

Our website is hosted by IONOS. As a result, visitor and technical data submitted through or generated by the website may be processed via IONOS hosting infrastructure and related systems. IONOS provides privacy and data protection information for its hosting services and website operations.

11. Third-party service providers we use

We currently use the following providers to help run our business:

  • Google – for email and related communications. 
  • Ticket Tailor – for ticket sales and event booking management. 
  • IONOS – for website hosting. 
  • SmartSurvey – for subscription management and forms. 

These providers may process personal data on our behalf. We may update this list from time to time.

12. Sharing your data

We do not sell your personal data.

We may share your personal data where necessary with:

  • our service providers and processors listed above;
  • payment and booking providers involved in processing your order;
  • professional advisers, where necessary;
  • regulators, law enforcement, courts, insurers, or other authorities where required by law or to protect legal rights.

13. International transfers

Some of the providers we use may process personal data outside the UK. Where this happens, we expect appropriate safeguards to be used in line with applicable data protection law.

For example, Ticket Tailor states that while its main servers and databases are in the EU in Ireland, some of its third parties are outside the EU and are contractually required to comply with GDPR standards.

14. How long we keep your data

We keep personal data only for as long as reasonably necessary for the purposes set out in this policy, including to meet legal, accounting, tax, insurance, safeguarding, and record-keeping requirements.

As a guide, we may keep:

  • enquiry emails for up to 24 months;
  • booking and transaction records for up to 6 years where required for tax and accounting purposes;
  • subscription data until you unsubscribe or ask us to delete it, unless we need to retain limited records to demonstrate consent or comply with legal obligations.

If we no longer need your personal data, we will delete it or anonymise it where appropriate. The ICO says privacy notices should explain either retention periods or the criteria used to decide them.

15. Cookies and website analytics

Our website may use cookies or similar technologies for essential website functions, security, performance, and basic analytics.

You can usually control cookies through your browser settings. Where legally required, we will request consent before using non-essential cookies.

You may also wish to have a separate Cookie Policy if your website uses analytics, embedded content, or non-essential cookies.

16. Data security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration.

However, no method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

17. Your data protection rights

Depending on the circumstances, you may have the right to:

  • access your personal data;
  • have inaccurate data corrected;
  • ask for your data to be erased;
  • restrict how your data is used;
  • object to certain processing;
  • withdraw consent at any time where consent is the lawful basis;
  • request transfer of your data in some cases;
  • complain to the UK Information Commissioner’s Office (ICO).

The ICO says individuals should be told what rights they have and how they can complain.

You also have the right to complain to the ICO.

18. Children’s data

Our services relate to children’s events, but bookings and key communications should usually be made by a parent or guardian.

We ask that adults only provide personal data that is necessary for the booking or safe operation of the event. We do not knowingly collect more information about children than we need.

19. Changes to this privacy policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.
 

We need your consent to load the translations

We use a third-party service to translate the website content that may collect data about your activity. Please review the details in the privacy policy and accept the service to view the translations.