Privacy Policy

1 Who we are

This website, hauntedhalloweenescape.co.uk (the “Website”), is operated by [Legal/Trading Name] (“we”, “us”, “our”). We provide Halloween-themed escape experiences, ghost hunts, scarefests, live attractions and related services across England, Wales and Scotland.

For the purposes of UK data protection law, we are the “data controller” responsible for your personal data. We are [a company registered in England and Wales under company number [00000000], registered office [registered address]] / [a sole trader trading from [business address]]. Where required, we are registered with the Information Commissioner’s Office under registration number [ICO registration number].

This policy explains what personal data we collect, how we use it, who we share it with and the rights you have. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

2 What this policy covers

This policy applies to personal data we collect when you visit the Website, make a booking or purchase tickets, create an account, contact us, or otherwise interact with our services. It does not apply to third-party websites we link to, which have their own privacy policies (see clause 13).

3 The information we collect

Depending on how you use our services, we may collect the following categories of personal data:

Booking & attendee information

• Lead booker details — your name, email address, telephone number and billing address.
• Attendee details — for ticketed events we may collect the name, email and telephone of each attendee you add to a booking, so we can issue individual e-tickets.
• Booking details — the event, date, ticket type, number of guests, order reference and any notes or accessibility requirements you provide.

Account information

• If you create an account, we store your username, email, password (encrypted), order history and saved addresses. You can view, edit or delete most of this at any time from your account area.

Payment information

• Payments are processed by our payment providers (for example Stripe) and by bank transfer where offered. We do not store your full card details on our servers; card data is handled directly by the payment provider under their own security standards.

Communications & preferences

• The content of messages you send us (email, contact form, WhatsApp) and your marketing preferences, including whether you have subscribed to our newsletter or WhatsApp updates.

Website & device information

• Technical data such as your IP address, browser type, device information and pages viewed, collected through cookies and similar technologies (see clause 6). If you leave a comment, we collect the data in the comment form plus your IP address and browser string to help detect spam.
• If you request a password reset, your IP address is included in the reset email.

On-site information

• At our venues we may operate CCTV for safety and security, and may take photographs or video for promotional purposes. You can ask a member of staff not to be included in promotional material.

4 How & why we use your information

We only use your personal data where the law allows us to. The main ways we use it, and our lawful bases under the UK GDPR, are:

Where we rely on legitimate interests, we make sure this is balanced against your rights. Where we rely on consent, you can withdraw it at any time.

5 Marketing communications

If you opt in, we may send you news about upcoming events, last-minute places and Early Bird offers by email or WhatsApp. Every marketing email includes an unsubscribe link, and you can opt out of WhatsApp updates by replying to any message or contacting us. Opting out of marketing does not affect service messages we must send you about a booking you have made (such as your confirmation and e-tickets).

6 Cookies & similar technologies

We use cookies and similar technologies to make the Website work, remember your basket and preferences, keep you signed in, and understand how the site is used. If you leave a comment you may opt in to saving your name, email and website in cookies for convenience; these last up to one year. Login and screen-option cookies are set when you sign in, and are removed when you log out (a “Remember me” login persists for two weeks).

You can control or delete cookies through your browser settings and, where available, our cookie banner. Blocking some cookies may affect how the Website works. For more detail, see our Cookie Policy.

7 Who we share your information with

We do not sell your personal data. We share it only where necessary with:

• Payment providers (for example Stripe) to take payment securely.
• Ticketing & booking tools that issue and manage your e-tickets and attendee records.
• Hosting, email and IT providers that run our Website and send booking and marketing emails.
• Analytics and spam-detection services that help us improve and protect the Website; visitor comments may be checked through an automated spam-detection service.
• Professional advisers (such as accountants and legal advisers) where needed.
• Authorities or third parties where we are required to by law, or to protect our rights, safety or property.

Our providers may only use your data for the purposes we specify and must keep it secure.

8 Storing & transferring your data

Your data is stored on secure servers operated by us or our providers. Some providers may process data outside the UK. Where they do, we make sure appropriate safeguards are in place (such as UK “adequacy” regulations or the UK International Data Transfer Agreement) so your data receives an equivalent level of protection.

9 How long we keep your data

We keep personal data only for as long as we need it. Booking and transaction records are generally kept for [6] years to meet tax and accounting obligations. Account data is kept while your account is active. Marketing data is kept until you unsubscribe. If you leave a comment, the comment and its metadata may be retained so we can recognise and approve follow-up comments automatically. When we no longer need your data, we securely delete or anonymise it.

10 How we protect your data

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including secure hosting, encryption in transit and restricted access. No method of transmission over the internet is completely secure, but we take reasonable steps to keep your data safe.

11 Your rights

Under UK data protection law you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectify — ask us to correct data that is inaccurate or incomplete.
• Erase — ask us to delete your data where there is no good reason for us to keep it.
• Restrict or object — ask us to pause or stop certain processing, including direct marketing.
• Port — receive your data in a portable format, or have it transferred to another provider.
• Withdraw consent — where we rely on consent, at any time.

To exercise any of these rights, contact us using the details in clause 15. We will respond within one month. Exercising your rights is free, and you can also see, edit or delete much of your information yourself from your account. Please note we may need to keep some data where we are legally required to.

12 Children’s privacy

You must be 18 or over to make a booking or hold an account. We do not knowingly collect personal data from children in order to sell to them. Where a booking includes younger attendees, the details are provided by the responsible adult who made the booking.

13 Third-party links & embedded content

Our Website may include links to other sites and embedded content (such as videos, images or maps). Embedded content behaves as if you had visited the other website, and those sites may collect data about you, set cookies and track your interaction. We are not responsible for the privacy practices of third-party sites; please review their policies.

14 Changes to this policy

We may update this policy from time to time, for example to reflect changes in law or how we operate. The version that applies is the one published here, and we will update the “Last updated” date above. Significant changes will be highlighted where appropriate.