Thursford Collection and Thursford Enterprises Ltd – Data Protection Statement

Thursford Collection’s Commitment

Thursford Collection is committed to processing all personal data in a responsible and secure way that meets the requirements set out in the General Data Protection Regulation (GDPR). To do this we make use of appropriate technology to keep your data secure and follow documented procedures to ensure that our staff and any third parties we use, understand them so that we can process your personal data safely and responsibly.

Thursford Collection as the Data Controller

Thursford Collection is the data controller when we determine the purpose for which your data is collected. When you submit your personal data to us, it becomes the responsibility of the Thursford Collection. If anyone has any concerns regarding the handling of their personal data or who may wish to exercise their rights, they should contact the Privacy Officer (PO) in the first instance using the following contact details shown below:

Thursford Collection

Fakenham

NR21 0AS

[email protected]

Why we have prepared this statement

We have prepared this statement to be as clear as possible as to how we process or intend to process any personal data you give us. We also explain the procedures we adhere to in order to protect your privacy. One of these procedures is to notify you on how you can access an appropriate Privacy Notice.

This sets out:

• What information we collect about you and why we collect it
• How that information is used
• How you can exercise your rights, such as accessing and updating the information

Why we collect your personal data and how we justify it in law

Thursford Collection will need to collect personal data for a variety of reasons depending on the relationship you have with us. In all instances, we will process your personal data using one of the lawful conditions as follows:

• Using your consent, given prior to any processing;
• To meet our contractual obligation;
• To comply with our legal obligations;
• When acting in your vital interests;
• When processing is necessary for tasks in the public interest; or
• For the purposes of our legitimate interests, where we asses that this action does not over-ride your rights and freedoms as they affect the use of your personal data.

In all cases we will respect our legal obligations that any personal data we collect shall be:

• Processed fairly, lawfully and transparently;
• Collected for a specified, explicit and legitimate purposes;
• Adequate, relevant and limited to what is necessary (and no more);
• Accurate and, where necessary kept up to date;
• Kept for no longer than is necessary; and
• Processed in a manner that ensures appropriate security.

What happens when you purchase a product, service or event

For all purchases of, products, services and events we use third party system providers.  When you make a purchase, you create a contract between us and this will be our lawful basis against which we will process your personal data.  The contract also comes with terms and conditions which can be viewed separately.

Where the personal data is processed and stored

All personal data, that we collect or generate in hard copy form, is processed and stored securely on the premises of Thursford Collection. We have agreements in place with our Ticketing System provider, other database software suppliers, email distribution service and mailing house to ensure that your data is secure at all times and cannot be accessed or used for any other purpose.  All our back up servers are situated in the EEA.

Unless you instruct us to the contrary, we will retain your profile on our booking and IT systems for the period necessary to fulfil the purposes outlined in this statement or until you request that the data is deleted. None of this affects your rights and if you have any concerns, we ask that you contact the Privacy Officer using [email protected] in the first instance.

If you want to delete your profile online, you can do this yourself at any time or you can ask us to do this for you by contacting the Privacy Officer.

As far as making a booking and the use of personal data, our processing will involve:

• Collecting/ confirming the personal details of the head of party or ‘booker’;
• If children are being booked to use Santa’s Magical Journey into Christmas, we will ask you for their first name, age and gender. This will only be collected with your explicit consent and will only be used for the purposes of arranging an appropriate gift to be given to each child as they pass through the venue hall;
• Using anonymised versions of your data for the purposes of statistical analysis which forms part of our marketing strategy; and
• Possibly contacting you with important information that is relevant to your visit, such as local road conditions that impact your journey planning.

What happens to information relating to general enquiries

If you intend to use the website to make an enquiry, we will ask you to read this statement beforehand. If you call us, you will be notified that your call will be recorded and monitored for quality purposes. In order for us to deal with any queries regarding any bookings made or concerns about the way your enquiry was handled, we have a legitimate interest to keep all recordings for 12 months, after which the recordings are deleted. In all instances, we will look after any personal data you give us over the phone or via the website, in accordance with current data protection laws and this statement.

Use of on-site CCTV

Thursford Collection uses an extensive CCTV operation to enhance the security of the site which, in turn, enhances the safety of the staff, performers and the visitors. Operation of the CCTV is controlled, and images are stored on a series of hard drives which are over-written over time. This action effectively deletes the images recorded between twelve and fourteen months previously.

Under certain circumstances, Thursford Collection will have a legitimate interest or a legal obligation to retain selected footage for the purposes of assisting with legitimate investigations (or similar activities); such content will be stored for up to seven years, after which it will be destroyed, unless there are over-riding reasons to retain it for longer.

The Thursford Collection website

Thursford Collection maintains a website for publicity purposes and as a source of information to visitors. It is also how the public can make bookings online. The website uses cookies to enhance user experience and collects analytical data of the web browsers used to view the website. No attempt must be made to identify the individuals, via technical means or otherwise, that visit the website, unless there is a legal requirement to do so.

What we will not do with your personal data

Thursford Collection will not pass your personal data to any third-party unless we are legally obliged to do so. We will not engage you in any direct marketing activity or contact you unless you have requested to be kept informed of future events or to be provided with details of future offers relating to our on-site activities only.

Change of purpose of processing

If the purpose for which we have collected your data changes, we will contact you with the relevant information and take further appropriate action. If necessary, we will re-issue you with a new Privacy Notice.

If the basis of processing relies on your consent, we will not act upon any change of purpose until we have re-established your consent. If you choose not to respond, then we take it that you have not given us your consent against the new purpose.

Information about your rights

The GDPR puts much greater emphasis on transparency of processing and accountability by all parties involved in handling your personal data. It also extends the rights of individuals in respect of their personal data. It should be noted that these are restricted in so much that they do not necessarily apply in all situations. For convenience, the rights are listed below.

• Right to be informed;
• The right to access;
• Right to rectification;
• Right to erasure (‘right to be forgotten’);
• Right to restrict processing;
• Right to data portability;
• Right to object to processing; and
• Rights related to automated decision making and profiling

In addition, a user has the right to lodge a complaint against Thursford Collection. As we are based in the UK, complaints should be lodged with the UK Government’s Information Commissioner’s Office (ico.org.uk)

If you have concerns or queries about the processing of your personal data

If you have concerns or queries regarding the handling of your personal data and/or you wish to exercise your rights, we ask that you contact the Privacy Officer. We will respond in the first instance to confirm the nature of the enquiry and provide a schedule for a full response, as required. If you are making a data subject access request, we may ask you for further information or documentation so that we can verify your identity before providing you with the information you have requested.

If you prefer not to contact us, you may take your concern or complaint directly to the ICO. For more information, please visit the ICO website using https://ico.org.uk.