North Devon Wake Park Ltd

Effective Date: October 20, 2024

1. Introduction
North Devon Wake Park Ltd ("NDWP," "we," "us," or "our") is committed to protecting the privacy of our customers, staff, and visitors. This Privacy Policy explains how we collect, use, and disclose personal data in accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

2. Information We Collect
We collect personal data in the following ways:
Information you provide to us: This includes information you provide when making a booking, signing a waiver, contacting us with inquiries, or subscribing to our newsletter. This may include your name, address, email address, phone number, date of birth, and medical information.
Information collected automatically: We use CCTV cameras to monitor our premises for health and safety, security, and operational purposes. This may capture images of you while you are at the park.
Information from other sources: We may receive information about you from third parties, such as social media platforms, if you interact with our accounts or participate in promotions.

3. How We Use Your Information
We use your personal data for the following purposes:
Providing and improving our services: To process bookings, manage activities, ensure safety, and enhance customer experience.
Communication: To respond to inquiries, provide updates, and send promotional materials if you have opted in.
Security: To protect our premises, staff, and customers, and to investigate incidents or claims.
Legal compliance: To comply with legal obligations and assist law enforcement agencies if required.

4. Legal Basis for Processing
We process your personal data on the following legal bases:
Contract: To fulfill our contractual obligations to you when you make a booking or participate in an activity.
Legitimate interests: To ensure the safety and security of our premises, staff, and customers, and to promote our business.
Consent: To send you marketing communications if you have opted in.

5. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law. CCTV footage is typically retained for a maximum of 90 days, unless needed for an ongoing investigation.

6. Data Sharing
We may share your personal data with:
Our staff: To provide a safe and enjoyable session and to improve our services.
Third-party service providers: Who assist us with processing payments, sending communications, or providing other services.
Law enforcement agencies: If required by law or to prevent or investigate a crime.

7. Your Rights
You have the following rights in relation to your personal data:
Access: To request access to your personal data. - You can request access to CCTV footage that relates to you by emailing info@northdevonwakepark.co.uk. We will handle your request in accordance with our CCTV Policy and applicable data protection laws.
Rectification: To request correction of any inaccurate or incomplete data.
Erasure: To request deletion of your personal data in certain circumstances.
Restriction: To request restriction of processing of your personal data in certain circumstances.
Objection: To object to processing of your personal data in certain circumstances.
Data portability: To receive your personal data in a portable format.

8. Data Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it from unauthorised access, use, or disclosure. These measures include:
Secure Website: Our website uses HTTPS encryption to protect data transmitted between your browser and our server.
Secure internet access: We used a private connection and do not allow customers to gain access to our internet.
Secure Data Storage: We utilise a third-party provider (Wakesys, Wix, & Square) to securely store all personal data. This provider employs industry-standard security measures to protect data from unauthorised access or breaches.
Software Updates: We maintain all software, including operating systems, applications, and security software, up to date to patch vulnerabilities and protect against malware.
Strong Passwords: All staff members are required to use strong passwords and are prohibited from sharing them.
Access Controls: Access to computers and software containing personal data is restricted to authorized personnel. All such devices are kept on-site and securely locked when not in use.
Data Breach Response Plan: We have a data breach response plan in place to ensure prompt and effective action in the event of a data breach.

9. Children's Data
NDWP is committed to protecting the privacy of children. We encourage parents and guardians to observe and guide their children's online activity.
We collect limited personal data from children under the age of 16, such as their name and date of birth, for the purpose of providing our services and ensuring their safety. We also require a signed parental waiver for all children under 16 participating in our activities.
All children's data is linked to their parent's account, and children cannot create an account without an adult. We will not use children's data for any marketing purposes or share it with any third parties without parental consent, except where required by law.
If you believe that your child has provided us with their personal data without your consent, please contact us immediately, and we will take steps to remove such information from our records.

10. Contact Us
If you have any questions or concerns about this Privacy Policy or our data protection practices, please contact us at: 01237751517

11. Policy Updates
We may update this Privacy Policy from time to time. Any changes will be posted on our website and will be effective immediately.
By using our services or providing us with your personal data, you acknowledge that you have read and understood this Privacy Policy.