Privacy Policy

1. Introduction

Inflatable World Cookstown Ltd ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website, book our services, or visit our premises.

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means we are responsible for deciding how we hold and use personal information about you.

2. Information We Collect

We collect and process the following types of personal data:

2.1 Information You Provide

• Account Information: Name, email address, and password when you create an account
• Booking Information: Date, time, party size, special requests, and dietary requirements
• Payment Information: Payment card details processed securely through our payment provider (Revolut)
• Guest Checkout: Name and email address for guest bookings
• Waiver Information: Acknowledgement of safety rules and liability waivers
• Communications: Any messages or enquiries you send us

2.2 Information Collected Automatically

• Technical Data: IP address, browser type, device information, and operating system
• Usage Data: How you interact with our website, pages visited, and booking patterns (see Section 8)

2.3 Children's Data

Our services are designed for families and children. We do not knowingly collect personal data from children under 13 without parental consent. Bookings for children must be made by a parent or guardian who accepts responsibility for the child's visit and any data provided.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To fulfil bookings and provide our services to you
• Legal Obligation: To comply with health and safety regulations, tax obligations, and other legal requirements
• Legitimate Interests: To improve our services, prevent fraud, and communicate with you about your bookings
• Consent: For marketing communications (where required)

4. How We Use Your Information

We use your personal data for the following purposes:

• Processing and managing your bookings
• Taking payment and providing receipts
• Communicating booking confirmations, reminders, and updates
• Managing dietary requirements and allergies for party catering
• Maintaining safety records and liability waiver acknowledgements
• Responding to your enquiries and providing customer support
• Improving our website and services
• Sending marketing communications (only with your consent)
• Preventing fraud and ensuring security
• Complying with legal obligations

5. Data Sharing and Third Parties

We may share your personal data with:

• Payment Processors: Revolut for secure payment processing
• Cloud Service Providers: For hosting and data storage
• Email Service Providers: For booking confirmations and communications
• Legal and Regulatory Bodies: When required by law or to protect our legal rights

We require all third parties to respect the security of your personal data and treat it in accordance with UK data protection laws. We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for the following periods:

• Account Information: Until you delete your account, plus 6 years for legal compliance
• Booking Records: 6 years from the date of the booking (for tax and legal purposes)
• Waiver Records: 6 years from the date signed (or until a child reaches 21 years old plus 6 years for child waivers)
• Payment Records: 6 years (HMRC requirements)
• Marketing Consent: Until you withdraw consent

7. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at privacy@inflatableworldcookstown.com. We will respond to your request within one month.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies and Website Analytics

8.1 Cookies

Our website does not use cookies for analytics or tracking purposes. We do not use any third-party analytics services (such as Google Analytics) or advertising trackers.

8.2 Session-Based Analytics

To help us understand how visitors use our website and improve our services, we collect anonymous usage data using our own self-hosted analytics. This works as follows:

• A randomly generated visitor identifier is stored in your browser's session storage (not a cookie) for the duration of your browsing session
• This identifier is automatically deleted when you close your browser tab and cannot be used to identify you personally
• We record which pages are visited to understand usage patterns
• No data is shared with third parties

This analytics data is processed on the basis of our legitimate interest in improving our website and services (Article 6(1)(f) UK GDPR). Because we use session storage rather than cookies, and the data is anonymous and non-persistent, this does not require consent under the Privacy and Electronic Communications Regulations (PECR).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit using SSL/TLS
• Secure password hashing for user accounts
• PCI DSS compliant payment processing through Revolut
• Regular security assessments and updates
• Staff training on data protection
• Access controls and authentication measures

10. International Data Transfers

Your data is primarily stored within the UK and European Economic Area. Where we transfer data outside these regions, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK government or adequacy decisions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Significant changes will be communicated to you via email where appropriate.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: