Privacy Policy
Last updated:
This policy explains what personal information Turbary House Leisure Park collects when you book, enquire or visit, why we collect it, and the rights you have over it under UK data protection law.
1. Who we are
Turbary House Leisure Park is run by THLP Group Ltd, a company registered in England and Wales under number 15519638. We are the data controller for the personal information described in this policy.
- Address: Turbary House Leisure Park, Chain House Lane, Whitestake, Preston, Lancashire, PR4 4LB
- Email: hello@thlp.uk
- Phone: 07921 193 063
If you have any questions about this policy or how we use your information, please contact us using the details above.
2. What information we collect
We only collect the information we need to run your booking or answer your enquiry.
| Type of information | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, email address, phone number, postcode | You, when you book, enquire or fill in one of our forms |
| Enquiry details | Which experience you are interested in, preferred dates | Our website forms and Facebook or Instagram lead forms |
| Booking details | Tickets bought, date and time slot, number and ages of people in your group | Our online booking system, phone or in person |
| Children’s details | First name, age and any information you give us for a visit to Father Christmas | You, as the parent or guardian making the booking |
| Payment information | Card payments are taken by our payment provider. We do not see or store your full card number | Our payment provider |
| Health and safety information | Accessibility needs, allergies, medical information relevant to an activity, accident reports | You, or our staff if an incident happens on site |
| Activity waivers | Signed participation forms for activities such as axe throwing or archery | You, before taking part |
| CCTV and photos | CCTV images on site; photos or video taken at events | Our cameras and staff |
| Communications | Emails, messages, calls, reviews and feedback | You, when you contact us |
| Website and advert data | IP address, device, pages visited, how you found us, which advert you clicked | Cookies on our website and advertising platforms such as Meta |
3. How we use your information and our legal basis
UK data protection law says we must have a lawful reason for each way we use your information. Ours are set out below.
| What we use it for | Lawful basis |
|---|---|
| Taking and managing your booking, sending confirmations and updates about your visit | Contract |
| Replying to your enquiry and calling or emailing you to help you book | Legitimate interests (responding to people who have asked us to contact them) |
| Keeping visitors safe, recording accidents and checking activity waivers | Legal obligation and legitimate interests |
| Health or accessibility information you give us | Your explicit consent, or where needed to protect someone’s vital interests |
| Sending you offers and news about future events | Consent, or soft opt-in for existing customers (see section 5) |
| CCTV for security and the safety of visitors and staff | Legitimate interests |
| Using event photos on our website and social media | Consent |
| Measuring and improving our adverts and website | Consent for non-essential cookies; legitimate interests otherwise |
| Keeping financial and tax records | Legal obligation |
We do not sell your personal information, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.
4. Children’s information
We only collect children’s information from a parent, guardian or the adult making the booking, never directly from the child.
For events such as The Great Christmas Rescue and visits to Father Christmas, we may ask for a child’s first name and age so we can personalise their visit and choose an age-appropriate present. We use this only for that visit and delete it within 3 months of the event.
Our online forms and adverts are aimed at adults aged 18 and over. If you think a child has given us their details without a parent’s knowledge, please contact us and we will delete them.
We will never publish a photo in which a child can be identified without permission from their parent or guardian.
5. Marketing
We will only send you marketing emails or texts if you have agreed to receive them, or if you have booked with us before and we are telling you about similar events. This is known as the soft opt-in, and you can say no at any time.
Filling in an enquiry form is not the same as signing up to marketing. If you enquire, we will contact you about that enquiry only, unless you also tick the box to hear about future events.
You can opt out at any time by clicking unsubscribe in any email, replying STOP to any text, or contacting us directly. We may also show you adverts on Facebook and Instagram based on your visit to our website; you can control this in your Meta ad preferences and our cookie settings.
7. International transfers
Some of our providers, including Meta and some software companies, store data outside the UK, for example in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK’s data adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement approved by the ICO.
8. How long we keep your information
We keep information only for as long as we need it, then delete or anonymise it.
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to a booking | 12 months from your last contact |
| Booking records | 2 years after your visit |
| Financial and payment records | 6 years, as required by HMRC |
| Children’s names and ages for Father Christmas visits | 3 months after the event |
| Activity waivers and accident reports | 3 years, or until a child involved turns 21 if longer |
| CCTV footage | 30 days, unless needed to investigate an incident |
| Marketing list | Until you unsubscribe, or 3 years without any contact |
9. How we keep your information safe
We use password-protected systems with access limited to staff who need it, secure payment providers, and encrypted connections on our website. Paper forms such as waivers are kept in a locked office. If a data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
11. Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to limit how we use your information
- object to us using your information, including for marketing
- ask us to transfer your information to another organisation
- withdraw your consent at any time, where we rely on consent
To use any of these rights, email hello@thlp.uk or write to us at the address in section 1. We will reply within one month and there is usually no charge.
If you are unhappy with how we have handled your information, please talk to us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time, for example when we add new events or change providers. The latest version will always be on this page, with the date it was last updated at the top.
Last updated: