Elf Kingdom Privacy Policy

1 Who we are and how to contact us

Elf Kingdom is operated by 2 Four 6 Marketing Limited. For the activities described in this policy, 2 Four 6 Marketing Limited is the data controller when it decides why and how your information is used.

For privacy enquiries, email [email protected] or write to Elf Kingdom, c/o 2 Four 6 Marketing Limited, 1st Floor Spitalfields House, Stirling Way, Borehamwood, Hertfordshire WD6 2FX. Use this email to opt out of email or SMS marketing or request the removal of your personal information.

2 Information we collect

• Contact and account details: your name, email address, telephone number, billing address, postcode and account details where you create an account.
• Booking and payment information: booking reference, event date and time, ticket and add-on choices, number of visitors, prices, discounts, payment status, refunds, changes and ticket scanning or admission records. Payment providers handle your card details; we generally receive transaction details rather than your full card number.
• Information about children: where needed for the experience, a parent or guardian may give us a child’s first name, age or age range and preferences connected with the booking. Please give us only the details we request.
• Support and event information: enquiries, messages, feedback, complaints, incident reports and records of our response.
• Accessibility and safety information: details you choose to share about access needs, disability, medical needs or an incident so we can arrange support and respond appropriately. We seek only what is needed.
• Marketing and technical information: your subscription choices, messages sent and interactions where measured, and website data such as IP address, device, browser, pages visited, referral source and cookie or similar identifiers.
• Images and security records: photographs or video captured by our event team and CCTV images where cameras operate at the venue. Event signs or notices will give further information where appropriate.

3 Where we get information

We receive information directly from you, from a person who makes a booking for you, from the ticketing and payment providers used for your booking, and when you contact us or attend. We also receive website information through our systems and, where permitted, cookies and similar technologies. If another adult gives us information about a child or visitor, we expect them to tell that person, or their parent or guardian, about this policy where appropriate.

4 Why we use information and our lawful bases

We use information only where we have a lawful basis under UK data protection law. The basis depends on the activity:

• Bookings and entry: to process orders, take payment, send confirmations and tickets, validate entry and supply what was purchased. We generally rely on our contract with the person booking. For another visitor’s details we may rely on our legitimate interest in providing and managing their visit.
• Essential event messages and customer support: to explain changes, safety arrangements or issues with a booking, answer questions and handle complaints. We rely on our contract, our legitimate interest in running the event and helping visitors, or a legal obligation where one applies.
• Safety, security and fraud prevention: to manage incidents, protect visitors and staff, prevent ticket misuse and protect our systems. We rely on our legitimate interest in operating a safe and secure event, and on legal obligations where applicable.
• Financial records and claims: to maintain accounting records, comply with tax or legal duties and establish or defend claims. We rely on a legal obligation or our legitimate interest in managing disputes.
• Event planning and improvement: to assess attendance, feedback and website performance so we can improve the event. We rely on our legitimate interest in improving our services, or consent for technologies that require it.
• Marketing: to send eligible adults news about Elf Kingdom and similar events or offers when you have consented or when the electronic marketing rules allow us to contact an existing customer who had a clear opt-out when their details were collected and in every message. See section 6.

Our legitimate interests are running the event, supporting visitors, preventing misuse, protecting people and improving our services. We weigh those interests against your rights, especially where children’s information is involved.

5 Children and accessibility information

An adult should make bookings and provide information about children. We use children’s details only where needed for admission, age-appropriate activities, the experience requested or safety. We do not use information supplied about a child for direct marketing to that child. A child and their parent or guardian can ask us about the child’s information and rights.

Health and disability information needs additional protection. Where you ask us to make an accessibility arrangement, we will explain what we need and use an appropriate UK GDPR lawful basis and a separate special-category condition, such as explicit consent where suitable. If you show supporting evidence at the event, we do not automatically keep a copy. In an emergency or incident, we may use relevant information where another legal condition applies.

6 Marketing and your choices

Marketing sign-up is separate from buying a ticket. If we invite you to receive marketing, the sign-up wording will explain the type of messages and the sender. We will not treat a sign-up for Elf Kingdom as permission for unrelated companies or brands to market to you. We may promote similar events run by the same legal company to eligible existing customers only when the rules for doing so are met.

You can stop email or SMS marketing at any time by using the unsubscribe link in an email, following the opt-out instructions in a text or emailing [email protected]. We may retain limited information to honour your opt-out. You may still receive necessary messages about a booking.

7 Cookies and online advertising

Our website and booking pages may use cookies, pixels, tags or similar technologies for essential functions, security, remembering choices, audience measurement and advertising. We use technologies without consent only where a legal exception applies. Where consent is required, including for advertising tracking, we ask before activating them. You can change available choices through the cookie controls on the relevant website. A separate cookie notice or preference panel should identify the technologies in use, their purposes, providers and durations.

If you visit a booking page run by another provider, that provider may set its own cookies and give you its own privacy information.

8 Photography, filming and CCTV

We may photograph or film parts of the event for operational records and promotion. If we intend to make a child the clear focus of a promotional image, we will seek appropriate permission from a parent or guardian. Tell our team if you have a concern about a particular image. Other visitors may take their own photographs; we do not control how they use images they capture independently.

Where CCTV is used, we use footage for safety, security and incident investigation. Signs at the venue should identify the relevant operator and how to obtain more information. We restrict access and keep footage only for as long as needed, except where an incident or claim requires longer retention.

9 Who we share information with

We share only what is reasonably needed with ticketing and payment providers, website and IT suppliers, email and customer support providers, event staff and contractors, security and medical teams, insurers and professional advisers. Where lawful and necessary, we may also share details with police, emergency services, local authorities, regulators or courts. Analytics and advertising providers may receive website data where their technologies are used in line with your choices and the law.

Our suppliers must protect information and act under suitable agreements when processing it for us. A provider may also be an independent controller for its own services; check the privacy information it gives you. We do not sell your personal information.

10 Transfers outside the UK

Some suppliers may process information outside the UK. Where a transfer is restricted by UK law, we use a valid route, such as UK adequacy regulations or appropriate contractual safeguards and any required assessment. Contact us if you want more information about safeguards relevant to your data.

11 How long we keep information

We keep information only for as long as needed for its purpose, then delete or anonymise it securely. Booking and financial records are generally retained for up to six years after the relevant transaction where needed for tax, accounting and potential claims, with longer retention if a dispute or legal duty requires it. We keep enquiries and incident records for the period needed to resolve them and any related claim. We keep marketing preferences while relevant and a limited suppression record after you opt out. We remove children’s details and accessibility information when they are no longer needed for the visit or any related issue. CCTV is normally kept for a short period unless needed for an incident or claim. Exact periods may differ where a provider is an independent controller.

12 How we protect information

We use appropriate access controls and organisational and technical measures to protect information against loss, misuse and unauthorised access. Only people who need information for their work should access it. No internet service can guarantee complete security.

13 Your rights

Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction of use or transfer of data you supplied. You may withdraw consent at any time where we rely on it; withdrawal does not affect earlier lawful use. Some rights depend on the lawful basis and are subject to legal exceptions.

You have the right to object to direct marketing at any time. You may also object to processing based on our legitimate interests, in which case we will consider your request under the law.

To exercise a right, including a request to remove your information from our systems, email [email protected]. We may need to verify your identity. We will delete information where the right to erasure applies, but may have to keep some records for legal, accounting or claims purposes. We will not make a decision about your admission or access to the event based solely on automated processing that has legal or similarly significant effects.

14 Complaints and changes

Please contact us if you have a concern so we can look into it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.

We may update this policy when our event, suppliers or data practices change. We will publish the latest version on the Elf Kingdom website and show the updated date above. If a material change affects information we already hold, we will tell you where the law requires it.