1. Introduction

1.1 This Policy (together with our Website Terms and Conditions and any other documents referred to in them) sets out the basis on which we, Cannon Hall Farm Limited, with company number 04637412 and a registered address of Cannon Hall Farm, Cannon Hall Cawthorne, Barnsley, South Yorkshire, S75 4AT (trading as Cannon Hall Farm), will process any personal data we collect from you or that you provide to us in the course of using our website (https://www.cannonhallfarm.co.uk/) and affiliated passport platform (https://passport.cannonhallfarm.co.uk/), ticketing website (tickets.cannonhallfarm.co.uk), shops (shop.cannonhallfarm.co.uk) and VIP website (https://vip.cannonhallfarm.co.uk/), jointly referred to as “Site”.

1.2 Cannon Hall Farm (“us” or “we” or “our”) respects the privacy rights of all our users and recognises the importance of protecting the information we collect about you. Our Privacy Policy is designed to help you understand how we collect, hold, use, and disclose personally identifiable information about you.

1.3 For the purpose of the UK Data Protection Act 2018 (“DPA’18”), Cannon Hall Farm is the data controller.

2. Your Information

2.1 All personal data collected from a user who is making a purchase through our Site is processed under the UK General Data Protection Regulation (“UK GDPR”) and DPA’18 under the lawful basis of contract.

2.2 Any additional personal data collected through a user’s interactions with our Site will be processed on the lawful basis of legitimate business interest for the purposes of providing information and services to our users.

3. Information that may be collected about you

3.1 The following personal data may be collected from you when you create a passport account (“Passport Account”), when you make a purchase through the Site (whether this be booking a ticket or purchasing physical goods), when you book an event, or when you visit us at Cannon Hall Farm:

• Full name;
• Age;
• Email address;
• Telephone number;
• Address;
• Delivery address (where applicable);
• Company name (where applicable);
• Financial data (such as payment details);
• Dietary requirements;
• Health data;
• Photos of videos;
• Car registration;
• CCTV images and videos; and
• Reasonable adjustment requirements.

3.2 During the course of using our Site other data may be collected from you, including:

• Your activity on the Site;
• Date and time stamps;
• Operating system; and
• Analytic data for statistical purposes.

4. Special Category Personal Data

4.1 Where a user books or organises an event through our Site, such as a VIP Experience, a school visit, or a child’s party, there may be times where we collect special category data. This may include but is not limited to, the following types of special categories personal data:

• Health;
• Religion or other beliefs; and
  Reasonable adjustments.

4.2 Where special categories of personal data may be collected, we will ensure that additional safeguards are in place to protect any such personal data.

5. Processing of personal data of those below the age of 13

5.1 Our Site is not intended for use by anyone under the age of 13. We do not knowingly collect or solicit personally identifiable information from anyone under the age of 13. If you are under the age of 13, you may not attempt to send any information about yourself to us, including your name or email address.

5.2 However, where VIP Experiences, school events, and children’s parties are held, we may collect data on those under the age of 13. Where this is the case, it is up to the individual booking the VIP Experience or event to collect consent from either an applicable parent or guardian for those under the age of 13 before submitting any personal data.

5.3 In the event that we confirm that we have collected personally identifiable information from someone under the age of 13 without verification of parental consent, we will delete or destroy that information promptly. If you are a parent or legal guardian of a child under the age of 13 and believe that we might have any information from or about such a child, please contact us at the email or mailing address provided at the end of this Privacy Policy.

6. How your personal data may be used

6.1 We may use your data in the following ways:

• To create your Passport Account.
• To provide a user with our goods and services.
• To provide a user with our content.
• To ensure that content from our Site is presented in the most optimised and effective manner for you and for your computer.
• To diagnose or fix technology problems.
• To control unauthorised use or abuse of our Site and our products and services, or otherwise detect, investigate or prevent activities that may violate our Site policies or be illegal.
• To carry out obligations arising from any interaction entered into between you and Cannon Hall Farm.
• To allow you to participate in interactive features of this service, when you choose to do so.
• To notify you about changes to any service.
• To administer our Site including data analysis, testing, traffic monitoring, research, statistical and survey purposes.
• To provide you with information, products or services that you request or that we feel may interest you, where you have consented to be contacted for such purposes.

6.2 If you do not wish to be contacted for marketing purposes, please tick any relevant box on which you submit your data or unsubscribe from any marketing communication using the unsubscribe function in the footer of the email. You can also unsubscribe from any marketing communication by sending an email info@cannonhallfarm.co.uk.

7. How your data may be disclosed

7.1 To provide our services to you, we may transfer your personally identifiable information to third parties, including parents, affiliates, subsidiaries, and service providers, some of which may process and/or store your personally identifiable information outside of the European Economic Area (“EEA”). However, in such an instance, all reasonable steps will be taken to ensure that your personal data is treated securely and in accordance with this Privacy Policy (where possible). Any data transfers that take place outside of the EEA will be covered by appropriate safeguards, for example, Standard Contractual Clauses (“SCCs”), Binding Corporate Rules (“BCRs”), or Data Transfer Agreements (“DTAs”).

7.2 Third parties to whom your personally identifiable information may be disclosed to include, but are not limited to:

• Stripe – https://stripe.com/gb/privacy.
• AWS – https://aws.amazon.com/privacy/?nc1=f_pr.
• Digital Ocean – https://www.digitalocean.com/legal/privacy-policy.

7.3 Please note that if you click on or follow any links from our Site to external websites, our Privacy Policy will no longer apply. Please check the privacy policies of any such external site before submitting any personal data, as we cannot accept any responsibility or liability in relation to them.

8. Servers

8.1 All information you provide to us will be stored on our UK-based secure servers.

8.2 We take your privacy seriously and will take all reasonable steps to protect your personal data, but please beware that any data that you send to our Site is sent at your own risk.

8.3 The data that we collect from you may be transferred to, processed, and/or stored at a destination outside of the EEA. By submitting your personal data, you agree to this. We will take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

9. Data Storage

9.1 We hold personally identifiable information in a combination of hard copy and electronic files for the period necessary to support our Site, comply with our legal obligations, resolve disputes, or otherwise fulfil the purposes outlined in this Privacy Policy. We use third-party information system providers who may store or have access to your personal information. We may also retain backup information on our servers for some time to comply with applicable law or our internal security policies. We do not always remove or delete all of your information for a number of reasons, including due to technical and system constraints and contractual or legal requirements.

9.2 We operate a data retention period of 7 years (6 years plus one year long-stop) from the date of our last interaction with a user, for example, the last time that they logged into their Passport Account. 7 years after the date of our last interaction with a user, all of the data provided by the user during all of their interactions with us will be reviewed and securely deleted or destroyed.

9.3 No method of transmission over the internet, method of electronic storage, or other security method is one hundred percent secure. Therefore, while we strive to use commercially acceptable means such as firewalls, password-protected databases with limited physical and electronic access, and encryption to protect your personally identifiable information against unauthorised use, disclosure, or modification, we cannot guarantee its absolute security.

10. Data subject rights

10.1 Subject access request – You have the right under DPA’18 to access the information we hold about you. If you wish to exercise this right, please send your request to info@cannonhallfarm.co.uk.

10.2 Right to rectification – You have the right under DPA’18 to request the amendment or updating of all the information that we hold about you. If you wish to exercise this right, please send your request to info@cannonhallfarm.co.uk.

10.3 Right to erasure – You have the right under DPA’18 to have all of the information that we hold about you deleted in line with our statutory and legal responsibilities. If you wish to exercise this right, please send your request to info@cannonhallfarm.co.uk.

10.4 Right to restriction of processing – In line with Article 18 (1) (a) to (d) of UK GDPR, you have the right under DPA’18 to obtain from the controller a restriction of processing. If you wish to exercise this right, please send your request to info@cannonhallfarm.co.uk.

10.5 Right to data portability -You may have the right under DPA’18 to request a copy of all of the information we hold about you if the processing is based on consent or contract, and the processing is being carried out by automated means. If you wish to exercise this right, please send your request to info@cannonhallfarm.co.uk.

11. Enforcement

11.1 We cooperate with the appropriate regulatory authorities, including local data protection authorities (the UK Information Commissioner’s Office (“ICO”)), to resolve any complaints regarding the collection, processing, and disclosure of personally identifiable information that cannot be resolved between Cannon Hall Farm and the individual.

11.2 If you have a concern about your privacy or would like to know more about how your personally identifiable information is collected or used, please contact us. We ask that when you contact us with a complaint, please include contact information and clearly describe your complaint. For any complaints regarding privacy, please email us at info@cannonhallfarm.co.uk.

11.3 We will respond to your request or complaint within a reasonable time and will let you know the next steps in resolving your complaint. If you are not satisfied with our response, you may also contact your local and federal data protection authorities to lodge a complaint.

11.4 Should you not be satisfied with the process, conduct, or response to a request you may have made, you have the right to complain to the ICO (https://ico.org.uk/make-a-complaint/).

12. Notices and provisions

12.1 We reserve the right to change our Privacy Policy at any time. These changes will take immediate effect unless you are notified otherwise. We recommend that you refer to this Privacy Policy on an ongoing basis so that you understand our current practices at the time of using our service. Unless stated otherwise in a separate agreement, this Privacy Policy applies to all information we hold about you.

13. Contact us

13.1 We regularly review our compliance with relevant data protection laws and this Privacy Policy. If you have any questions or want to get in contact with us regarding this Privacy Policy, please feel free to email us at info@cannonhallfarm.co.uk.