Through its commitment to its core values, Merlin Entertainments Limited "Merlin" who is the operator of this attraction, acknowledge and support an individual's right to privacy and use appropriate measures and practices to ensure personal data is protected. As a global entertainments service provider, which operates more than 100 attractions and 20 hotels and resort villages across 30 countries, Merlin fulfils many roles as a trusted employer, services supplier, partner and customer. The registered office for Merlin Entertainments is Arbor Building, 16th Floor, 255 Blackfriars Road, London, SE1 9AX, United Kingdom.

A list of our attractions and group companies can be found on the Merlin corporate website. This Privacy Notice describes how Merlin and its Affiliates (companies that are directly or indirectly controlled or owned by Merlin) collect, use and disclose personal information. Please read this Privacy Notice carefully. 

It provides important information about how we use personal data and explains your legal rights. This Privacy Notice is not intended to override the terms of any contract that you have with us (for example, Wi-Fi terms and conditions or annual pass terms) or any rights you might have available under applicable data protection laws. We may make changes to this Privacy Notice from time to time for example, to keep it up to date or to comply with legal requirements or changes in the way we operate our business. We will strive to make sure that you are aware of any material changes by sending an email message to the email address you most recently provided to us or by posting a notice on each relevant website so that you are aware of the impact to the data processing activities before you continue to engage. 

We encourage you to regularly check back and review this so that you will always know what information we collect, how we use it, and who we share it with. The entity in the Merlin Group which was originally responsible for collecting information about you will be the Data Controller. 

Other entities in the Merlin Group may also be Data Controllers where they control the use or processing of such data. To exercise your data subject rights or to contact Merlin, please refer to the relevant sections found later in this Notice .

When do We Collect Your Data

We collect information directly from you when:

• you visit and navigate our websites

• you complete forms on our website to book visits to our attractions

• you complete surveys on our website

• subscribe to a service

• opt-in to receiving marketing communications

• purchase tickets or passes

• make a booking by telephone

• visit our attractions (CCTV)

• login to the Wi-Fi at our attractions

• make a hotel booking

• make a complaint or provide feedback

• or request further information.

We may receive some personal information from third parties, such as:

• family members or legal guardians

• promotional partners

• payment providers

• third party merchants etc.

We never knowingly collect personal information from children under 13 for marketing purposes without parental consent, as required by law.

What Personal Information We Collect

We may collect contact information to communicate with you about our services and your bookings. This may include your name, postal address, telephone number, email address, date of birth or social media profile name. We collect information directly from you when you complete surveys or forms on our website to book visits to our attractions, subscribe to a service, purchase tickets, make a hotel booking or requesting further information.

Payment Information

When you submit payment details for any of our services we may receive financial information about you or the company on behalf of which you are making the payment. This transaction data may include: bank name, bank address, account number, sort code, security code, card expiration date.

Purchasing & Marketing Information

We collect data regarding your shopping and visit history as well as your marketing preferences and interests. This includes the collection of contact details such as your name, address, date of birth, telephone number and email address, engagement details including your purchase history and attraction visit history, your marketing preferences including interests / marketing list assignments, record of permissions or marketing objections, website data, device data including IP addresses and details about your browsing history, browser type, and session frequency and cookies.

Where we require explicit opt-in consent for direct marketing in accordance with the Privacy and Electronic Communications Regulations we will ask for your consent. Otherwise, for non-electronic marketing or where we can rely on the soft opt-in exemption under the Privacy and Electronic Communications Regulations, we will be relying on our Legitimate Interests for the purposes of GDPR.

You have a right to stop receiving direct marketing at any time - you can do this by following the opt-out links in electronic communications (such as emails), or by exercising your right to erasure as detailed later in this Notice.

We also use your personal data for customising or personalising advertisements, offers and content made available to you based on your visits to and/or usage of our attraction websites or other mobile applications, platforms or services, and analysing the performance of those advertisements, offers and content, as well as your interaction with them. We may also recommend content to you based on information we have collected about you and your viewing habits. This constitutes 'profiling', and more information is provided later in this Notice about this.

Profiling and Automated Processing

'Automated Decision Making' refers to a decision which is taken through the automated processing of your personal data alone - this means processing using, for example, software code or an algorithm, which does not involve any human intervention. We do not carry out any automated decision making, however we do carry out profiling using automated processing to tailor marketing materials for a specific customer.

Where we have permissions to send a consumer marketing updates, we may use profiling to ensure that marketing materials are tailored to your preferences and to what we think you will be interested in.  In certain circumstances it will be possible to infer certain information about you from the result of profiling, which could include special categories of personal data, but we will not do this unless we have obtained your explicit consent to do so.

We may use software and tools containing Artificial Intelligence (AI), for business efficiency and analytical purposes. AI may be used: 

• To analyse emails/content you have provided to Merlin such as suggesting responses we provide to guests and to help with managing the content internally such as providing a summary of an email. Where used, all responses are viewable by Merlin prior to being issued and personal data is only used in line with the original purposes for which it was provided and/or processed in accordance with this notice 

• To direct your support requests via the initial engagement with a support chatbot - we will inform you when you are engaging with a chatbot before communication commences. 

• By our vetted supply chain in their product and service offerings 

• To provide insights into your personal preferences and may use analytics tools to analyse the effectiveness of advertisements 

• To automate processes within our attractions to improve guest experience 

• For analysing and processing data to improve efficiencies within processes 

• To analyse data in relation to business performance and strategic initiatives 

• Where you have agreed to take part in a meeting, either at our offices or remotely, e.g. using Teams. AI may be used to help with summarising and analysing the meeting content and enabling real-time translation. 

If inputting any personal data (where necessary and lawful to do so) in connection with such AI tools Merlin will ensure compliance with data protection legislation and regulatory requirements. 

System and Application Information

We collect personal data when you visit any of our websites or use our applications including IP addresses, browser data, location, traffic data, social media behaviour and user patterns, recordings of calls to our service centres, email communications, online chats, comments and reviews collected through surveys or posted on our social media platforms. 

Physical security records:

• CCTV - will be used for safety and security monitoring of staff, company property and assets.

• Bodycam footage will be used for safety and security monitoring of staff, company property and assets.

• Biometric data (facial recognition) will be collected to identify the correct individual in ride photographs or for security purposes on some sites

• Photographs: images will be used on passes to identify individual owners and for promotional means in some instances, photography services are in place at some of our attractions and rides

• Automatic Number Plate Recognition (ANPR): details of vehicle registration numbers will be collected from some sites

• Some of the personal information that we collect about you or which you provide to us about you and your family may be classified as special category data. We will only process special category data where we have an additional lawful basis for processing.

Why we collect your personal information

We may collect, use and store your personal information for the following reasons:

• provide you with the products, services or information you request from Merlin, and for related purposes such as delivering customer service, handling queries and complaints, establishing and maintaining contractual relations, complying with industry and regulatory standards;

• to operate electronic payment processes;

• based on your choices and previous behaviours, deliver marketing communications, offers and newsletters to you;

• to show you advertising on social media that is tailored to you

• to profile potential audiences on social media and online platforms;

• to monitor entry onto our sites and ensure effective management of the health and safety of our staff, guests and facilities;

• support our everyday business purposes, such as for account management, quality control, website administration, business continuity and disaster recovery, security and fraud prevention;

• corporate and business forecasting, reporting, analysis, and insight, to include business development requirements, management and operational reporting, in accordance with business growth, operational activities, and the provision of our services to clients;

• considering and implementing mergers, acquisitions, reorganizations, bankruptcies, and other business transactions;

• business management to include accounting, auditing, insurance and compliance assessments;

• understand how you and others use our services, for analytics and modelling and to create business intelligence and insights and to understand economic trends and develop better experiences for our guests;

• generate anonymised or aggregated datasets, which are used for product development;

• governance, reporting and legal compliance;

• establishing, exercising or defending our legal rights; and otherwise, for the lawful operation of our business;

• CCTV monitoring and other security of company facilities;

• ensuring adequate insurance coverage for our business;

• business management to include accounting and auditing;

• security threat detection and monitoring. 

Legal Basis for Personal Information Use

We need to have a legal basis for using your personal information for the processing set out in this privacy notice as set out below: 

1. our use of your personal information is necessary for the performance of our obligations under our contract with you; 

2. or our use of your personal information is necessary for complying with our legal obligations

3. or our use of your personal information is necessary to protect an individual’s vital interests (for example if there is a danger to life);

4. or where neither (a) nor (b) apply, it is necessary for the purposes of our legitimate interests or the legitimate interests of a third party (for example, to ensure a safe working environment, to ensure the reliability of our employees, workers and contractors or to maintain adequate personnel records). 

5. Where the processing is necessary to protect your vital interests in an emergency situation. We will also collect information about you indirectly from other sources where we believe this is necessary to help ensure the security of our attractions. These other sources may include public registers and social media platforms.

Children's Personal Information

We recognise our responsibility to provide suitable privacy protection to personal information we collect from children under 13. Some of the services we offer or features of our site are not aimed to be used by children and for those we do not knowingly collect personal information from children under 13.

When we do intend to collect personal information about children under 13, we put in place a number of measure to protect that child’s privacy such as:

• notifying parents and/or guardians about the processing and obtaining consent where necessary 

• ensuring any data collected is kept to a minimum

• where permitted by law, allowing parents/legal guardians the right to request the personal information collected about their child and ask for such to be amended or deleted. 

Disclosure of Personal Information

Your personal data may be made available to Merlin employees, temporary staff, workers and contractors, and with customers, agencies, investors and suppliers in the course of providing our services. Your personal data may be shared with any company that is a member of our group, where we have a lawful basis upon which to do so for example internal administrative purposes, corporate strategy, auditing and monitoring. We may also share your personal information with our group companies where they provide products and services to us, such as information technology systems, health and safety monitoring, security services and human resources services. Access to your personal information is limited to those employees who need to know the personal data and any international data transfers are managed by Merlin's Intragroup Data Transfer Agreement.

We may share your personal information with the following categories of third parties:

• companies that provide products and services to us, such as: 

• investors;

• insurance companies, including those providing medical insurance and group income protection;

• legal and regulatory authorities, accountants, auditors, lawyers and other outside professional advisors.

• information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up and disaster recovery and cyber security services; psychometric testing providers and other outsourcing providers, such as off-site storage providers and cloud services providers. Some examples of the service providers that Merlin use are outlined below:

  • Customer Relationship Management providers, in particular Salesforce, Experian, Accesso, Avius Insight, Zendesk, Venue Verdict, Sprint Education and Facebook.

  • our app team, Attractions.io

  • our website development agencies, Isobar, CTI Digital and Headland

  • our PR agency, The Academy PR

  • our printing agency, Adare International

  • our ride photography partner POMVOM

We will also disclose your personal information to third parties:

• where it is in our legitimate interests to do so to run, grow and develop our business, for example:

• if we sell or buy any business or assets, we may disclose your personal information to the prospective seller or buyer of such business or assets;

• if Merlin or substantially all of its assets are acquired by a third party, in which case personal information held by Merlin will be one of the transferred assets;

• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;

• to enforce our contract with you, to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent any illegal activity; or

• to protect the rights, property or safety of Merlin, our employees, workers and contractors, customers, suppliers or other persons.

• If Merlin transfers or sells any of its assets (such as attractions), personal information held by Merlin for those attractions may be transferred as part of the transaction. Only required personal information will be transferred and could include but is not limited to, your name, email address, phone number, postal address, and details of any ticket purchases. Prior to any such transfer, Merlin will inform affected individuals and provide clear information regarding the nature of the personal information being transferred, the identity of the acquiring party, and the purpose for which the data will be used.
  You will always have the option to unsubscribe from communications or refuse the transfer of your personal data. We will ensure that mechanisms are in place to exercise these rights easily and promptly.
  
  

Any third parties with whom we share your personal information are limited (by law and by contract) in their ability to use your personal information for the specific purposes identified by us. We will always ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this privacy notice and applicable laws.

We are a global company and may transfer the personal data we collect about you internationally to our group companies or third parties, so long as there is a lawful basis for doing. For transfers between Merlin group entities an intragroup agreement is in place. In certain limited circumstances we may seek your explicit consent to send your personal data. We may also share your personal data overseas, for example if we receive a legal or regulatory request from a foreign law enforcement body. Before sending your personal data internationally, we will ensure that appropriate safeguards are in place to protect your data and that all transfers are carried out in compliance with your rights and interests. In particular we will either:

• only transfer your personal data to countries which are recognised as providing an adequate level of legal protection in accordance with Article 45 of the GDPR; or

• ensure that transfers outside the European Union are subject to an appropriate legal safeguard - for example, the EU Model Clauses pursuant to Article 46(2) of the GDPR

Your Rights

The following rights can be exercised directly or, in certain cases, through an authorized agent and are determined by local legislation as set out below.

To exercise your data subject rights, including Subject Access Requests, please complete the request form.

For further information on what data subject rights are offered, please refer to the below:

Please note the following if you do wish to exercise these rights:

• We take the confidentiality of all records containing personal data seriously, and reserve the right to ask you for proof of your identity if you make a request.

• We will not ask for a fee to exercise any of your rights in relation to your personal data, unless your request for access to information is unfounded or excessive, in which case we will charge a reasonable amount in the circumstances.

• We aim to respond to any valid requests within one month unless it is particularly complicated or you have made several requests, in which case we aim to respond within three months. We will let you know if we are going to take longer than one month. We might ask you if you can help by telling us what exactly you want to receive or are concerned about. This will help us to action your request more quickly.

• Local laws may provide for additional exemptions, in particular to the right of access, whereby personal data can be withheld from you in certain circumstances, for example where it is subject to legal privilege.

• You also have the right to complain to your supervisory authority (further details of which are set out in our Complaints section below)

Retention of Personal Information

We retain your personal data for as long as needed, or permitted, based on the reason we obtained it (consistent with applicable law and to support legitimate business purposes). When deciding how long to keep your personal data, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period before we can delete them) or whether we have taken any legal positions (e.g., issued any legal holds or otherwise need to preserve the information). Rather than delete your data, we may also deidentify it by removing identifying details. If we deidentify the data, we will not attempt to reidentify it.

Security

Merlin has implemented safeguards that are intended to protect the confidentiality of your personal information and we are a "PCI DSS" (The Payment Card Industry Data Security Standard) approved organization. 

You may, from time to time, access links to or other websites operated by third parties (e.g. competition providers, industry news sources, sales portal, feedback surveys etc). Please note that this privacy notice only applies to the personal information that we collect from or about you and we cannot be responsible for personal information collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer. Cookies contain information that is transferred to your computer's hard drive. 

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.

• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies. These cookies are likely to be analytical/performance cookies or targeting cookies. You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site. You can opt-out of optional cookies which you can exercise by using the consent banner when you first visit one of our attraction's webpages.

Contact and complaints

If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights, please contact our Data Protection Team - email Data.Protection@merlinentertainments.biz  or write to: 

Data Protection Officer

Merlin Entertainments

Arbor Building, 16th Floor, 

255 Blackfriars Road, 

London, 

SE1 9AX, 

United Kingdom

We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal information.

You also have a right to lodge a complaint with your national data protection supervisory authority at any time. 

In the UK, the supervisory authority for data protection is the ICO (https://ico.org.uk). We do ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.  

For any other queries or complaints not relating to data protection, please refer to the attraction's "Contact Us" link at the bottom of this page.

Information on Joint Controllership

In certain specific instances, as set out below, this attraction acts as a Joint Controller of your personal data with Merlin Attractions Operations Ltd (hereinafter "MAOL"), which is also part of the Merlin Entertainments Limited Group and whose registered office is at Arbor Building, 16th Floor, 255 Blackfriars Road, London, SE1 9AX, United Kingdom (hereinafter, for convenience, collectively referred to as the "Joint Controllers").

As of the date of publication of this privacy notice, this attraction operates under joint controllership with MAOL its Customer Relationship Management (CRM) platform. For further information on this relationship, please refer to the privacy notice on the Merlin corporate website.

APPENDIX 1 - Glossary

Consumer: means an individual who will, who has, or who is purchasing tickets for an Attraction or using Merlin's websites, goods or services, or participating in a prize draw/competition or Merlin experience.

Data Controller: means a natural or legal person which determines the means and purposes of processing of personal data.

Data Subject: means an individual whom the personal data is about.

EEA: means the European Economic Area.

GDPR: means the General Data Protection Regulation 2018.

ICO: the Information Commissioner's Office regulates the processing of personal data by all organisations within the UK.

Legitimate Interests: this is a ground which can be used by organisations as a lawful basis of processing, for example where personal data is used in ways that could reasonably be expected, or there is a compelling reason for the processing.

Member States: means those countries which are part of the European Union.

Data Privacy Framework: means a framework which has been adopted to protect the rights of those individuals whose data has been transferred to the US.

Profiling: means to analyse your personal data in order to evaluate your behaviour or to predict things about you which are relevant in an entertainment context, such as how likely you are to attend a certain event that we host.

Special Categories of Data: means any personal data relating to your health, genetic or biometric data, criminal convictions, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership.

Service Providers: these are a range of third parties to whom we outsource certain functions of our business. For example, we have service providers who provide / support 'cloud based' IT applications or systems, which means that your personal data will be hosted on their servers, but under our control and direction. We require all our service providers to respect the confidentiality and security of personal data.

APPENDIX 2 - Details of Processing of Guest Data

At Merlin Entertainments, depending on the attraction we will rely upon the following lawful basis for our data processing.