10. HOW WE PROCESS YOUR PERSONAL DATA
We only process your personal data when allowed to do so by law. Most commonly, we will process your personal data:
• With your consent and please note that you have the right to withdraw your consent at any time by contacting us.
• Where we need to perform a contract we are about to enter into, or have entered into, with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.
The below table sets out how we process your personal data. Please contact us if you would like further information about the specific basis for processing.
10A
Activity
To process and deliver a product or service that you have ordered from us, including:
• online orders or orders at one of our sites
• gift card purchases
• when we issue a refund
• to manage the payment, fees and charges
• to collect and recover money owed to us
• any other contractual arrangement that we agree to enter into with you
Personal Data
• Identity Data
• Contact Data
• Financial Data
• Transaction Data
• Children’s Data (only as required for booking children’s parties and events)
Basis for Processing
• Performance of a contract with you
• Necessary for our legitimate interests, being to recover debts due to us or, in the case of Children’s Data, to provide an event tailored to your child
10B
Activity
To process your registration with us including:
• to receive news, offers, promotions and updates
• to receive a voucher
• to make full use of our apps
• when you otherwise register as one of our customers
Personal Data
• Identity Data
• Contact Data
• Profile Data
Basis for Processing
• Performance of a contract with you
10C
Activity
To tailor our direct marketing to you and to send you direct marketing communications including via:
• Email
• SMS
• Push Notifications
Personal Data
• Identity Data
• Contact Data
• Technical Data
• Transaction Data
• Usage Data
• Profile Data
• Marketing and Communications Data
Basis for Processing
• In terms of tailoring our direct marketing, necessary for our legitimate interests, being to develop our business and inform our marketing strategy.
• In terms of sending direct marketing where you are a customer and have not previously opted out of receiving such direct marketing, as necessary for our legitimate interests, being to offer you relevant products and services related to what we have previously provided to you.
• In terms of sending direct marking where you are not one of our customers, with your consent given when you sign up to our mobile app, website or otherwise give your details and provide consent when doing so.
10D
Activity
To enable you to take part in prize draws, competitions or surveys.
Personal Data
• Identity Data
• Contact Data
• Usage Data
• Profile Data
• Marketing and Communications Data
Basis for Processing
• Performance of a contract with you
• Necessary for our legitimate interests, being to study how customers use our products and services, to develop them and grow our business.
10E
Activity
To understand our customers, matching common information from various sources to build a profile of you; this may include:
• understanding your habits, where you are from time to time, your personal circumstances and those of your family or household, and the things you may like, dislike and be interested in.
• the ways you interact with us, such as subscribing to news, offers, promotions and updates, booking tables, completing surveys, entering competitions, using our Wi-Fi, mobile apps, browsing website pages, interacting – e.g. by likes and comments – with our social media accounts and reviewing our products and services in public forums.
• creating Aggregated Data.
Personal Data
• Identity Data
• Contact Data
• Technical Data
• Transaction Data
• Usage Data
• Profile Data
• Marketing and Communications Data
• Children’s Data (limited to data concerning use of our WiFi by children aged 13+)
Basis for Processing
• Necessary for our legitimate interests, being to develop our business, products, services, content and advertising campaigns to make these relevant for you, and tracking the effectiveness of our advertising campaigns.
10F
Activity
To manage our relationship with you, which includes:
• to notify you about changes to our privacy policy.
• to communicate with you about operational changes to our products, services, websites and mobile apps, for example if we were to withdraw one of our apps.
• to gather feedback from you about our brands, websites, mobile apps and other services and activities from time to time.
• to respond to, deal with and address any questions, suggestions, issues or complaints you have raised and reporting and analysis in respect of these.
• to respond to any social media reviews, posts or other public comments you make about us, our brands, websites, mobile apps, services or other activities
Personal Data
• Identity Data
• Contact Data
• Profile Data
• Marketing and Communications Data
• Sensitive Data (only as required for dealing with feedback and complaints about specific issues)
• Children’s Data (only as required for dealing with feedback and complaints for specific issues)
Basis for Processing
• Performance of a contract with you.
• Necessary to comply with a legal obligation.
• Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
10G
Activity
To administer and protect our business and website and offer safe and secure use of our products and services, which includes:
• the process of anonymising your information so that you are no longer identifiable to us, where we no longer need your data in an identifiable form.
• to provide safe access to our websites, mobile apps and Wi-Fi networks.
• to power user security measures and services, such as recognition of your usernames and passwords, as well as reset functions.
• to monitor security measures around our websites, mobile apps and Wi-Fi networks to check they are not being abused or threatened.
• to protect you and our business against potential criminal behaviour, such as fraud.
• to administer troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data.
Basis for Processing
• Performance of a contract with you.
• Necessary for our legitimate interests, being to run our business, ensure network security and prevent potential criminal behaviour.
• Necessary to comply with a legal obligation.
10H
Activity
To provide information to legal and regulatory bodies where we are under a legal or regulatory obligation to do so.
Personal Data
• Identity Data
• Contact Data
• Technical Data
• Transaction Data
• Usage Data
• Profile Data
• Marketing and Communications Data
• Sensitive Data
• Children’s Data
Basis for Processing
• Necessary to comply with a legal obligation.