Privacy Policy

Sample wording for the demo. CrackingDay will review and replace it before these sites go live.

Who we are

CrackingDay Limited (company number 06401570, registered office 47 South Road, Horndean, Hampshire, PO8 0EW) runs UCAP Airsoft, Gloucester & Dorchester Prison Events & Experiences and CrackingDay. We're the data controller for the personal information described here, whichever of these websites you use, and we're registered with the Information Commissioner's Office.

What we collect

• Account details: your name, email address, date of birth, postal address and password. We store the password only as a one-way hash.
• People you book for: each attendee's name and date of birth, and their email address if you give it so we can send their waiver link.
• Bookings without an account: the buyer's name and email address.
• Safety information: an emergency contact and any medical notes you choose to give us.
• Waivers and consents: the wording you agreed to and its version, the date, the name, date of birth and address you signed with, and your on-screen signature.
• Payments: what you bought, the amount and a payment reference. Stripe handles your card details; they never reach our systems.
• Your visit: whether each attendee checked in, and whether they signed a paper waiver on the day.
• Restrictions: if someone is restricted from an activity, the reason and any end date. For a ban, we keep a coded version of the email address rather than the address itself.
• Technical information: your IP address, used briefly to stop repeated or automated attempts at signing in and booking, and a sign-in cookie for each of our websites.

Why we use it

• To take and manage bookings, send confirmations, receipts, waiver links and reminders, and run check-in: this is necessary for our contract with you.
• To keep attendees safe, check ages and hold emergency and medical details: our legitimate interest in running safe events, and our health and safety obligations.
• To keep financial records and signed waivers in case of a claim: our legal obligations and our legitimate interest in defending claims.
• To stop fraud and misuse, including automated bookings: our legitimate interest in protecting our customers and our business.
• We don't send marketing emails.

Children

Under-18s are booked by a parent, guardian or other responsible adult, who gives their details and, where an experience needs one, signs their parental consent. We hold only what we need to run the booking and keep them safe.

Who we share it with

• Stripe, which takes card payments on our behalf.
• Cloudflare, whose Turnstile check sees your IP address and browser details at checkout to tell people from automated bookings.
• Our email provider, which delivers the emails we send you.
• Our hosting provider, which stores our data.
• Our staff and marshals, who see what they need to run the day.
• Insurers, advisers or the authorities, where the law requires it or a claim makes it necessary.

We don't sell your personal information. Stripe and Cloudflare may process data outside the UK, using the safeguards they have in place for international transfers.

How long we keep it

• Your account stays while you use it. We delete it six years after the later of your last event and the expiry of your last waiver. An account that has never been used for a booking or waiver is deleted after a year without a sign-in.
• Details of attendees booked by name are cleared six years after their event, and details of buyers without an account six years after they booked.
• Details on bookings that were never paid are cleared after seven days.
• Waivers signed through a ticket's link are deleted seven years after signing.

Six years matches the time limit for most legal claims.

Your rights

You can ask to see, correct or delete your information, to restrict or object to how we use it, and to receive it in a portable form. Account holders can download their data from the privacy section of their account. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies

Each of our websites sets one essential cookie to keep you signed in. At checkout, Stripe and Cloudflare may set their own cookies to prevent fraud. We don't use advertising or tracking cookies.

Changes

We'll update this policy when how we use information changes, and tell account holders about significant changes.

Contact

CrackingDay Limited, 47 South Road, Horndean, Hampshire, PO8 0EW. Phone 0330 111 8227.