5. Special Category Information

Personal data relating to health, physical injuries, disabilities, allergies, pregnancy status, medical needs or rescue and first-aid records may be special category data under UK data protection law and receives additional protection.

Where we process special category data, we will only do so where we have a lawful basis under UK GDPR and a special category condition under Article 9. Depending on the circumstances, this may include explicit consent, vital interests, legal claims, safeguarding obligations, substantial public interest where applicable, or another condition permitted by law.

We use this information only where relevant to activity eligibility, water safety, emergency response, safeguarding, incident management, insurance, legal claims or reasonable adjustments.

Important: Please do not provide medical history or sensitive personal details that are not relevant to safe participation, immediate first aid, emergency response or reasonable adjustments.

6. Children and Young People

Children and young people may only take part in Activities where the relevant age, height, swimming ability, supervision and safety requirements are met.

Where a Participant is under 18, a parent or legal guardian must normally complete the booking and waiver process on their behalf.

We process children’s personal data only where necessary to manage bookings, verify eligibility, record waiver completion, support safety and supervision, respond to incidents, meet safeguarding responsibilities, or comply with legal and insurance requirements.

We do not knowingly allow minors under 18 to create independent booking accounts or register a waiver without appropriate parental or guardian involvement.

If we discover that a minor has provided personal data without appropriate involvement from a parent or legal guardian, we may delete, restrict or update the data as appropriate.

7. Booking Infrastructure and Service Providers

To deliver bookings, payments, communications and website services, we use third-party software and service providers. These providers may include, depending on the services in use from time to time:

• Booking engines and core systems, such as Roller.

• Payment providers, such as Adyen and PayPal.

• Transactional email and service-message providers, such as SendGrid.

• Marketing and customer communication platforms, such as Mailchimp.

• Analytics, advertising and content services, such as Google Analytics, Meta/Facebook Pixel and YouTube.

Where a service provider processes personal data for us, we take steps to ensure that appropriate contractual and technical safeguards are in place and that the provider uses the data only for authorised purposes.

8. Who We Share Personal Information With

We may share personal information with the following parties where necessary and lawful:

• Windsor Lakes site teams: where necessary to coordinate bookings, check-in, site access, visitor facilities, customer service, welfare, incidents or complaints.

• Trading brands and Activity Operators: including Splash Kingdom Windsor, Plastic Playground Wake Park and Windsor Open Water Swim where needed to coordinate packages, verify waiver completion, manage safety, confirm eligibility, investigate incidents or handle claims.

• Professional advisers: including insurers, legal advisers, accountants, auditors and compliance advisers.

• Public authorities and emergency services: including emergency responders, medical responders, safeguarding bodies, police, public health authorities, regulators or other authorities where required or permitted by law.

• Business transfer or restructuring: a successor organisation, purchaser or adviser if the business or its assets are sold, transferred or restructured, subject to appropriate confidentiality and data protection safeguards.

We do not sell your personal data.

9. International Transfers

Some technology providers may store or process personal data outside the United Kingdom or the European Economic Area, including in countries such as the United States or Australia.

Where international transfers occur, we take steps designed to protect your personal data in accordance with UK data protection law. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, Standard Contractual Clauses, or other safeguards permitted by law.

10. Cookies, Analytics and Online Tracking

Our website and booking systems may use cookies and similar technologies to keep your session active, remember items in your basket, maintain security, process transactions, understand website performance and support relevant communications or marketing where permitted.

Essential cookies are needed for the website or booking system to work properly. Non-essential analytics, optimisation or advertising cookies will be used only where the required consent or permission has been obtained through our cookie banner or other consent mechanism.

You can manage cookies through your browser settings. Blocking all cookies may affect the functionality of the website or booking system.

11. Marketing Communications

We will send promotional news, offers or brand updates only where you have given consent or where we are otherwise permitted by law to contact you, such as in relation to similar services you have previously purchased from us.

You can opt out of marketing at any time by using the unsubscribe link in our emails or by contacting us directly.

Opting out of marketing will not stop important service messages, such as booking confirmations, payment confirmations, safety updates, waiver reminders, session changes or closure notices.

12. CCTV, Photography and Filming

CCTV may be used at the Site for safety, security, incident management, crime prevention, staff training, insurance purposes and the proper running of the Site. CCTV is generally used on the basis of our legitimate interests, legal obligations where applicable, and the protection of Customers, Visitors, Participants and staff.

Promotional photography or filming may take place from time to time. Where photography or filming is taking place for promotional or public use, we will take reasonable steps to make Customers aware, such as signage, booking information, announcements or staff communication.

If you do not wish to be included in promotional photography or filming, or do not wish a child in your care to be included, please notify a member of staff before taking part or as soon as reasonably possible.

We will handle visual data in accordance with this Privacy Policy and applicable law.

13. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including to manage bookings, provide services, maintain safety records, comply with legal and accounting obligations, manage insurance matters and protect the business against legal claims.

Financial, transaction and booking records are normally retained for up to 6 years to comply with accounting, tax and company record-keeping requirements.

Waivers, rescue logs, swim-test records, incident reports, safeguarding records and insurance-related files may be retained for longer where necessary, particularly where an incident involves a minor or where a claim may arise.

CCTV and visual data are retained only for as long as necessary for the purpose for which they were collected, unless they are needed for an incident, complaint, investigation, insurance matter or legal claim.

When data is no longer needed, we will delete, anonymise or securely destroy it.

14. Data Security Controls

We use technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, misuse, alteration or disclosure. These may include access controls, password protection, secure systems, staff training, processor due diligence and encrypted transmission where appropriate.

No digital system can be guaranteed to be completely secure. If you believe your data or account security has been compromised, please contact us as soon as possible.

Where required by law, we will notify the Information Commissioner’s Office and/or affected individuals about a personal data breach.

15. Your Legal Data Rights

Under the UK GDPR, you may have the following rights regarding your personal data:

• Right of access: to request a copy of the personal data we hold about you.

• Right to rectification: to ask us to correct inaccurate or incomplete personal data.

• Right to erasure: to ask us to delete personal data where there is no lawful reason for us to keep it.

• Right to restriction: to ask us to restrict processing in certain circumstances.

• Right to object: to object to processing based on legitimate interests or direct marketing.

• Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format.

• Right to withdraw consent: where consent is the lawful basis for processing, to withdraw that consent at any time.

To exercise your rights, please contact us using the details in Section 1. We may request proof of identity before processing your request to protect your data from unauthorised disclosure.

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by telephone on 0303 123 1113.

16. Consequences of Not Providing Information

Some information is required so that we can process bookings, manage waivers, confirm activity eligibility, provide emergency contact details, meet safety requirements, comply with legal obligations and provide the requested service.

If you choose not to provide information that is required for booking, safety, waiver, emergency contact, eligibility or legal purposes, we may be unable to complete your booking, permit participation, provide the relevant service or allow access to the relevant Activity. Any refund, credit or rebooking will be considered in accordance with the applicable Terms & Conditions.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operations, technology, legal requirements or data protection practices. The current version will be made available through our website footer and checkout links where applicable. If a material update significantly affects your data rights, we will take reasonable steps to notify you.

18. Contact Details

Windsor Lakes
Horton Road
Datchet
Berkshire
SL3 9HY
Email: info@windsorlakes.co.uk
Website: www.windsorlakes.co.uk