Privacy Notice

Spooky Paranormal Investigations Ltd (“SPI”, “we”, “us” or “our”) is committed to handling personal information fairly, lawfully and transparently.

This Privacy Notice explains:

• what personal information we may collect;
• why we use it;
• the lawful bases we rely upon;
• who information may be shared with;
• how long information may be retained;
• how we protect information;
• the rights available to individuals under UK data-protection law; and
• how to contact us about privacy matters.

SPI is the data controller for personal information where we determine why and how that information is processed.

Nothing in this Privacy Notice removes or restricts any rights available under applicable UK data-protection law.

1. WHO WE ARE

The data controller is:

Spooky Paranormal Investigations Ltd

Company number:
16540220

Registered office:
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ

Email:
hello@spookypi.co.uk

Website:
spookypi.co.uk

2. THE PERSONAL INFORMATION WE MAY COLLECT

The information SPI collects depends on how a person interacts with us.

It may include:

• name;
• email address;
• mobile or telephone number supplied for booking and Event administration;
• booking reference;
• Event and ticket information;
• attendee information;
• age or age-related information where relevant to an Event;
• details of a parent or another person who has parental responsibility for the child where an under-18 attendee is permitted;
• accessibility information voluntarily provided so that an adjustment or access requirement can be considered;
• emergency contact information where reasonably required;
• communications sent to or received from SPI;
• complaints and feedback;
• information relating to an incident, accident, safety or safeguarding concern;
• photographs, video or audio where applicable;
• marketing preferences;
• payment-related information made available to SPI by payment or ticketing providers;
• technical information about use of our website; and
• any other information a person chooses to provide to us.

SPI aims to collect only information which is reasonably necessary for the relevant purpose.

3. BOOKING AND ATTENDEE INFORMATION

When a customer books an SPI Event, information may be collected in order to:

• process and administer the booking;
• issue tickets or booking confirmation;
• communicate important Event information;
• manage attendance;
• respond to questions;
• deal with cancellations, transfers, refunds or booking changes;
• manage safety, accessibility or Event-specific arrangements; and
• maintain appropriate booking and financial records.

Where a person books on behalf of another attendee, the booker should provide only information which is reasonably necessary and should make the other attendee aware that their information has been provided to SPI where appropriate.

SPI does not require a customer to provide unnecessary personal information merely in order to browse the website.

Information may come directly from you or, where relevant, from another booker, attendee, witness, Venue, payment or ticketing provider, SPI team member, public authority or other person involved in an Event or enquiry.

4. INFORMATION ABOUT UNDER-18 ATTENDEES

SPI primarily operates adult paranormal investigation Events. Children under 12 are not permitted at any SPI Event.

Selected suitable Events may permit guests aged 12–17 in accordance with SPI’s Age Requirements at SPI Events.

Where an under-18 attendee is permitted, SPI may reasonably process information including:

• the child’s name;
• age or date-of-birth information where necessary to establish eligibility;
• the identity and contact details of the attending parent or other person who has parental responsibility for the child;
• emergency contact information where required;
• information relevant to Event safety or accessibility;
• consent, acknowledgements or communications connected with attendance; and
• safeguarding information where a concern arises.

SPI will not knowingly collect information about children which is unnecessary for the Event or relevant safeguarding, safety, legal or administrative purposes.

Under-18 attendees must remain with a parent or another person who has parental responsibility for the child throughout the Event in accordance with SPI’s Age Requirements and Safeguarding & Child Protection information.

5. ACCESSIBILITY INFORMATION

If you contact SPI about accessibility or participation requirements, we normally need to understand the barrier you may experience and the adjustment or assistance that may help. You do not normally need to provide a diagnosis, medical evidence or detailed medical information.

Please provide only the information reasonably needed for us to consider the adjustment. Information you choose to provide may sometimes reveal details about your health or disability and may therefore be special-category personal data.

For ordinary accessibility information, SPI’s Article 6 lawful basis is normally that processing is necessary to comply with our legal obligations under applicable equality law. Where SPI needs to use or retain health information for this purpose, we will normally rely on your explicit consent as the separate Article 9 special-category condition.

We will use special-category information only where necessary, restrict access to people who need it to arrange the adjustment and avoid retaining unnecessary medical information. Where we rely on explicit consent for health information, you may withdraw that consent.

Further information about Event accessibility is available in SPI’s Accessibility at SPI Events.

6. SAFEGUARDING, SAFETY AND INCIDENT INFORMATION

SPI may process information relating to:

• safeguarding concerns;
• accidents or injuries;
• behavioural concerns;
• alleged misconduct;
• emergency situations;
• complaints;
• reports concerning a member of SPI, another guest, a Venue representative or another person;
• steps taken in response to a concern; and
• communications with relevant authorities or organisations.

In limited circumstances, information recorded in connection with an incident, complaint or safeguarding concern may include allegations or suspected criminal conduct. SPI will only use this information where necessary, proportionate and permitted by data-protection law.

Where an allegation is recorded, the fact that SPI has recorded the allegation does not mean that SPI has concluded that the allegation is true.

Such information may include sensitive or special-category personal information where reasonably necessary.

SPI will handle safeguarding and safety information carefully and will not disclose it more widely than reasonably necessary.

Where lawful and necessary, information may be shared with organisations such as:

• the police;
• emergency services;
• a local authority or safeguarding service;
• a relevant Venue;
• insurers;
• legal or professional advisers; or
• another appropriate person or organisation where reasonably necessary to protect somebody or meet a legal obligation.

Further information is available in SPI’s Safeguarding & Child Protection.

7. PHOTOGRAPHS, VIDEO AND AUDIO

SPI may take or use photographs, video or audio in connection with its Events.

The legal basis will depend on the circumstances and intended use.

Ordinary contextual or documentary Event photography may, where appropriate, be processed on the basis of SPI’s legitimate interests where those interests are not overridden by the rights and interests of the individuals concerned.

Where a person is deliberately featured as the principal subject of promotional photography, an interview, testimonial or similar content, SPI will normally seek specific agreement or consent where appropriate.

SPI takes additional care where under-18 attendees are involved.

Further information is available in SPI’s Photography & Filming at SPI Events.

8. CONTACT AND CUSTOMER-SERVICE INFORMATION

If someone contacts SPI by email, the Contact SPI form, social media or another published communication method, SPI may process information necessary to:

• respond to the enquiry;
• provide customer support;
• investigate a question or complaint;
• maintain a record of relevant correspondence;
• resolve a booking issue;
• consider accessibility or Event arrangements; or
• protect SPI’s legitimate business and legal interests.

SPI may retain correspondence where reasonably necessary for administrative, legal, insurance, safeguarding, complaint-handling or evidential purposes.

9. COMPLAINTS

Where a complaint is made, SPI may process information including:

• the complainant’s identity and contact details;
• booking information;
• details of the complaint;
• information about people involved;
• photographs, video, emails or other evidence;
• investigation notes;
• responses from relevant people;
• decisions and outcomes; and
• communications connected with a review.

SPI may need to share relevant information with people reasonably involved in investigating or responding to the complaint.

SPI will not necessarily be able to disclose personal information about another person or confidential details of action taken.

Further information is available in SPI’s Complaints Procedure.

10. WEBSITE AND TECHNICAL INFORMATION

When someone uses the SPI website, certain technical information may be processed automatically.

Depending on the website configuration, this may include:

• IP address;
• browser type;
• device type;
• operating system;
• date and time of access;
• pages visited;
• referring pages;
• website interaction information;
• security or error logs; and
• cookie or similar-technology identifiers.

Some of this information may be necessary for:

• website security;
• fraud prevention;
• technical operation;
• performance;
• troubleshooting; or
• maintaining the website.

Other analytics or advertising technologies may require consent before they are used.

11. COOKIES AND SIMILAR TECHNOLOGIES

The SPI website may use cookies and similar technologies. Some are necessary for the website to function properly; others may support analytics, advertising measurement, preferences or third-party services.

Where UK law requires consent, non-essential technologies should not be activated until the user has made the relevant choice.

SPI’s Cookies Policy explains the technologies and providers in use, their purposes and the choices available as the website configuration is verified and updated.

12. MARKETING COMMUNICATIONS

SPI may send marketing communications where permitted by applicable law. Where consent is required, SPI will seek a clear affirmative choice, and marketing consent will not be treated as a condition of purchasing a ticket where it is not necessary for the booking.

Marketing communications may include information about future Events, news, offers, updates or other SPI promotions.

You may withdraw marketing consent or unsubscribe at any time. Section 30 explains how to opt out and how this differs from necessary communications about a booking or service.

13. LAWFUL BASES FOR PROCESSING

SPI will only process personal information where a lawful basis is available. The basis depends on the purpose and circumstances; this table summarises the bases most likely to apply to the activities described in this Notice.

Where SPI relies on legitimate interests, we consider whether those interests are overridden by the individual’s rights and interests. Where we rely on consent, it can normally be withdrawn at any time. In a genuine emergency, vital interests may allow necessary processing to protect someone’s life or physical safety.

14. SPECIAL-CATEGORY PERSONAL DATA

Certain information is given additional protection under UK data-protection law. This can include information concerning health, religion, sexual orientation, racial or ethnic origin, or other categories protected by law.

SPI does not seek to collect such information unnecessarily. Where it is processed, SPI will identify both an Article 6 lawful basis and a separate applicable Article 9 condition.

For accessibility-related health information that is reasonably necessary, the Article 6 basis is normally legal obligation under applicable equality law and explicit consent is normally the additional Article 9 condition. Safeguarding, incident, complaint and legal processing may rely on different statutory conditions depending on the circumstances.

Special-category information will only be used where necessary and access will be restricted appropriately.

15. PAYMENT INFORMATION

SPI uses third-party ticketing and payment providers.

Payment transactions may be processed by providers such as the ticketing platform, Stripe, PayPal or another payment service made available at checkout.

SPI does not need to receive or store a customer’s complete payment-card details merely in order for an electronic card transaction to be processed.

Payment providers may process personal information as separate controllers or processors under their own privacy information.

Customers should review the privacy information presented by the relevant provider where appropriate.

16. TICKET TAILOR

SPI uses Ticket Tailor in connection with Event ticketing and booking administration.

Ticket Tailor may process information connected with:

• ticket purchases;
• attendee details;
• booking communications;
• Event management;
• refunds;
• transfers;
• order administration; and
• related ticketing functions.

Ticket Tailor’s own privacy information may also apply to processing which it carries out in its own capacity.

17. REFUND PROTECTION PROVIDER

Where available, customers may be offered optional Refund Protection through a third-party service associated with Ticket Tailor.

This service is separate from SPI’s own cancellation and refund obligations.

Information submitted in connection with Refund Protection or a claim may be processed by the relevant provider under its own privacy terms.

SPI does not determine Refund Protection claims.

The identity of the provider and applicable information will be shown where the service is offered.

18. OTHER SERVICE PROVIDERS

SPI may use trusted service providers to support its operations.

Depending on the services in use, these may include providers of:

• website hosting;
• domain or website services;
• ticketing;
• payment processing;
• email;
• cloud storage;
• forms;
• accounting;
• analytics;
• advertising;
• IT support;
• social media;
• professional advice; or
• other business services.

SPI will only provide those organisations with information reasonably required for the relevant purpose.

Where a provider acts as a processor on SPI’s behalf, SPI will seek to use appropriate contractual and data-protection safeguards.

Some providers may instead act as separate data controllers for aspects of their own service.

19. VENUES AND THIRD PARTIES

SPI Events take place at third-party Venues.

Where reasonably necessary, limited information may be shared with a Venue in connection with:

• access arrangements;
• safety;
• emergencies;
• safeguarding;
• incidents;
• complaints;
• security; or
• another genuine Event-related requirement.

A Venue may independently process information for its own purposes, for example CCTV or its own security arrangements.

Where this occurs, the Venue may be a separate data controller.

20. DISCLOSURE REQUIRED BY LAW OR TO PROTECT PEOPLE

SPI may disclose personal information where reasonably necessary and lawful to:

• comply with a legal obligation;
• respond to a lawful request from a public authority;
• protect someone from serious harm;
• report suspected criminal conduct;
• establish, exercise or defend legal claims;
• protect SPI, its guests or a Venue;
• cooperate with insurers or professional advisers; or
• deal appropriately with safeguarding or safety concerns.

SPI will not disclose personal information more widely than reasonably necessary for the relevant purpose.

21. INTERNATIONAL DATA TRANSFERS

Some service providers used by SPI may process information outside the United Kingdom.

Where personal information is transferred internationally, SPI will seek to ensure that an appropriate lawful transfer mechanism is used where required.

Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another lawful transfer safeguard.

SPI will not state that data remains solely within the UK where this cannot be guaranteed. You may contact SPI at hello@spookypi.co.uk if you would like further information about the safeguards used for a relevant international transfer.

22. ANALYTICS AND ADVERTISING TECHNOLOGIES

SPI may use analytics or advertising technologies to understand website use or measure advertising effectiveness.

These services may process information such as:

• IP address;
• browser and device information;
• pages viewed;
• interactions with the website;
• referral information; and
• identifiers stored in cookies or similar technologies.

SPI expects to configure some analytics and advertising services after the new website has gone live.

For that reason, this Privacy Notice does not state that a particular analytics or advertising provider is currently active unless that has been verified.

Where consent is legally required, non-essential analytics or advertising technologies should not be loaded until the user has made the appropriate consent choice.

The Cookies Policy will identify the relevant providers, purposes, cookies or technologies once the relevant analytics and advertising services have been configured and verified.

23. SOCIAL MEDIA

SPI operates social-media accounts.

Where a person interacts with SPI through a social-media platform, the platform may independently process information under its own privacy terms.

SPI may receive information including:

• public profile information;
• messages;
• comments;
• reactions;
• account usernames; or
• other information voluntarily shared with SPI.

SPI does not control the independent processing carried out by social-media platforms.

24. DATA RETENTION

SPI will not keep personal information for longer than reasonably necessary for the purpose for which it is held.

SPI maintains an internal data-retention schedule setting standard retention and review periods for the principal categories of information we hold. Records are deleted, anonymised or reviewed when their normal retention period expires unless there is a documented reason to retain them for longer, such as an active complaint, safeguarding matter, insurance claim, legal matter or regulatory enquiry.

Retention periods may differ depending on the type of information and the reason it is required.

Factors SPI may consider include:

• the duration of the customer relationship;
• accounting and tax requirements;
• contractual requirements;
• limitation periods;
• insurance requirements;
• safeguarding obligations;
• complaint or dispute handling;
• evidential requirements;
• whether consent remains valid;
• whether an objection has been made;
• whether information retains genuine documentary or historical value; and
• whether continued retention is otherwise lawful and proportionate.

Examples include:

Booking and financial information

May be retained for periods necessary to meet accounting, tax, contractual, legal or insurance requirements.

Customer correspondence

May be retained for as long as reasonably necessary to deal with the enquiry, booking, complaint, dispute or other relevant issue.

Marketing information

May be retained while marketing permission remains valid, together with limited suppression information where needed to respect an opt-out.

Safeguarding information

May require longer retention where necessary for safeguarding, legal, insurance or evidential reasons.

Photographs and media

Raw, duplicate or unused material may be deleted when no longer required.

Selected images or recordings may be retained for longer where they retain genuine documentary, historical or promotional value and continued processing remains lawful.

SPI will periodically review information where appropriate rather than applying one arbitrary retention period to every category of data.

25. DATA SECURITY

SPI will take appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration; or
• disclosure.

The measures used will depend on the type and sensitivity of the information and the systems involved.

No electronic system can be guaranteed to be completely secure.

SPI will therefore take reasonable precautions but does not make an absolute guarantee that a security incident can never occur.

26. PERSONAL DATA BREACHES

Where SPI becomes aware of a personal-data breach, it will assess the circumstances, including:

• what information is affected;
• how the breach occurred;
• the number and type of individuals affected;
• the likely consequences;
• the risk to individuals’ rights and freedoms;
• steps available to contain or reduce the risk; and
• whether notification is legally required.

SPI will keep an appropriate record of personal-data breaches and the action taken.

Where a breach is required to be reported to the Information Commissioner’s Office, SPI will do so without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where UK data-protection law requires affected individuals to be informed, SPI will provide the required information without undue delay.

SPI may also take reasonable steps to investigate, contain, remedy and reduce the risk of recurrence.

27. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, UK data-protection law may give an individual rights including:

• the right to be informed about processing;
• the right of access;
• the right to rectification;
• the right to erasure in certain circumstances;
• the right to restriction of processing in certain circumstances;
• the right to data portability where applicable;
• the right to object to certain processing;
• rights relating to solely automated decision-making where applicable; and
• the right to withdraw consent where processing is based on consent.

These rights are not absolute and legal exemptions may apply. The availability of a particular right depends on the circumstances and the lawful basis on which the relevant information is processed.

SPI may need to verify identity before responding to a request and will normally respond within the timeframe required by UK data-protection law.

Automated decision-making

SPI does not currently use solely automated decision-making which produces legal or similarly significant effects about you.

28. THE RIGHT TO OBJECT

Objecting to legitimate-interest processing

Where SPI relies on legitimate interests, an individual may have the right to object to that processing.

SPI will consider:

• the nature of the processing;
• the reasons for the objection;
• the impact on the individual; and
• whether SPI has compelling legitimate grounds which override the individual’s interests, rights and freedoms or requires the information for legal claims.

An objection does not necessarily mean that all processing must automatically stop, but SPI will assess the circumstances properly.

29. WITHDRAWING CONSENT

Where SPI relies on consent, consent may normally be withdrawn at any time.

Withdrawal does not make processing which occurred lawfully before withdrawal unlawful.

Where withdrawal concerns photographs, video, testimonials or similar content, SPI will take reasonable steps concerning future use.

It may not always be possible to retrieve material which has already been:

• lawfully published;
• printed;
• downloaded;
• shared;
• reposted; or
• distributed by third parties.

SPI will consider reasonable removal from its own controlled channels where appropriate.

30. MARKETING OPT-OUTS

A person can stop receiving SPI marketing communications at any time by:

• using an unsubscribe facility where provided; or
• contacting hello@spookypi.co.uk.

SPI may retain limited suppression information so that the opt-out continues to be respected.

An opt-out from marketing does not prevent SPI from sending necessary communications concerning an existing booking, Event, payment, safety matter or other service requested by the individual.

31. MAKING A DATA-PROTECTION REQUEST

Requests concerning personal information may be sent to:

hello@spookypi.co.uk

It is helpful to explain:

• what right is being exercised;
• what information the request concerns;
• relevant dates or Events where applicable; and
• any information which may help SPI identify the relevant records.

A person does not need to use any particular legal wording.

SPI will not normally charge a fee for exercising data-protection rights.

A reasonable fee may only be considered where permitted by law, for example where a request is manifestly unfounded or excessive.

32. DATA PROTECTION COMPLAINTS

If you believe SPI has handled your personal information incorrectly or has not complied with data-protection law, you can make a data-protection complaint by emailing hello@spookypi.co.uk or by using the Contact SPI form and selecting Complaint or concern.

SPI will acknowledge a data-protection complaint within 30 days of receiving it, investigate the complaint appropriately and without undue delay, keep the complainant reasonably informed where appropriate, and communicate the outcome without undue delay.

Complaining to the ICO

The Information Commissioner’s Office (ICO) is the UK’s data-protection regulator. You may complain to the ICO if you remain dissatisfied with SPI’s response. See the ICO’s Make a complaint information.

Using SPI’s complaints process does not remove or restrict your right to complain to the ICO.

33. LINKS TO OTHER WEBSITES

The SPI website may contain links to websites or services operated by third parties.

SPI does not control the privacy practices of independent third-party websites.

Individuals should review the privacy information provided by the relevant third party where appropriate.

34. CHANGES TO THIS PRIVACY NOTICE

SPI may update this Privacy Notice from time to time to reflect:

• changes in law;
• changes to SPI’s services;
• changes to systems or providers;
• new processing activities; or
• improvements to the information provided.

The current version and latest revision date will be published on the website.

A new version will not be treated as retrospective consent to processing which requires consent.

Where a significant change materially affects individuals, SPI will consider whether additional notice is appropriate.

35. RELATIONSHIP WITH OTHER SPI POLICIES

This Privacy Notice should be read alongside relevant SPI information including:

• Terms & Conditions
• Cancellation, Refund & Ticket Transfer Policy
• Photography & Filming at SPI Events
• Accessibility at SPI Events
• Age Requirements at SPI Events
• Guest Code of Conduct
• Complaints Procedure
• Safeguarding & Child Protection
• Cookies Policy
• relevant Event-specific information

36. CONTACT SPI

For privacy questions, data-protection requests or concerns, contact Spooky Paranormal Investigations Ltd at hello@spookypi.co.uk.

Our company number, registered office and website details are listed in section 1.