Access

You can ask us to:

·   confirm whether we are processing your personal data;

·   give you a copy of that data;

·   provide you with other information about your personal data such as what data we have, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we have carried out automated decision making or profiling, to the extent that information has not already been provided to you in this Policy.

Rectification

You can ask us to rectify inaccurate personal data. We may seek to verify the accuracy of the data before rectifying it.

Erasure / Right to be Forgotten

You can ask us to erase your personal data, but only where:

·      it is no longer needed for the purposes for which it was collected; or

·      you have withdrawn your consent (where the data processing was based on consent); or

·      it follows a successful right to object (see 'Objection' below); or

·      it has been processed unlawfully; or

·      it is necessary to comply with a legal obligation which Merlin is subject to.

We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary: for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims, in relation to the freedom of expression or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In the context of marketing, please note that we will maintain a suppression list if you have opted out from receiving marketing content to ensure that you do not receive any further communications.

Restriction

You can ask us to restrict (i.e. keep but not use) your personal data, but only where:

·      its accuracy is contested (see 'Rectification' below), to allow us to verify its accuracy; or

·      the processing is unlawful, but you do not want it erased; or

·      it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or

·      you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal data following a request for restriction, where:

·      we have your consent; or

·      to establish, exercise or defend legal claims; or

·      to protect the rights of another natural or legal person.

Portability

You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it 'ported' directly to another Data Controller, but in each case only where: the processing is based on your consent or the performance of a contract with you; and the processing is carried out by automated means.

Objection

You can object to any processing of your personal data which has our 'Legitimate Interests' as its legal basis (see Appendix 2 for further details), if you believe your fundamental rights and freedoms outweigh our Legitimate Interests. Once you have objected, we have an opportunity to demonstrate that we have compelling Legitimate Interests which override your rights, however this does not apply as far as the objections refers to the use of personal data for direct marketing purposes.

Activity

Purpose for processing

The lawful basis we rely on

Service Delivery

To provide guests with the products, services or information you request from Merlin, and for related purposes such as delivering customer service, handling queries and complaints, establishing and maintaining contractual relations.

Merlin will process your personal data in accordance with its legal obligations and legitimate interests to deliver its services to you.

Operating Competitions, Prize Draws and other Promotions

To administer competitions and rewards to our guests we may use our website and social media accounts

It is necessary for Merlin to use your personal data to perform our obligations in accordance with any contract that we may have with you or where it is in our legitimate interest to use your personal data to enable us to administer a Merlin competition or promotion effectively and fairly in line with our own business practices. 

Payment Services

To operate electronic payment processes  

We have legal and regulatory obligations to ensure that we process certain personal data when facilitating payment transactions.

Photography and Film

Some attractions offer photography services during your visit.

Where relevant for publishing appropriate internal or external communications or publicity or marketing material including via social media in appropriate circumstances;

The company also has a legitimate interest in promoting and marketing its brand, whether to prospective employees or prospective customers, both of which support the Company's immediate and long-term business goals and outcomes. 

Guests have the option to purchase their own photographs at certain attractions. Notices are in place where photography services are in operation.

Deliver marketing communications by email, offers and newsletters to you

To deliver marketing communications, offers and newsletters to you .

Merlin will rely upon your explicit consent to send you marketing material. All of Merlin’s marketing correspondence has the option for you to ‘unsubscribe’ from our communications, at any time.

Merlin and its third party partners may show you advertising on social media, that is tailored to you.

If you are a user of social media, Merlin may ask the third-party providers of those platforms to find other registered users of their services who share similar interests and characteristics to you, which will be based on information that the third party holds about you and other registered users of its platform. This is known as advertising to a ‘lookalike’ audience advertising because Merlin are seeking to advertise to other people who ‘look like’ you. This advertising method is based on data that you as user of social media have provided to the platform independently and is also dependent upon the privacy settings you have associated to your social media account.

(for more information click here) 

All Facebook users have the opportunity to set their preferences for their marketing options.

Where we use your personal data to display online personal advertising to you, we rely on the consent or our legitimate interests to promote our website and services and/or attractions to you.

We will only share your Personal Data with the third-party providers of any social media platform so that we can advertise our available services to you when you use those platforms only where you have provided your consent or where it is otherwise in our legitimate interests to do so in order to promote Merlin services.

Safety and security including the use of CCTV at our attractions; satisfying the Company's regulatory or other obligations preventing, detecting and investigating a wide range of activities and behaviours and liaising with regulatory authorities

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including health and safety laws, our duty of care and regulatory laws to which the Company is subject.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring that its business, guests, employees and systems are protected and that action is taken to mitigate risk and to prevent and detect matters which may put the Company or its business or stakeholders at risk. 

This includes carrying out risk assessments; detecting and preventing crimes or criminal activity or other unlawful or unethical activity; ensuring that only appropriate employees are engaged in our business; and ensuring compliance other legal or regulatory requirements placed upon us or related official guidance.

It also includes providing ways to report conduct or compliance issues and the appropriate consideration and investigation of matters drawn to the Company's attention.

It also includes facilitating, controlling and restricting access to appropriate locations and systems. To be effective these must be monitored and kept up to date. Effective business protection is important for business continuity and to protect the Company's reputation. This supports the Company's immediate and long-term business goals and outcomes.

Some of our attractions have automatic number place recognition in place to monitor entry to our car park facilities

Depending on local laws, we will rely upon consent, performance of a contract or legitimate interest to process this information.

Protecting the private, confidential and proprietary information of the Company, its employees, its guests and third parties

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring that its business, guests, employees and systems are protected.

This includes protecting our assets and the integrity of our systems; and detecting and preventing loss of confidential and proprietary information.

This is also important to comply with our obligations to our guests and staff to protect their information.

Effective business protection is important for business continuity and to protect the Company's reputation. This supports the Company's immediate and long-term business goals and outcomes.

Complying with laws and regulation applicable to the Company

This processing is necessary for the compliance with legal obligations to which the Company is subject including those laws set out.

Planning, due diligence and implementation in relation to a commercial transaction or service transfer involving the Company that impacts on your relationship with the Company

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its business operations in the most effective way. The Company needs to make decisions relating to the future of its business in order to preserve its business operations or grow its business or maximise efficiency and effectiveness.

In the event that the Company makes a decision to outsource a function or acquire or transfer a business or part of a business the Company and the third party with whom the Company is seeking to transact each have a legitimate interest in ensuring that the services offered to guests are upheld throughout any transition period.

Business change programmes and transformation support business continuity and improvement and support the Company in achieving its long-term business goals and outcomes. 

For business operational and reporting documentation such as accounting, auditing, insurance, compliance assessments, business development requirements, management and operational reporting, in accordance with business growth and operational activities

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including statutory Company reporting obligations and corporate governance requirements.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its workforce and operating its business, ensuring appropriate governance and controls are in place and to measure and report on financial management and business performance.

This includes appropriate preparation of management information reports; financial accounts and other reports including in relation to HR metrics such as retention or attendance; reporting for internal and external governance; and liaising with third parties such as investors or finance providers.

Effective management information and reporting is important for effective management of the business, risk management and decision making. This supports business continuity and is important to support the Company's long-term business goals and outcomes. 

To operate the relationship with other third parties such as suppliers including disclosure of information to data processors for the provision of services to the Company

The Company also has a legitimate interest in ensuring that it can engage with suppliers effectively and that suppliers can access the information they need to provide the service for which they have been engaged.

Effective communication with and engagement of suppliers is important for business continuity and improvement.

This supports the Company's achievement of its immediate and long-term goals and outcomes.

Where relevant for publishing appropriate internal or external communications or publicity material including via social media in appropriate circumstances;

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in communicating effectively with its workforce, guests and other stakeholders as well as carrying out appropriate business development activity.

That includes giving information to the workforce or, where appropriate guests, other stakeholders or the wider market about relevant business activities, plans or projects. That can include making reference to those of our staff who are involved in the relevant matters being communicated above.

Effective employee, guest and other stakeholder communication and engagement contributes to attraction and retention of high calibre employees, development and retention of guest relationships, strong business performance, business growth and maintaining and enhancing the Company's reputation. This supports the Company's immediate and long-term business goals and outcomes. 

To enforce our legal rights and obligations, and for any purposes in connection with any complaint or legal claim made by, against or otherwise involving you

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that the Company's legal rights and interests are protected appropriately, to protect the Company's reputation and to protect the Company from other damage or loss.

This is important to protect the business of the Company and ensure its continued success and growth. This supports the Company's immediate and long-term business goals and outcomes.

To comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country;

This processing is necessary for the compliance with legal obligations to which the Company is subject where there is a legal obligation to disclose information or a court or other legal order to provide information is in place.

Where not legally required, processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in co-operating with relevant authorities, government bodies or regulators for the provision of information where appropriate. The Company wishes to maintain its reputation as a good corporate citizen and to act ethically and appropriately in all the countries in which it does business. 

This encourages compliance and high standards of business practice and protects the Company's reputation. This supports the Company's immediate and long-term business goals and outcomes.

To understand how you and others use our services, for analytics and modelling and to create business intelligence and insights and to understand economic trends

Merlin has a legitimate interest in using analytics to enhance and improve guest experience. Merlin uses cookies to monitor interaction between guests and its website, more information is available here.

Consumer: means an individual who will, who has, or who is purchasing tickets for an Attraction or using Merlin's websites, goods or services, or participating in a prize draw/competition or Merlin experience.

Data Controller: means a natural or legal person which determines the means and purposes of processing of personal data.

Data Subject: means an individual whom the personal data is about.  

EEA: means the European Economic Area.

GDPR: means the General Data Protection Regulation, which comes into force on 25 May 2018 and replaces the previous Data Protection Directive 95/46/EC.

ICO: the Information Commissioner's Office regulates the processing of personal data by all organisations within the UK.

Legitimate Interests: this is a ground which can be used by organisations as a lawful basis of processing, for example where personal data is used in ways that could reasonably be expected, or there is a compelling reason for the processing.

Member States: means those countries which are part of the European Union.

Privacy Shield: means a framework which has been adopted to protect the rights of those individuals whose data has been transferred to the US.

Profiling: means to analyse your personal data in order to evaluate your behaviour or to predict things about you which are relevant in an entertainment context, such as how likely you are to attend a certain event that we host.

Special Categories of Data: means any personal data relating to your health, genetic or biometric data, criminal convictions, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership. 

Service Providers: these are a range of third parties to whom we outsource certain functions of our business. For example, we have service providers who provide / support 'cloud based' IT applications or systems, which means that your personal data will be hosted on their servers, but under our control and direction. We require all our service providers to respect the confidentiality and security of personal data.