Privacy Policy

Last updated: June 2026
Who we are: Wonderland Wedding Venues Ltd (“we”, “us”, “our”).
Registered address: Unit 6 Wortley Business Park, Upper Wortley Court, Leeds, West Yorkshire, England, LS12 4WE
Contact: 01780 239163

We respect your privacy and are committed to complying with UK data protection law, including the UK GDPR, the Data Protection Act 2018 (DPA 2018), and the Data Use and Access Act 2025 (DUAA). Our approach reflects the UK GDPR’s seven key principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

 1) What this notice covers
This Privacy Notice explains what personal data we collect when you visit or interact with this website, why we collect it, how we use and share it, our legal bases for processing, how long we keep it, your rights under UK law, and how to contact us or complain.

2) Personal data we collect
We may collect and process the following categories of personal data:

• Identifiers and contact details – name, email address, telephone number, when you submit a form.
• Event and booking information – your preferred venue, event date, guest numbers, and other details you share when planning your event or wedding.
• Transactional data – payment references and booking records where you enter a contract with us.
• Usage and device data – pages visited, links clicked, IP address, browser type and device identifiers, collected automatically via cookies and similar technologies.
• Marketing preferences – records of consent, opt-ins, and opt-outs for marketing communications.
• Correspondence – emails, messages, and any other communications you send to us.

3) Where we get your data
Directly from you – via enquiry forms, contact pages, phone calls, email, or live chat.

• Automatically – from your device and browser when you visit our site (see Section 5: Cookies).

4) How we use your data & our legal bases
We only process personal data when we have a lawful basis. The table below sets out our typical purposes and the legal bases we rely on:

Notes on DUAA 2025: It introduced recognised legitimate interests (a limited statutory list, e.g., crime prevention, safeguarding, emergencies), clarified subject access timing (including a “stop‑the‑clock” where you clarify a request), and updated automated decision‑making safeguards while making the framework more permissive when safeguards are in place. GOV.UK 

5) Cookies & similar technologies
We use cookies and similar technologies to operate our website and, where you agree, formarketing purposes. Our cookies fall into three categories:

• Strictly necessary cookies – essential for core functionality such as security and navigation. These do not require your consent.
• Analytics & performance cookies – used to understand how visitors use our site so we can improve it. Under the DUAA, certain low-risk statistical analytics may not require consent where appropriate safeguards and transparency are in place; we will apply this exemption only where it is proportionate, and will seek consent otherwise.
• Advertising & personalisation cookies – used to display relevant content and measure campaign effectiveness. These are only set with your explicit consent.

You can manage your cookie preferences via our cookie consent banner or your browser settings.

6) Direct marketing (PECR)

7) Automated decision‑making & profiling
We do not currently make decisions about you solely by automated means that produce legal or similarly significant effects. If this changes, we will inform you, explain the logic and significance, and put in place appropriate safeguards — including your right to obtain human review, express your view, and contest the decision, as provided under UK law.

8) Sharing your data
We share personal data only where necessary and with appropriate safeguards in place. Recipients may include:

• Service providers acting on our instructions – including website hosting, email delivery, customer support tools, analytics platforms, and payment processors.
• Professional advisers – solicitors, accountants, and insurers, where required.
• Regulatory authorities and law enforcement – where we are required by law to disclose information.
• Business successors – if we restructure, merge, or transfer assets, personal data may be transferred under appropriate data protection safeguards.
• We require all processors to implement appropriate security measures and prohibit them from using your data for their own purposes.

9) Data retention
We retain personal data only for as long as necessary for the purposes described in this notice, and to meet any legal, accounting, or regulatory requirements. We apply documented retention periods and securely delete or anonymise data when it is no longer needed. As a general guide:

• Enquiry and contact records: up to 2 years from the date of your last contact.
• Booking and contractual records: up to 7 years following the event, in line with standard accounting and legal obligations.
• Marketing consent records: held for the duration of our marketing relationship and for a reasonable period after to demonstrate compliance.

Specific retention periods are available on request.

10) Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These include access controls, encryption in transit, staff training, and incident response procedures. We review our security measures regularly.

11) Your rights
Under UK data protection law, you have the right to:

• Access – request a copy of the personal data we hold about you.
• Rectification – ask us to correct inaccurate or incomplete data.
• Erasure – ask us to delete your data in certain circumstances.
• Restriction – ask us to pause processing while a dispute is resolved.
• Data portability – receive the data you provided to us in a structured, machine-readable format and transfer it to another controller.
• Object – object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent – where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Automated decision-making rights – obtain human intervention, express your view, and contest automated decisions (see Section 8).

Response timescales: We aim to respond to all rights requests within one month. Where we need clarification to process a subject access request, we may pause (“stop the clock”) the response period under the DUAA until the information is received.

12) Children’s privacy
Our services are directed at adults planning weddings and events, and are not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it. We are aware of and observe the principles of the ICO’s Children’s Code (Age-Appropriate Design Code). 

13) Third‑party links & services
Our site may link to third‑party sites, plug‑ins or apps. Those providers control their own privacy practices; please read their policies. 

14) Changes to this notice
We may update this notice from time to time. We’ll post changes here and, if significant, we’ll notify you by banner. Please check back regularly. 

15) How to contact us
Company Name: Wonderland Wedding Venues Ltd
Registered address: Unit 6 Wortley Business Park, Upper Wortley Court, Leeds, West Yorkshire, England, LS12 4WE
Contact: 01780 239163 

16) Complaints
If you have concerns about our use of your data, please contact us first so we can try to resolve them. You can also complain to the UK regulator: 

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113 | ico.org.uk. ICO