PLHR EVENTS LTD (Royal Windsor Wheel) Privacy Policy

PLHR Events limited Privacy Policy PLHR Events limited - Data Protection Policy Last updated 7th March 2024 Definitions Company means PLHR Events limited – a registered company, trading as The Royal Windsor Wheel.

GDPR means the General Data Protection Regulation. Responsible person means Luisa Coupland. Register of Systems means a register of systems or contexts in which personal data is processed by the Company. 1. Data protection principles

The Company is committed to processing data in accordance with its responsibilities under the GDPR. Article 5 of the GDPR requires that personal data shall be: a. processed lawfully, fairly and in a transparent manner in relation to individuals; b. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes or statistical purposes shall not be considered to be incompatible with the initial purposes; c. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; d. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which is inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; e. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and f. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

2. General provisions a. This policy applies to all personal data processed by the Company. b. The Responsible Person shall take responsibility for the Company’s ongoing compliance with this policy. c. This policy shall be reviewed at least annually. d. The Company shall register with the Information Commissioner’s Office as an organization that processes personal data.

3. Lawful, fair and transparent processing a. To ensure its processing of data is lawful, fair and transparent, the Company shall maintain a register of Systems. b. The Register of Systems shall be reviewed at least annually. c. Individuals have the right to access their personal data and any such requests made to the Company shall be dealt with in a timely manner.

4. Lawful purposes a. All data processed by the Company must be done on one of the following lawful bases: consent, contract, legal obligation, vital interest, public task or legitimate interests b. The Company shall note the appropriate lawful basis on the Register of Systems. c. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data. d. Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in the Company’s systems.

5. Data Minimisation a. The Company shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. b. Any personal financial information (credit/debit card information) provided in order to purchase tickets for the event is not stored on the Company’s systems in any form and is used solely for the purchase of requested tickets. c. The customer has the right to opt in/out of future communication with the Company at time of ticket purchase.

6. Accuracy a. The Company shall take reasonable steps to ensure personal data is accurate. b. Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.

7. Archiving / removal a. To ensure that personal data is kept for no longer than necessary, the Company shall put in place an archiving policy for each area in which the personal data is processed and review this annually. b. The archiving policy shall consider what data should be retained, for how long, and why.

8. Security a. The company shall ensure that personal data is stored using modern software that is kept-up-to-date. b. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorized sharing of information. c. When personal data is deleted this should be done safely and in a such a way that the data is irrecoverable. d. Appropriate back-up and disaster recovery solutions shall be in place.

9. Breach In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the Company shall promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the Information Commissioner’s Office. End of Policy DigiTickets Privacy Policy Who we are In this privacy policy references to "we", "us" and "our" are to PLHR EVENTS LTD.

References to "our Website" or "the Website" are to royalwindsorwheel.digitickets.co.uk. Information collected and its use The information we collect via the Website may include:

1. Any personal details you knowingly provide us with through forms and our email, such as name, address, telephone number etc.

2. In order to effectively process credit or debit card transactions it may be necessary for the bank or card processing agency to verify your personal details for authorisation outside the European Economic Area (EEA). Such information will not be transferred out of the EEA for any other purpose.

3. Your preferences and use of email updates, recorded by emails we send you (if you select to receive email updates on products and offers).

4. Your IP Address, this is a string of numbers unique to your computer that is recorded by our web server when you request any page or component on the Website. This information is used to monitor your usage of the Website.

5. Information about your device such as your web browser, screen resolution and operating system. This information is used to ensure we continue to support the different devices used by our customers.

6. Data recorded by the Website which allows us to recognise you and your preferred settings, this saves you from re-entering information on return visits to the site. Such data is recorded locally on your computer through the use of cookies. Most browsers can be programmed to reject, or warn you before downloading cookies, information regarding this may be found in your browsers 'help' facility. We do not store any credit card details.

What we do with your information

Any personal information we collect from this website will be used in accordance with the Data Protection Act 1998 and other applicable laws. The details we collect will be used:

1. To process your order, to provide after sales service (we may pass your details to another organisation to supply/deliver products or services you have purchased and/or to provide after-sales service);

2. In certain cases we may use your email address to send you information on our other products and services. In such a case you will be offered the option to opt in/out before completing your purchase. We may need to pass the information we collect to other companies for administrative purposes. We may use third parties to carry out certain activities, such as processing and sorting data, monitoring how customers use the Website and issuing our e-mails for us. Third parties will not be allowed to use your personal information for their own purposes. Cookie Policy Like many websites we use cookies to store and then retrieve small bits of information on your computer when you visit. This information is used to make the site work as you expect it to. It is not personally identifiable to you, but it can be used to give you a more personalised web experience. Some of the information stored is put there by other companies whose software we have added to the site, and this can also impact your experience of other websites you may visit after leaving ours. If you continue to use this site without taking action to prevent the storage of this information, you are effectively agreeing to this use. If you want to learn more about the general uses of cookies, including how to stop them being stored by your computer, please visit Cookiepedia - all about cookies. Below is a list of the different types of cookies used on this site, and an explanation of what they are used for. If you would like any more information, please get in touch. C oo ki e Na m e Ex pir ati on Ti m e Purpose Your Rights You have the right to request a copy of any information that we currently hold about you. In order to receive such information please send your contact details including address to the following address: plhrevents@aol.com Shop ping Bask et PHPSES SID 24 minut es This cookie is used to keep track of what items are in a user's shopping basket. Cook ie Cons ent dtAnalyti csConse nt 1 year This cookie is used to monitor the users consent for analytical cookies on our site. No user data is collected without this being enabled.

Goo gle Anal ytics _ga _ga_cont ainer-id 2 years These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. Read Google's overview of privacy and safeguarding data _gid 24 hours _gat_trac ker-name 1 minut e Micr osoft Clarit y _clck 1 year These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site and how they interact with the website. Read Microsoft Clarity's Cookie Overview and Data Retention Policy. _clsk 1 year CLID 1 year ANONC HK 1 year MR 1 year MUID 1 year SM 1 year New Relic __cfduid 1 year This cookie is used to collect information about visitor's experience of the site in terms of performance. This helps us to monitor that our systems are working quickly and effectively, and to identify any problematic areas. Visit the New Relic website Other websites This privacy policy only covers this website. Any other websites which may be linked to by our website are subject to their own policy, which may differ from ours.

DigiTickets Privacy Policy

Policy Owner

This policy is owned and distributed by IT and Compliance manager of Digital Ticketing Systems Limited

Who we are

In this Privacy Policy, references to "we", "us", and "our"" are to Digital Ticketing Systems Limited (Company number 07044584). References to "our Website" or "the Website" are to *.digitickets.co.uk.

Digital Ticketing Systems Limited is the data controller responsible for the personal information collected through this Website.

Information We Collect

We may collect and process the following categories of personal information:

Information You Provide Directly

When you contact us, make a purchase, register for services, or complete forms on our Website, we may collect information such as:

• Name
• Postal address
• Email address
• Telephone number
• Purchase and booking information
• Any other information voluntarily provided by you

Payment Information

Payments made through our Website are processed by authorised payment service providers. We do not store your full credit or debit card details on our systems.

Our payment providers may process payment information and carry out fraud prevention and verification checks. Where international transfers are required, appropriate safeguards will be applied in accordance with applicable data protection laws.

Digital Ticketing Systems is PCI DSS v4.0.1 compliant and are annually assessed/certified.

Website Usage Information

When you visit our Website, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Screen resolution
• Operating system
• Referral source
• Pages visited and actions taken on the Website
• Date and time of access

Marketing Preferences

If you choose to receive marketing communications, we will record your preferences and any interactions with our emails, including whether emails are opened or links are clicked.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our Website, remember your preferences, analyse usage, and improve user experience. Further information is provided in our Cookie Policy below.

How We Use Your Information

We process personal information for the following purposes:

• To provide products and services you request
• To process transactions and fulfil orders
• To provide customer support and after-sales services
• To manage bookings and accounts
• To improve our Website, products, and services
• To ensure Website security and prevent fraud
• To comply with legal and regulatory obligations
• To send marketing communications where we have your consent or another lawful basis to do so

Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Performance of a contract: to provide goods or services you have requested.
• Legal obligation: where processing is necessary to comply with legal requirements.
• Legitimate interests: to manage and improve our business, Website security, and customer experience.
• Consent: where required, including for certain cookies and marketing communications.

Where we rely on consent, you may withdraw it at any time.

Sharing Your Information

We may share your personal information with:

• Payment processors
• Hosting and IT service providers
• Delivery and fulfilment partners
• Marketing and communications providers
• Analytics and Website performance providers
• Professional advisers and auditors
• Regulatory authorities, law enforcement agencies, or courts where required by law

All third-party service providers are required to process personal information only on our instructions and in accordance with applicable data protection laws.

We do not sell personal information to third parties.

International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as:

• Transfers to countries deemed to provide an adequate level of protection; or
• Approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, regulatory, and reporting requirements.

Retention periods vary depending on the type of information and the purpose for which it is processed.

Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember preferences, improve performance, and provide analytics information.

How We Use Cookies

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie management tools.

Cookie	Purpose	Duration
PHPSESSID	Maintains user session and shopping basket functionality	Session / 24 minutes
dtAnalyticsConsent	Records cookie consent preferences	1 year

Analytics Cookies

These cookies help us understand how visitors interact with the Website so that we can improve performance and usability.

These cookies are only placed with your consent.

Google Analytics

Examples include:

• _ga
• _ga<container-id>
• _gid
• _gat_<tracker-name>

Used to collect aggregated statistical information about Website usage.

Google Privacy Information:

https://support.google.com/analytics/answer/6004245

Microsoft Clarity

Examples include:

• _clck
• _clsk
• CLID
• ANONCHK
• MR
• MUID
• SM

Used to analyse user interactions and improve Website usability.

Microsoft Clarity Information:

• https://clarity.microsoft.com/blog/cookies-in-clarity/
• https://learn.microsoft.com/en-us/clarity/

Performance Monitoring Cookies

Performance monitoring tools help us identify technical issues and improve Website reliability.

Examples may include cookies used by services such as New Relic.

Managing Cookies

When you first visit our Website, you will be presented with a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Choose your cookie preferences

You may change your preferences at any time through our cookie settings tool.

You can also manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

Your Data Protection Rights

Under UK GDPR, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Restrict processing
• Object to processing
• Request portability of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

For more information about your rights, visit:

https://ico.org.uk/

Automated Decision-Making

We do not generally make decisions producing legal or similarly significant effects using solely automated processing.

Where automated tools are used for fraud prevention, security monitoring, or service administration, appropriate safeguards will be applied in accordance with applicable data protection legislation.

Childrens Data

Our Website is not intended to knowingly collect personal information from children unless necessary to provide services requested by a parent, guardian, school, attraction, venue, or authorised organisation.

Where we process children's personal information, we take additional care to ensure appropriate protections are in place.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Digital Ticketing Systems (t/a DigiTickets)

Sentio House, Pynes Hill, Exeter, Devon, EX2 5AZ

www.digitickets.co.uk/compliance-request

If you have concerns about how we use your personal information, you may submit a privacy complaint to us using the contact details above.

We will acknowledge your complaint and investigate it in accordance with applicable data protection legislation. We aim to respond without undue delay and within the timescales required by law.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

Other Websites

This Privacy Policy applies only to this Website. Links to third-party websites are provided for convenience only. We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies before providing any personal information.

Last Updated: 5 August 2026