Privacy Policy

Cosgrove Leisure Parks Privacy Policy

Introduction

Cosgrove Leisure Parks UK (“we, “our” or “us”) are committed to protecting the privacy and security of your personal information. We take care to protect the privacy of our customers and anyone that communicates (online or offline) with us either in person, over the phone or through our mobile applications, websites, and social media platforms. We will handle your personal information fairly and legally and are dedicated to being transparent about the information we collect about you and how we use it.

The purpose of this Privacy Notice is to inform you of the information we collect, what we do with it, what we do to keep it secure as well as the rights and choices you have over your personal information.

Applicable data protection legislation includes the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where information is processed by a controller or processor established in the European Union or comprises the information of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR) and any replacement legislation coming into effect from time to time.

We are the data controller for the personal information we process, unless otherwise stated.

Who we are

Cosgrove Leisure Parks UK Ltd. is registered in England under Company Number 09984574 and registered with the Information Commissioner’s Office (the ICO) - Registration Number ZB477808.
Cosgrove Leisure Parks UK Ltd, can be contacted by post, email or phone. as follows:
Cosgrove Leisure Parks UK
Sheerness Holiday Park
Halfway Road
Sheerness
Kent
ME12 3AA

Phone; 0345 340 3964

Email: ho@clparksuk.com

Information we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer various kinds of personal information about you including but not limited to:

• Identity Data: includes first name, last name, maiden name, gender, marital status, date of birth, username, customer number, title, proof of identity (passport, driving licence etc.), proof of address (inc. previous address if less than 3 years),

• Contact Data: includes billing address, delivery address, email address and telephone numbers.

• Financial Data: includes bank account details, proof of income, employment status, employment sector, occupation, company name, company address, if proprietor length of time in business, company registration number, VAT number, funding instrument including bank account and credit/debit card details (if appropriate), time at current bank and relevant transaction information (if appropriate).

• Transaction Data: includes details about payments to and from you and other details of products and services you have purchased from us.

• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our websites.

• Usage Data: includes information about how you use our website, products, and services.

• Marketing & Communications Data: includes your preferences in receiving marketing from us and our third parties, your communications and correspondence with us. Your interests, feedback and survey responses.

• Publicly available e Data: includes personal information which you have shared via a public platform (for example on X or a public Facebook page).

• Security Data: includes CCTV, ANPR and other images.

This list is not exhaustive and other personal information may be processed for reasonable business purposes related to the running and managing of our Parks. We keep our Privacy Notice under regular review.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your information changes during your relationship with us.

Special categories of data

Special categories of data are types of personal information that might be seen as more sensitive or private and relates to information about health, disability, race, ethnicity, political opinions, biometrics, or religion.

We will usually only process health or disability special category data and only in the following circumstances:

• It is necessary to enter into or perform our contract with you; or

• It is in your vital interests to do so; or

• It is necessary to comply with our legal obligations

And one of these further conditions of processing applies:

• We have your explicit consent; or

• It is in your vital interest; or for

• Health or social care purposes

Criminal offence data

The UK GDPR gives extra protection to the personal information of offenders or suspected offenders in the context of criminal activity, allegations, investigations, and proceedings.

Criminal offence data includes information about criminal allegations, criminal offences, criminal proceedings and criminal convictions. We do not keep a comprehensive register of criminal convictions, however, owing to the nature of our business we often generate, or receive from third parties, data about criminal allegations, offences, proceedings and convictions.

• Where we process criminal offence data, we will only do where it is necessary to comply with our legal obligations

And one of these further conditions of processing applies:

• We have your explicit consent; or

• Is necessary for the purposes of the prevention or detection of an unlawful act

Children

We may collect data about children in relation to some of the services we provide, such as holiday or activity bookings for example. Children’s data is not knowingly collected or used for the purposes of account creation or marketing.

Aggregated data

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal information but is not considered personal information in law as this data will not directly or indirectly reveal your identity.

For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Privacy Notice.

If you fail to provide personal information

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a purchase or service you have with us, but we will notify you if this is the case at the time.

How we use your personal information

We will only use your personal information when the law allows us to. Most commonly, we will use it in the following circumstances:

• Performance of a contract we have or are about to enter into with you.

• Where it is necessary for our business legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal obligation.

Purposes for which we will use your personal information

We have set out below a description of all the ways we plan to use your data and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

Note that we may process your personal information against more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful basis, we are relying on to process your personal information, where more than one basis has been set out in the table below

Purpose/Activity

To register you as a new customer:

(a) Create an account for you
(b) Provide our products and services

(d) Verify your identity

(e) Prevent fraud

(f) Send you marketing communications

(g) Share this information with third parties if you have provided your consent to this

Type of data

(a) Identity

(b) Contact

Lawful basis for processing including basis of legitimate interest

(a) Performance of a contract with you

(b) Necessary to comply with a legal obligation

(d) Consent

To understand the way you use our products:

(a) Identify products/services that may be of interest to you or to others

(b) Upload your photos and videos

(d) Personalise our service

(e) Statistical analysis and research

(f) Improve our services

(g) Develop new products and services

Type of data

(a) Identity

(b) Contact

Lawful basis for processing including basis of legitimate interest

Necessary for our legitimate interests (to keep our records updated, to study how customers use our products/services and to identify prospective new customers)

To process transactions, including:

(a) Manage payments, fees and charges

(b) Collect and recover money owed to us

Type of data

(a) Identity

(b) Contact

Lawful basis for processing including basis of legitimate interest

(a) Performance of a contract with you

(b) Necessary to comply with a legal obligation

Information when you communicate with us whether in person, through our website, via email, over the phone, through social media or via any other medium. We use this to:

(a) Answer any of your issues or concerns

(b) Monitor customer communications for quality and training purposes

(d) Improve our services based on the feedback you provide

Type of data

(a) Identity

(b) Contact

(d) Marketing and Communications

Lawful basis for processing including basis of legitimate interest

(a) Performance of a contract with you

(b) Necessary for our legitimate interests (to provide a better service)

To manage our relationship with you which will include:

(a) Notifying you about changes to our terms or Privacy Notice

(b) Resolving technical issues

Type of data

(a) Identity

(b) Contact

(d) Marketing and Communications

Lawful basis for processing including basis of legitimate interest

(a) Performance of a contract with you

(b) Necessary to comply with a legal obligation

(c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)

To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting of data, and anti-money laundering checks).

Type of data
(a) Identity

(b) Contact

Lawful basis for processing including basis of legitimate interest

(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)

(b) Necessary to comply with a legal obligation

To deliver relevant website content

Type of data

(a) Identity

(b) Contact

(d) Marketing and Communications

(e) Information about your interactions with us on our website.

Lawful basis for processing including basis of legitimate interest

Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)

To use data analytics to improve our website, products/services, marketing, customer relationships and experiences

Type of data

(a) Information about your interactions with us in person and on our website and apps

(b) Usage

Lawful basis for processing including basis of legitimate interest

Lawful basis for processing including basis of legitimate interest

To make suggestions and recommendations to you about services that may be of interest to you or to others

Type of data

(a) Identity

(b) Contact

(d) Usage

(e) Marketing and Communications

Lawful basis for processing including basis of legitimate interest

Necessary for our legitimate interests (to develop our products/services and grow our business)

Information that we collect incidentally from other sources or public sources, including information presented on our social media or wider social media platforms including Facebook, Twitter and Instagram. We use this information, including to:

(a) Maintain market awareness

(b) Build and maintain social media branding

Type of data

(a) Usage

(b) Marketing & Communications

Lawful basis for processing including basis of legitimate interest

Necessary for our legitimate interests (to develop our products/services and grow our business)

Change of purpose

We will only use your personal information for the purpose it was collected, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If you would like an explanation with regard to the ways in which any new processing is compatible with the original purpose, please contact us.

• We rely on the Legitimate Interest lawful basis for the following types of processing:

• Selling and supplying goods and services to our customers

• Sending promotional marketing communications which are tailored and relevant to our customers

• Understanding our customers’ preferences and behaviours

• Handling customer queries, complaints and disputes

• Fulfilling our duties to our employees and customers

• Protecting our customers, employees and other individuals to maintain their safety, health and welfare

• Protecting Cosgrove Leisure Parks UK., its employees and customers by taking legal action against third parties against third parties who have committed criminal acts or are in breach of their legal obligations to Cosgrove Leisure Parks UK.

• Improving our products and services and developing new products and services

• Complying with legal and regulatory requirements

• Managing legal and insurance claims

• Handling legal or regulatory enforcement actions taken against Cosgrove Leisure Parks UK Ltd.

• Managing corporate matters, including selling or transferring part or all of our business to third parties, acquisitions and mergers, or any other corporate restructuring activity

• Prevention, investigation and detection of crime, fraud and antisocial behaviour and the prosecution of offenders, in conjunction with law enforcement agencies

Marketing

We use your personal information to provide you with promotional messages via email, text, and other electronic means, based on your consent. strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. We may also use your personal information to send you and others promotional material in the post.

Opting out

You can ask us to stop sending you marketing messages at any time, by following the opt-out link we provide in all our marketing messages or contacting us at ho@clparksuk.com

Online advertising

You may be presented with personalised advertisements for our products and services whilst using ours or other websites and social media platforms. The advertisements may relate to products you have previously viewed on our websites on your computer or other devices that we believe will be of interest to you. The advertisements are presented to you by us via specialist providers using cookies and other similar technologies placed on your device. You can disable or remove cookies at any time – see below for details.

How long will we hold your personal information for

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Sometimes we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

In all other cases we will archive or delete your personal data in accordance with the rules set out in our Retention Policy and Schedule.

If you wish to have a copy of our Data Retention Policy please contact Head Office on 0345 340 3964 or email@ ho@clparksuk.com

Who we share your information with

We share your information with certain suppliers or service providers to help us deliver or promote our products and services to you and/or others. We will do this either when we receive your consent or because it is necessary for them to see your information in order for us to provide our products or services to you. These suppliers and service providers may process your personal information as data processors or as a data controller in their own right.

We only share your personal information with suppliers and service providers where they have confirmed they apply appropriate data protection and security controls. The information we provide to third party data processors, will be limited to only that required to complete the processing for which they have been engaged. They will not be permitted to use your information for any purposes other than those outlined in this Privacy Notice.

• If we are not able to share your information with these third parties, we may not be able to provide our products and services to you.

There are certain circumstances where we transfer your personal information to other parties. For example, we will:

• share your personal information with and access information from analytics and search engine providers that assist us in the improvement and optimisation of the website and app and for better personalisation of content and advertising

Your personal information may also be transferred to other third-party organisations in certain scenarios, for example:

• if we discuss selling or transferring part or all of our business – the information may be transferred to prospective purchasers under suitable terms as to confidentiality

• if we are reorganised or sold, information may be transferred to a buyer who can continue to provide services to you

• if we're required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority. For example, the police, regulators, local authorities, governmental bodies etc., to comply with our legal obligations and for the prevention, detection or investigation of crime

• if we are defending a legal claim your information may be transferred as required in connection with defending such claim

• if there is an emergency which requires us to share your data to protect the health and safety of our website users or the general public

Social Media Platforms and Search Engines

When you accept cookies on our websites and you also use search engines like Google or have accounts on a Meta platform (e.g., Facebook or Instagram) or TikTok, your purchasing and browsing data will be shared with them. ‘Meta’ means Meta Platforms Inc. (a US company) and other Meta Group companies. ‘TikTok’ means TikTok Information Technologies UK Ltd. in the UK and TikTok Technology Ltd. in Ireland. ‘Google’ means Google LLC (a US company) and Google Ireland Ltd. This enables social media companies and search engines to present you with personalised advertisements relating to our products and services when you use them.

You can find out more about how these organisations use your personal information and how you can exercise your data subject rights in the links below:

Meta - Privacy Centre - Manage your privacy on Facebook, Instagram and Messenger - Facebook Privacy

TikTok Privacy Policy

How Google uses information from sites or apps that use our services – Privacy and Terms - Google

As required under data protection legislation, Cosgrove Leisure Parks UK Ltd. has agreements in place with social media platforms which detail each party’s responsibilities and obligations. We are responsible for providing you with the information above and relevant social media platforms are responsible for enabling your rights under the UK GDPR, for the data they process.

Our relationships with social media platforms may not be limited to those explicitly referenced in this Notice and may change from time to time.

Mergers and Acquisitions

In the event that our business is acquired, either wholly or partly, by another business (e.g. a merger or sale) we may need to disclose your personal information to that company in order for them to continue providing services to you. Should this occur, your data will only be used by that company for the purposes set out in this Privacy Notice.

Your personal information may also be shared with another company, during preliminary discussions around a merger or acquisition of our business, prior to entering a contract. In this event, the data will be shared securely and kept confidential and deleted if the merger or acquisition does not complete.

International data transfers

In order to deliver our services and products to you, we sometimes need to transfer your information outside of the UK or European Economic Area (EEA) to countries which have different data protection rules.

Where this is necessary, we ensure the transfer is secure and will be compliant with prevailing laws and regulation. Our standard practice is to use standard contract clauses (SCC’s) which have been approved by the European Commission and the relevant UK authorities. These clauses can be viewed here.

Where we share data with our US-based parent company, we rely on our Inter Group Agreement, which incorporates the UK Addendum to the EU Standard Contractual Clauses.

How we protect your information

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal information to only those employees, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach, where we are legally required to do so.

Examples of the measures we take to protect your data include:

• Encryption of data

• Security measures that protect and monitor our IT systems to protect from external attack and unauthorised access

• Regular penetration testing of our systems

• Information security assessments of third parties we share your data with

• Internal policies and regular staff training relating to data protection

Your rights

You have the following rights under data protection laws in relation to your personal information:

Right to be informed in a clear and concise way about how we process your personal information. This is referred to as privacy information and we rely on this Privacy Notice to meet this requirement.

Right of access to your personal information (commonly known as a "Data Subject Access Request", “DSAR” or “SAR”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

We are committed to providing the information you request as part of your Data Subject Access Request and have procedures in place to ensure this occurs in a timely fashion.

Right to rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Right to erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right to restrict processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios:

• If you want us to establish the data's accuracy.

• Where our use of the data is unlawful, but you do not want us to erase it.

• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.

• You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Right to data portability of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate reasons to process your information which override your rights and freedoms.

Right related to automated decision making and profiling based on the personal information we hold about you. Where we do this, you have the right to be informed of the processing and to request human intervention. Where we rely on this type of processing, we will carry out regular checks to ensure our systems are working as intended.

Right to withdraw consent based on the personal information we hold about you. Where we do this, you have the right to be informed of the processing and to request human intervention. Where we rely on this type of processing, we will carry out regular checks to ensure our systems are working as intended.

Time limit to respond

We endeavour to respond to all legitimate requests within the required one calendar month timeframe. If your request is particularly complex or you have made a number of requests, we may need to extend the response window by up to a further two calendar months. In this case, we will notify you and keep you updated.

What we need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

How to contact us or make a complaint
Our Data Protection Officer helps ensure we protect the personal information we process and that we comply with data protection legislation.

If you have any questions about this Privacy Notice or our privacy practices, please contact our Data Protection Officer at ho@clparksuk.com.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this Privacy Policy

Cosgrove Leisure Parks UK reserve the right to amend or modify this Privacy Policy at any time and any changes will be published on our website. The date of the most recent revision will appear on this web page. If we make significant changes to this policy, we may also notify you by other means such as sending an email. Where required by law we will obtain your consent to make these changes. If you do not agree with any changes, please do not continue to use our website and let us know that you wish to have your personal data deleted.

Last updated 15/01/2026