Privacy Policy
The Academy Park Group Ltd (trading as The Park)
Version 002 | Effective date: 14 July 2026
This privacy policy explains how we collect, use, share and protect personal information relating to parents and guardians, children attending The Park, website visitors, customers, applicants, employees and team members.
It applies to our website, online store and checkout, booking and enquiry processes, programme delivery, recruitment and employment activities, and other communications with us. It is intended to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
The Academy Park Group Ltd (company number 17118021), trading as The Park, is registered in England and Wales. Our registered office is C/O Accounts And Legal, 81 King Street, Manchester, Greater Manchester, England, M2 4AH.
For most of the activities described in this policy, The Academy Park Group Ltd is the data controller, which means that we decide why and how personal information is used. In limited circumstances, where we process information solely on the instructions of another organisation, we may act as a data processor.
Our privacy contact is the Privacy Lead. You can contact us at info@thepark.co.uk or on +44 (0)7866 461 816.
2. The personal information we collect
The information we collect depends on how you interact with us. It may include the following.
Parents, guardians, customers and enquirers
- name, email address, telephone number, postal and billing address;
- booking, order, payment, refund and transaction information;
- communications, enquiries, complaints and customer-service records;
- marketing preferences and records of consent or opt-out choices; and
- information supplied in surveys, competitions, feedback forms or bursary applications.
Children attending The Park
- name, age, date of birth, school and attendance information;
- parental or guardian contact details and emergency contacts;
- medical conditions, allergies, medication, dietary requirements, disabilities,
- additional needs and other information needed to support the child safely;
- information relating to behaviour, welfare, safeguarding, accidents or incidents;
- programme feedback, evaluation responses and learning-related observations; and
- photographs, video or audio recordings where an appropriate permission or other lawful basis applies.
Website and online-store users
- IP address, device identifiers, browser type, operating system and approximate location;
- pages viewed, links selected, referring website, session information and shopping-cart activity;
- cookie and tracking preferences; and
- security, fraud-prevention and diagnostic information.
Applicants, employees and team members
- contact details, application forms, CVs, qualifications, references and interview notes;
- right-to-work, identity and background-check information, including information relevant to safeguarding and DBS checks where appropriate;
- employment, payroll, tax, pension, performance, training and absence records; and
- health, emergency-contact, accident, disciplinary and safeguarding information where relevant.
3. How we collect personal information
We collect personal information:
- directly from you, including through our website, Shopify store, booking forms, email, telephone, paper forms, surveys and in-person conversations;
- from a parent, guardian, school, referral partner or other person authorised to provide information about a child;
- automatically when you use our website or online store, through cookies and similar technologies;
- from payment, technology, marketing, recruitment and professional-service providers; and
- from publicly available sources or regulatory and safeguarding bodies where it is lawful and appropriate to do so.
Where someone gives us personal information about another person, they should ensure that they are authorised to do so and, where appropriate, have shown that person this policy.
4. How and why we use personal information
We use personal information only where we have a lawful basis. Depending on the activity, we may rely on one or more of the following:
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries, taking bookings, providing programme places, processing refunds and communicating about a booking | Taking steps at your request before entering into a contract and performing our contract with you |
| Planning and delivering a safe, suitable programme for a child | Contract; legitimate interests in providing and improving our services; legal obligations where applicable |
| Processing payments and preventing fraud | Contract; legitimate interests in preventing fraud and securing our services; legal obligations |
| Managing health, medical, accident, incident and safeguarding matters | Legal obligations; legitimate interests; vital interests in an emergency; and the special-category conditions described below |
| Keeping accounting, tax, insurance and business records | Legal obligations and legitimate interests |
| Answering questions, resolving complaints, recovering fees and establishing or defending legal claims | Contract, legal obligations and legitimate interests |
| Improving our services, conducting research and analysing how our website and programmes are used | Legitimate interests, or consent where required for cookies, tracking or a particular research activity |
| Sending marketing communications | Consent, or legitimate interests and the PECR soft opt-in where the law permits |
| Recruitment, employment, training and workforce management | Steps before entering into a contract; contract; legal obligations; and legitimate interests |
| Protecting our organisation, children, staff and systems, and investigating suspected unlawful conduct | Legal obligations and legitimate interests |
We do not use personal information for a new purpose that is incompatible with the purpose for which it was collected unless the law allows us to do so and we provide any additional information required.
5. Health, safeguarding and other sensitive information
Some information we use is classed as special category personal data, particularly information about health, disability or medical needs. We process this information only where both an ordinary lawful basis and an additional condition under data protection law apply.
Depending on the circumstances, those additional conditions may include:
- the substantial public interest in safeguarding children and individuals at risk;
- protecting someone's vital interests where they are physically or legally incapable of giving consent;
- employment, social-security and social-protection obligations; or
- explicit consent, where this is appropriate and genuinely optional.
We may process information relating to criminal convictions or offences, including DBS-related information, only where this is lawful and necessary for safeguarding, recruitment or employment purposes, with appropriate controls in place.
6. Shopify and online payments
We use Shopify to host and operate our online store and to provide checkout and payment-related services. When you browse our store or make a booking or purchase, Shopify and the relevant payment-service providers collect and process information needed to operate the checkout and complete the transaction. This may include your name, contact details, billing address, order and transaction information, IP address, device information and payment details.
We use this information to enter into and perform our contract with you, process payments and refunds, prevent and detect fraud, provide customer support, and comply with accounting and other legal obligations. When payment is made through Shopify, The Academy Park Group Ltd does not receive or store your full payment-card number or card security code. Those details are handled by Shopify and the relevant payment processor. We may receive limited payment information, such as the payment status, payment method and the final digits of a card number.
Depending on the Shopify services you choose to use, including services such as Shop or Shop Pay, Shopify may also process your information under its own privacy terms. Where Shopify Network Intelligence or other enhanced services are enabled, Shopify may process certain customer information for those services. You can read more in the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal to learn about Shopify's privacy controls.
7. Who we share personal information with
We may share personal information with the following categories of recipient where this is necessary and lawful:
- Shopify, payment processors, banks and fraud-prevention providers;
- website hosting, booking, customer-management, email, cloud-storage, analytics, IT support and cybersecurity providers;
- programme venues, activity providers and other suppliers helping us deliver a booking;
- employees, team members and contractors who need the information to perform their role;
- accountants, auditors, insurers, lawyers and other professional advisers;
- schools, referral partners or bursary partners where appropriate and authorised;
8. International transfers
Some of our service providers, including Shopify and providers connected with our website, communications and cloud systems, may process personal information outside the United Kingdom. Their systems or staff may be located in the European Economic Area, Canada, the United States or other countries.
Where personal information is transferred to a country that is not covered by UK adequacy regulations, we use an appropriate safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. We also consider whether additional technical and organisational measures are appropriate. You may contact us for further information about the safeguards relevant to your information.
9. Cookies and similar technologies
What cookies are
Cookies are small text files placed on a device when someone visits a website. Similar technologies, such as pixels, local storage and software development kits, can perform related functions. These technologies may collect information that is personal data, including IP addresses, device identifiers and online activity.
How we use them
We may use cookies and similar technologies for the following purposes:
- strictly necessary functions, including security, fraud prevention, shopping-cart operation, checkout and remembering privacy choices;
- functionality and personalisation;
- analytics and measuring website or campaign performance; and
- advertising and measuring the effectiveness of advertising, where these services are enabled.
Strictly necessary technologies may be used without consent where the law permits. We ask for consent before using non-essential cookies or similar technologies where PECR requires it. You can make or change your choices through our cookie banner or privacy settings. Refusing non-essential cookies should not prevent you from using the core functions of the website, although some optional features may not work as intended.
Shopify cookies
Our online store and checkout are provided by Shopify. Shopify uses cookies and similar technologies needed to operate features such as the shopping cart, checkout, security and fraud prevention.
10. Analytics, advertising and email measurement
Where enabled and permitted by your choices, we may use analytics services such as Google Analytics to understand how people use our website, diagnose problems and improve our services. We may also use advertising tools provided by platforms such as Meta or Google to measure campaigns and show relevant advertising.
Marketing emails may contain technologies that tell us whether an email was opened or a link was selected. We use this information only where lawful and in accordance with your marketing and cookie choices. You can unsubscribe from marketing emails at any time.
11. Social media, external links and embedded content
Our website may link to external websites or allow you to interact with social-media services. When you follow an external link, use an embedded service or share information with a social platform, that provider may collect and use information under its own privacy policy. We are not responsible for the privacy practices of websites or services that we do not control, and we encourage you to review their notices.
12. Marketing communications
We may send you news, information about The Park, future programmes, offers, competitions or related content where you have consented, or where we are otherwise permitted to do so. For electronic marketing to existing customers, we may rely on the PECR “soft opt-in” for our own similar services where the legal conditions are met, including giving you a clear opportunity to opt out when we collect your details and in every message.
You can change your preferences or unsubscribe at any time by using the unsubscribe link in an email, adjusting available privacy settings, or contacting us. We may retain a minimal suppression record so that we can respect your opt-out and avoid contacting you again by mistake.
13. Automated decision-making
We do not currently make decisions about individuals using solely automated processing where the decision would produce legal effects or similarly significant effects. If this changes, we will provide the information and safeguards required by law.
14. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to meet legal, accounting, insurance and safeguarding requirements, and to establish or defend legal claims. We consider the nature and sensitivity of the information, the reason we hold it, the risks of keeping it and any relevant limitation periods.
| Type of information | Usual retention approach |
|---|---|
| Enquiries that do not lead to a booking | Normally up to two years after the last meaningful contact, unless a longer period is needed for a complaint or legal issue |
| Booking, customer-service and contractual records | Normally six years after the end of the relevant booking or customer relationship |
| Payment, invoice, tax and accounting records | Normally six years after the end of the relevant financial year, or longer if required by law |
| Child registration, medical, accident, incident and safeguarding records | Kept for the period required by our safeguarding, insurance and legal retention schedule. Safeguarding or serious-incident records may be kept for longer where necessary to protect individuals or manage potential claims |
| Marketing records | Until you withdraw consent or object, subject to periodic review; a minimal suppression record may be kept after opt-out |
| Unsuccessful recruitment records | Normally six months after the recruitment process, unless a longer period is agreed or legally justified |
| Employment and team-member records | Normally six years after the relationship ends, with particular records kept for longer where tax, pension, safeguarding |
When information is no longer required, we securely delete or anonymise it. Anonymised information that can no longer identify an individual may be retained and used for statistical, research or service-improvement purposes.
15. How we protect personal information
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures may include access controls, staff confidentiality and training, secure service providers, backups, device and account security, and procedures for responding to suspected data breaches.
No internet transmission or storage system can be guaranteed to be completely secure. If a personal-data breach creates a risk to individuals, we will assess it and notify the Information Commissioner’s Office and affected individuals where the law requires.
16. Your data-protection rights
Depending on the circumstances and the lawful basis we rely on, you may have the right to:
- ask for access to your personal information and receive a copy;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information in certain circumstances;
- ask us to restrict how information is used in certain circumstances;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive information you provided to us in a structured, commonly used and machine-readable format, and ask us to transfer it, where the right to portability applies;
- withdraw consent at any time, without affecting processing carried out before withdrawal; and
- ask for safeguards in relation to qualifying solely automated decisions.
These rights are not absolute, and exemptions may apply. We will explain our decision if we cannot comply with all or part of a request.
17. How to exercise your rights
To exercise a data-protection right, contact us at info@thepark.camp, call +44 (0)7866 461 816, or write to the registered-office address above, marked for the attention of the Privacy Lead.
We may ask for information reasonably needed to confirm your identity and locate the relevant records. We will not routinely require a passport, driving licence or utility bill where less intrusive information is sufficient. We normally respond within one month. The law allows us to extend the response period by up to two further months for complex or numerous requests, in which case we will tell you within the first month.
18. Questions and complaints
Please contact us first if you have a question or concern about how we use personal information. We will investigate and respond as promptly as we can.
You also have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113
- ICO website and contact information
19. Changes to this policy
We may update this policy from time to time to reflect changes in our services, suppliers, legal obligations or privacy practices. We will publish the updated version and change the effective date and version number. Where a change is material, we will take reasonable steps to bring it to the attention of affected individuals.
20. Contact details
The Academy Park Group Ltd
C/O Accounts And Legal
81 King Street
Manchester
Greater Manchester
M2 4AH
United Kingdom
For the attention of: Privacy Lead
Telephone: +44 (0)7866 461 816
Email: info@thepark.camp
Effective date: 14 July 2026 | Version 002