Introduction

DP Leisure and 360 Play are committed to protecting your privacy and ensuring that your personal information is handled securely and responsibly. This Privacy Notice explains what personal data we collect, how we use it, the legal bases we rely on, and your rights under UK data protection law.

This notice is updated to reflect:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018 (DPA 2018)

• Data Use and Access Act 2025 (DUAA 2025)

We may update this policy from time to time. Significant changes will be communicated to you, and the most recent version will always be available on our website.

If you have any questions, you can contact our Data Protection Officer (DPO) at DPO@dpleisure.co.uk.

Who are we

DP Leisure GB Ltd manages the 360 Play Group of companies. We do not share personal data with unrelated third parties for marketing purposes. We only share data where necessary to process payments, verify membership, fulfil contractual obligations, or meet legal requirements.

The Data We Collect

We may collect the following categories of personal data:

  • Membership data: name, address, email, phone number, date of birth, gender.
  • Child security data: children’s names and photographs (to verify linked family memberships).
  • Booking data: birthday parties, events, group visits, transactions.
  • Payment information: card details (tokenised), direct debit details.
  • CCTV images: for safety and security.
  • Technical data: IP address, browser information, cookies.
  • Communications & feedback: complaints, enquiries, social media messages.
  • Competition and promotion entries. 

When We Collect Your Data

We collect personal data when you:

  • Register for membership in a 360 Play centre
  • Visit our website or use online services
  • Make purchases or bookings
  • Interact with us on social media
  • Contact us with queries or complaints
  • Enter competitions or complete surveys
  • Visit our centres (CCTV)

Legal Bases for Processing

We process your data under the following legal bases:

a. Contract

To fulfil bookings, membership registrations, payments, and customer service obligations.

b. Consent

For example, when you opt in to receive marketing emails. You may withdraw consent at any time.

c. Legal Obligation

We may process data when required by law (e.g., fraud prevention, accident reporting).

d. Legitimate Interest (updated under DUAA 2025)

This includes:

  • Centre security and safety
  • Verifying membership upon entry
  • Sending your mandatory membership introduction email
  • Preventing fraud
  • Direct marketing by post or email (unless you opt out)
  • Improving our services
  • Analysing visit and purchase history to tailor offers

We ensure legitimate interest does not override your fundamental rights.

e. Vital Interests

In emergencies, such as accidents, we may share data with emergency services.

How we use your personal data

We use your data to:

  • Administer membership accounts
  • Verify your identity when entering our centres
  • Process bookings, payments, refunds and orders
  • Send service updates (e.g., changes to opening hours)
  • Provide marketing where lawful
  • Improve our services and offers
  • Respond to complaints or enquiries
  • Ensure security through CCTV
  • Prevent fraud or unlawful activity
  • Personalise your experience and offers
  • Comply with legal and insurance requirements

Sharing your Data

We only share your data with:

  • Payment providers
  • IT and system support partners
  • Email and communication service providers
  • External auditors
  • Legal or regulatory authorities (when required)
  • Emergency services (where necessary)

All third parties are required to meet strict security standards.

We never sell personal data to third parties for marketing.

Cookies and Website Tracking

We use cookies to optimise website performance and improve your experience. Some functional cookies may be used without consent under DUAA 2025. Marketing or analytics cookies will only be used where consent is given.

Email communications may include tracking pixels to monitor engagement.

Automated Decision-Making (ADM)

If automated decision-making is ever used in a way that significantly affects you, we will:

  • Inform you
  • Allow you to request human review
  • Explain the logic involved

Data Security

We use strict organisational and technical measures to keep your data secure:

  • Encrypted transactions
  • Secure servers
  • Restricted staff access
  • Tokenised payment data
  • Secure CCTV storage

While we take all reasonable measures, data transmission over the internet is not completely risk-free.

Data Retention (How Long We keep Data)

Membership data – Up to 5 years from last visit/transaction

Booking/transaction data – 7 years

Birthday party/event bookings – 7 years

Accident/incident records – 21 years

Insurance-related records – 21 years

CCTV footage – 14–31 days (unless needed for investigation)

After retention periods end, data is deleted or anonymised.

CCTV Policy Summary

Our centres are monitored by CCTV for safety and crime prevention. Footage is stored securely and only accessible to authorised staff. Requests for footage must be made in writing with sufficient detail to identify the relevant time and location.

Your Rights

You have the right to:

  • Access your personal data
  • Request correction of inaccurate or incomplete data
  • Request erasure (in certain circumstances)
  • Withdraw consent
  • Object to legitimate interest processing
  • Object to direct marketing
  • Request human review of automated decisions
  • Request data portability
  • Lodge a complaint with the ICO

To exercise these rights, email DPO@dpleisure.co.uk.

We may request proof of identity to protect your confidentiality.

Complaints Process (DUAA 2025 Requirement)

We will acknowledge all data protection complaints within 30 days and respond without undue delay. If you remain dissatisfied, you may contact the Information Commissioner’s Office (ICO).

Contact Details

Data Protection Officer

DP Leisure / 360 Play

DP House, Sunrise Parkway, Linford Wood, Milton Keynes, MK14 6NU

Email: DPO@dpleisure.co.uk