Privacy Policy

Escapade Group Privacy Policy

Updated: 1st November 2026
Effective From: 1st November 2026

This policy details our responsibilities for the safe and fair processing of customer data under the UK GDPR, Data Protection Act (2018), and the Data Use and Access Act (2025). It will be updated periodically to reflect changes in legislation or our operations. Each release date will be recorded, and the newest version overrides prior versions.

1. Introduction & Who We Are

This is the privacy policy of Escapade Group ("Escapade", "we", "us", or "our"). We operate a network of themed parks and indoor play centres across the UK, providing entertainment, birthday-party services, annual passes, online bookings, Wi-Fi, and other activities ("our Services").

Our sites include:

• Hobbledown Epsom

• Hobbledown Heath

• Gripped

• Kidspace Croydon

• Kidspace Romford

• Watermouth Castle

• Farmer Teds

• Farmaggedon

We are committed to protecting the privacy and security of our guests, members, website users, contractors, and other individuals. This policy covers data collected in-person, online, via mobile apps, phone, email, or other channels. The ultimate Data Controller is Escapade Group.

2. Contact Details & Data Protection Lead

The Data Controller is Escapade Group, located at Hobbledown Epsom, Horton Lane, Epsom KT19 8PT. You can contact us by email at [email protected]

Following an assessment, Escapade has determined that it is not necessary for them to appoint a Data Protection Officer (DPO). This assessment will be kept under review. Responsibility for overseeing data protection has been allocated to trained personnel within the business.

3. The Personal Data We Collect

a) Guests, Visitors & Members

We collect personal information such as:

• Your name, contact details including email, postal address, and phone numbers, date of birth for account creation or age-specific services, and payment information for online or kiosk transactions.

• We also collect annual pass or loyalty scheme data, booking and reservation details including dates and number of participants, online account credentials, and marketing preferences.

• Additionally, we collect CCTV or video footage for safety and security purposes

• Health or allergy information you provide

• Device and website or app usage data,

• Images or videos for promotional purposes with consent,

• School or educational establishment details where relevant,

• Your IP address for monitoring of advertising activities

c) Children’s Data & Special Considerations

When processing children's data, we only do so with parent or guardian consent. Such data is used solely for the specified purposes, such as birthday-party bookings or annual passes. Staff are trained in handling children’s data and sensitive information, and extra safeguards are applied to health, allergy, or special needs information.

d) Cookies, Website & Online-Tracking

We use cookies and similar technologies to enhance website and app functionality. Strictly necessary cookies are required for logging in, making payments, or accessing secure areas. Performance or statistical cookies track visitor activity to improve usability. Functionality cookies remember preferences or login details. Marketing cookies personalise content and advertising, which may involve third-party sharing. Users can manage cookies through their browser settings or the consent banner, although blocking certain cookies may limit functionality. More information about this can be found on the relevant websites cookie banner.

4. When We Collect Data

We collect data when you visit our websites, use our apps, engage with our social media channels, book or purchase services, sign up for newsletters, loyalty schemes, or promotions, contact customer services, participate in promotional filming on-site, apply for a job, or use guest Wi-Fi services.

Occasionally, we receive data from third parties for aggregated marketing or demographic purposes, which is anonymised or includes minimal personal data.

5. How We Use Your Personal Data & Lawful Basis

We will only process (use) your personal information under the following legal bases:

Consent

• What is it?

  • Consent is defined in Article 4(11):

    • any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Contract

• What is it?

  • Contract is the lawful basis we rely on where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract.

    • Article 6(1)(b) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Legal Obligation

• What is it?

  • Legal obligation is the lawful basis we rely on where processing is necessary for compliance with a legal obligation to which we are subject.

    • Article 6(1)(c) - Processing is necessary for compliance with a legal obligation to which the controller is subject;

Legitimate interests

• What is it?

  • Legitimate interests is the lawful basis we rely on where processing is necessary for our legitimate interests or those of a third party, unless there is a good reason to protect your personal data which overrides those interests.

    • Article 6(1)(f) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

6. How We Process & Share Your Data

We do not sell personal data. We may share data with group companies for service delivery and central support, with service providers and contractors including payment processors, IT, marketing, CCTV/security, and booking systems, and with regulatory or law enforcement bodies as required by law. Other third parties may receive data only with explicit consent. In the event of a business sale, merger, or acquisition, personal data may be shared with the incoming organisation with notification provided to affected individuals.

Our key third-party processors include FuseMetrix for ticketing and booking, Salesforce for email marketing, Campus (Sprint Education) for school marketing campaigns, Meta for social platform engagement and advertising, on-site Wi-Fi providers, Google Analytics for website and app analytics, promotional partners for joint campaigns, direct marketing companies for post and phone campaigns with TPS/MPS checks, digital marketing platforms for lookalike audiences, and IT support companies for infrastructure and hosting.

If we transfer your personal data outside the UK or the European Economic Area, we ensure appropriate safeguards such as standard contractual clauses are in place.

Direct Marketing

With your consent, we will use your personal data, preferences and details of your transactions to keep you informed by email, web, text, telephone and through our head office about relevant offers and activities including tailored special offers, discounts, promotions, events, competitions and so on.

Of course, you are free to opt out of hearing from us by any of these channels at any time.

We may also contact you to send communications required by law or which are necessary to inform you about our changes to the services we provide you. For example, updates to this Privacy Notice, product recall notices, and legally required information relating to your orders. These service messages will not include any promotional content and do not require prior consent when sent by email or text message. If we do not use your personal data for these purposes, we would be unable to comply with our legal obligations.

Combining your data for personalised direct marketing

We want to bring you offers and promotions that are most relevant to your interests and particular age group of children. To help us form a better, overall understanding of you as a customer, we combine your personal data gathered from membership with your visit history at any of the Escapade Group attractions across the UK.

Marketing evaluation and targeting

We may collect and use your IP address and related online identifiers to understand how visitors interact with our website, measure the effectiveness of our marketing activities, and improve our services. We may also share this information with trusted marketing and analytics providers, such as Sky, to help us analyse audience engagement, identify organisations visiting our website, and deliver more relevant and targeted marketing communications where permitted by applicable law.

Meta and data sharing

We may share your data with Meta; this is to create and manage advertising audiences. This helps us to ensure our marketing is relevant to be both existing and prospective customers and to understand the effectiveness of our advertising campaigns and create audiences of people with similar interests to our customers

What information is shared?

The information shared for this purpose is limited to customer email addresses. In some cases, we may process additional contact details (such as telephone numbers) where this is held by us, and this has been specifically approved for use.

Before this information is uploaded to Meta, this data is converted to an encrypted format, this helps us ensure the security of your information.

We do not share payment information, detailed booking information, health information or any special category or children’s details for this processing activity.

How Meta uses the information

Meta uses the encrypted data to match these to registered accounts on Facebook and Instagram. Where a match is found, this data may be used to:

• Create and manage marketing to Custom audiences

• Exclude existing customers from certain targeted marketing campaigns

• Create similar audiences based on those that are interested in Escapade

• Improve our advertising measurements and effectiveness of these

Our marketing agency, Navigate, does not retain a copy of this customer list and only has access to campaign reporting based on this data

Our lawful basis

We rely on our legitimate interests to process personal data in this way. These interests include promoting our services effectively, making our advertising more relevant, reducing unnecessary marketing, and understanding the performance of our advertising campaigns.

We assess these interests against your rights and freedoms before carrying out this processing. Our interests will not cause our customers any harm or disproportionate risk

We will only use this personal data to serve this purpose and will not be shared or processed for any other purpose.

Where personal information was collected solely on the basis of consent, we will only use it for these purposes while that consent remains valid.

International transfers and Meta

Meta may process personal data in countries outside the United Kingdom, including the United States and other locations where Meta or its service providers operate. Where personal data is transferred internationally, Meta states that it applies safeguards designed to protect personal data in accordance with applicable data protection laws.

Depending on the circumstances, these safeguards may include transfers to countries benefiting from an adequacy decision or the use of UK-approved contractual transfer mechanisms. Further information about the safeguards applied to international transfers can be requested from us using the contact details set out in this Privacy Notice.

We will take reasonable steps to ensure that any international transfers are subject to appropriate protections and that personal data continues to receive a level of protection consistent with UK data protection requirements.

Your right to object

You have the right to object at any time to the use of your personal information for direct marketing purposes, including the creation and use of advertising audiences on Meta platforms.

If you wish to object, please contact [email protected]. We will stop using your information for Meta advertising audiences, remove or exclude you from active audiences, and retain only the minimum information necessary to ensure your preference is respected in the future.

7. Use of Escapade Group Social Media Sites

Social media platforms have their own terms, privacy policies, and cookie usage. Users should avoid sharing sensitive personal information such as name, address, date of birth, or annual pass numbers on public posts. We may share personal data with social media platforms to enhance advertising campaigns, target content, and improve customer engagement. This sharing is always done in line with GDPR and our lawful bases of consent or legitimate interest.

8. Links to Other Websites

Our website may include links to external sites. We do not control these sites and cannot take responsibility for how they handle your data. Users should review the privacy policies of any third-party websites they visit.

9. Retention & How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with legal, regulatory, or business obligations.

Users may contact us for data-specific retention inquiries.

10. Your Rights

Under UK GDPR, you have the right to access, correct, delete, restrict, or object to the processing of your personal data. You also have the right to data portability and to withdraw consent for marketing and profiling at any time.

Subject Access Requests (SARs)

Requests for access to personal data that we hold can be made via [email protected]. We will acknowledge any such request made within 30 days and respond as appropriate, if in the event we cannot fulfil a request we will explain the grounds for this.

Under the Data Use and Access Act 2025, there has been the introduction of the right to complain, which means that you come to us prior to going to the ICO if you have any complaints or concerns. We will do our best to resolve this for you. However, if you think our collection or use of personal information is unfair, misleading or inappropriate or if you have concerns about the security of your personal information, you also have the right to make a complaint to the Information Commissioner’s Office.

You can contact the Information Commissioner’s Office at the following address:

Information Commissioner’s Office, Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
T (0303 123 1113)

Your right to withdraw consent

Where we rely on your consent as the lawful basis for processing your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before your consent was withdrawn.

You may withdraw your consent by contacting us using the details provided in this notice or by using any available opt-out mechanism. Upon receipt of your request, we will cease processing your personal data for the purposes for which consent was withdrawn unless we have another lawful basis for continuing that processing.

11. Security & Your Data

We implement technical and organisational measures to protect personal data, including network encryption, secure hosting, authentication, role-based access, staff training, audits, and physical security for on-site records. We take all reasonably practicable steps to prevent unauthorised access, loss, or disclosure.

12. Data Breach Notification

In the event of a personal data breach, Escapade Group will notify the Information Commissioner’s Office (ICO) within 72 hours where required by law. If the breach poses a high risk to the rights and freedoms of individuals, we will also inform the affected parties without undue delay. Our response process includes investigation, containment, assessment of risk, and implementation of corrective measures to prevent recurrence.

13. Automated Decision-Making & Profiling

Escapade Group may use personal data for analytics, marketing, and creating lookalike audiences to enhance guest experience and improve campaigns. We do not make automated decisions that have legal or similarly significant effects on individuals. Any profiling is limited to legitimate business and marketing purposes and always ensures that your rights and freedoms are respected.

14. Changes to this Policy

We may update this privacy policy from time to time to reflect changes in the law, technology, or our business practices. Updated versions will be published on our website with the revised “Last Updated” date. Where there are material changes that affect your rights or the way we process your personal data, we will draw your attention to these changes.

15. Contact Us

If you have any questions regarding this notice, please contact us at [email protected]

You can contact us at the below address:

Hobbledown Ltd,
Horton Lane,
Epsom,
England,
KT19 8PT