Privacy Policy

PURPLE FROG ENTERTAINMENT PRIVACY POLICY — VERSION 1.0

Purple Frog Entertainment respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how Purple Frog Entertainment collects, uses, stores, shares and protects personal information when you:

• visit one of our websites;
• make an enquiry;
• request or receive a quotation;
• book or purchase our services;
• provide information about an event, venue or site;
• communicate with us;
• receive marketing from us;
• work with us as a venue contact, supplier, subcontractor or event contact;
• are assigned to an event as a member of our crew or operational team; or
• otherwise interact with Purple Frog Entertainment or one of its trading brands.

It also explains your rights in relation to your personal information.

This is the business-level Privacy Policy for Purple Frog Entertainment and the trading names through which it provides services.

For the purposes of applicable UK data protection law, the relevant business and data controller is:

Purple Frog Entertainment

5 Oxford House 17 London Road Cirencester Gloucestershire GL7 2PU United Kingdom

Privacy email: privacy@purplefrogentertainment.co.uk

Telephone: 03330 151 826

Purple Frog Entertainment's company registration is currently in progress. The company number will be added when issued.

VAT registration is currently in progress. The VAT number will be added when issued.

These pending registration numbers do not change who is responsible for the processing described in this Privacy Policy.

Purple Frog Entertainment operates services through a number of trading names and associated websites.

These include, as applicable:

• Globe Hire;
• Pop Up Beach;
• Crazy Golf Events / Pop-Up Golf;
• Boulder & Cave;
• Town Centre Trails;
• Christmas Experience; and
• other Purple Frog Entertainment trading names introduced from time to time.

These are trading brands of Purple Frog Entertainment and should not be understood from this Privacy Policy as separate subsidiaries or members of a corporate group.

Where you deal with one of these brands, your information is being processed by Purple Frog Entertainment in connection with that trading brand and the relevant service.

References in this Privacy Policy to "Purple Frog Entertainment", "we", "us" or "our" therefore include our activities carried out through those trading names.

The personal information we collect depends on how you interact with us and the services involved.

When you contact us or make an enquiry, we may collect:

• your name;
• business, organisation or employer;
• email address;
• telephone number;
• postal address where relevant;
• event or venue address;
• postcode;
• event date or proposed event date;
• event type;
• details of the service you are interested in;
• information contained in your enquiry;
• messages and correspondence; and
• other information you voluntarily provide to us.

If you request a quotation or proceed with a booking, we may also collect and process:

• customer and organisation details;
• billing and invoicing information;
• quotation details;
• booking details;
• services, options and extras selected;
• event dates and operating times;
• event and venue information;
• delivery and collection information;
• site-access information;
• setup and de-rig information;
• logistical requirements;
• operational questionnaire responses;
• customer instructions;
• relevant correspondence;
• contractual records;
• acceptance or decline records;
• records showing acceptance of applicable terms;
• payment and accounting status; and
• information necessary to plan and deliver the booked service.

A customer may need to provide details of another person involved with an event, for example:

• a venue manager;
• event organiser;
• site contact;
• facilities contact;
• access contact;
• operational contact;
• supplier or contractor; or
• emergency/on-the-day contact.

This may include that person's:

• name;
• job title or role;
• organisation;
• work email address;
• telephone number; and
• relevant event or operational information.

If you provide another person's information to us, you should only provide information that is reasonably necessary for the event or service and, where appropriate, make them aware that their details have been provided to Purple Frog Entertainment.

We use this information for legitimate event administration, communication, access, safety, logistics and service delivery purposes.

Where we obtain personal information from someone other than the individual concerned, we will handle it in accordance with applicable data protection requirements.

We may collect information concerning:

• venue layout;
• access routes;
• unloading arrangements;
• parking;
• dimensions and available space;
• indoor or outdoor conditions;
• ground or surface conditions;
• venue restrictions;
• power or water availability where relevant;
• drainage arrangements where relevant;
• installation requirements;
• site-specific risks;
• agreed operating arrangements; and
• other information required to plan an event safely and effectively.

Some of this information will not itself be personal information. It becomes personal information where it identifies or relates to an identifiable person.

Where you work with or provide services to Purple Frog Entertainment, we may process information such as:

• your name;
• telephone number;
• email address;
• role;
• event or job assignments;
• availability where applicable;
• acknowledgement records;
• operational instructions;
• communications;
• timestamps associated with operational activity; and
• information necessary to coordinate the event.

Additional employment, contractor, payroll or personnel information, where applicable, may be subject to separate internal privacy information and is not necessarily governed solely by this customer-facing Privacy Policy.

Where necessary for quotations, bookings, invoicing and accounting, we may process:

• customer or organisation identity;
• billing address;
• contact information;
• invoice details;
• amounts invoiced;
• amounts paid;
• outstanding balances;
• payment status;
• payment references;
• accounting references; and
• identifiers used to reconcile our records with our accounting system.

We do not state in this policy that we store complete payment-card details unless we actually do so.

Where you have opted in to marketing, or where we are otherwise legally permitted to send marketing communications, we may process:

• your name;
• email address;
• organisation;
• relevant customer or enquiry history;
• the trading brand or service you interacted with;
• your marketing preferences;
• the date, source and method of your consent where applicable;
• unsubscribe or objection records; and
• engagement information where supported by the marketing service we use.

We may also maintain suppression records so that we remember not to send marketing to somebody who has opted out.

When you interact with our systems, websites, emails or secure links, we may process technical information such as:

• IP address;
• browser or device information;
• user agent;
• date and time;
• request and access logs;
• security events;
• rate-limiting information;
• email delivery information;
• secure-link activity;
• quotation acceptance or decline timestamps;
• booking-form activity;
• audit records;
• authentication activity;
• integration records;
• error logs; and
• other information necessary to operate and protect our systems.

We only describe cookies, analytics and similar technologies as being in use where they are actually implemented.

Our ordinary enquiry and booking processes are not designed to collect unnecessary sensitive or special-category personal information.

Unless we specifically ask for information for a legitimate and lawful reason, please do not use free-text enquiry or booking fields to send us unnecessary information concerning matters such as:

• health or medical conditions;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• genetic or biometric information;
• sex life or sexual orientation; or
• criminal convictions or offences.

There may be circumstances where accessibility, safety or event requirements make some sensitive information relevant. Where that happens, we will seek to collect only what is necessary and identify an appropriate lawful basis and, where required, an additional condition for processing special-category information.

Some Purple Frog Entertainment services and events may be suitable for or attended by children.

That does not mean that we routinely need to collect personal information directly from children.

Our normal enquiry and booking processes are intended to be completed by adults acting as customers, organisers, venues, parents, guardians or other responsible persons.

We do not intentionally seek unnecessary personal information about children through ordinary enquiry forms.

If a particular service in future requires personal information about a child, we will assess the privacy and safeguarding requirements of that processing separately and provide appropriate information where required.

We may obtain personal information:

• directly from you;
• through one of our websites or enquiry forms;
• when you contact us by email or telephone;
• when you request a quotation;
• when you complete a booking or logistics form;
• when you accept or decline a quotation;
• through correspondence with us;
• from another person involved with the same event;
• from your employer or organisation;
• from an event organiser;
• from a venue or site;
• from suppliers or contractors involved in delivering an event;
• from our accounting and operational systems;
• from our existing customer records;
• from our marketing records;
• from technical and security systems; and
• where lawful and appropriate, from publicly available business information.

Where another person gives us your details, this will commonly be because you are a venue, event, access, logistics or operational contact connected with a booking.

We use personal information only where we have a lawful reason to do so.

We use enquiry information to:

• understand what you are asking for;
• identify the relevant service or trading brand;
• contact you;
• prepare responses;
• assess availability and requirements;
• prepare quotations; and
• manage follow-up communications.

Our lawful basis will normally be taking steps at your request before entering into a contract and/or our legitimate interests in operating our business and responding to genuine business enquiries.

We use information to:

• prepare quotations;
• calculate or manually determine prices;
• identify selected services and options;
• record quotation status;
• provide secure access to quotations;
• record acceptance or decline;
• preserve the applicable contractual terms; and
• create the relevant operational records if a quotation is accepted.

This processing is generally necessary to take steps before entering into a contract and, after acceptance, to perform our contract.

We use booking, venue, customer and operational information to:

• plan the event;
• arrange delivery and collection;
• assess site access;
• organise setup and de-rig;
• allocate crew;
• communicate with customers and venue contacts;
• prepare operational documentation;
• address service-specific requirements;
• manage safety and logistics;
• provide the agreed service; and
• resolve operational issues.

Our lawful bases may include performance of our contract, taking pre-contractual steps, compliance with legal obligations and our legitimate interests in safely and effectively delivering our services.

We may use relevant information to:

• prepare and administer operational safety documentation;
• investigate accidents, incidents or complaints;
• manage risks;
• protect customers, members of the public and our personnel;
• establish, exercise or defend legal claims; and
• comply with applicable legal and regulatory obligations.

Depending on the circumstances, the lawful basis may include legal obligation and/or legitimate interests.

We use appropriate customer, transaction and booking information to:

• issue and administer invoices;
• record payments;
• reconcile accounts;
• manage outstanding amounts;
• maintain financial records;
• prevent duplicate transactions;
• respond to accounting enquiries; and
• comply with tax, accounting and other legal obligations.

The lawful bases may include performance of a contract, legal obligation and legitimate interests.

Because Purple Frog Entertainment operates multiple trading brands, we may maintain a shared customer relationship record showing which Purple Frog Entertainment brands or services a customer has interacted with.

We may use this to:

• understand previous enquiries and bookings;
• avoid unnecessary duplication;
• provide continuity of service;
• resolve customer-service issues; and
• maintain accurate business records.

This is internal processing within one business operating multiple trading names. It should not be understood as disclosure of your information between separate companies.

Our lawful basis is generally our legitimate interests in efficiently administering customer relationships and operating our business, subject to your rights.

Purple Frog Entertainment uses, or may use, artificial-intelligence-assisted tools as part of its internal enquiry and customer-service workflow.

For example, information contained in an enquiry or message may be processed by an AI-assisted service to help us:

• classify an enquiry;
• identify the relevant subject or service;
• summarise correspondence;
• organise information;
• assist a member of staff in preparing a response; or
• prepare a draft communication for human review.

This means that personal information contained in an enquiry or message may be transmitted to and processed by an AI technology provider acting as a service provider or processor, subject to the arrangements we have with that provider.

We seek to limit the information supplied to AI-assisted services to what is reasonably necessary for the relevant purpose.

AI assistance does not replace our responsibility for the service we provide.

We do not use this AI assistance to make solely automated decisions that produce legal or similarly significant effects on customers. Customer communications, quotations, bookings and significant commercial or operational decisions remain subject to appropriate human control or review.

We will review this section if our use of AI changes materially.

Purple Frog Entertainment carries out, and intends to expand, direct email marketing relating to its services and trading brands.

We may send marketing where:

• you have given valid consent to receive it; or
• another lawful route for the particular communication is available, including the electronic-mail soft opt-in where all applicable requirements are satisfied.

We do not treat the mere act of submitting an enquiry as blanket consent to receive marketing.

Where we ask for marketing consent, it should be:

• separate from an enquiry or booking;
• optional;
• clearly explained;
• based on a positive choice rather than a pre-ticked box; and
• recorded so that we can demonstrate when and how the choice was made.

Purple Frog Entertainment may maintain or use existing customer and marketing records held in another CRM or marketing system.

Before those records are used for a new marketing campaign, we will take reasonable steps to establish that we have an appropriate basis to use the relevant contact details for the intended marketing.

Where we rely on consent, the available evidence should demonstrate that the consent appropriately covers Purple Frog Entertainment, the communication method and the relevant marketing.

We will not describe an historic list as "opted in" merely because the people on it were previous customers or contacts.

Because the trading brands covered by this policy are operated by Purple Frog Entertainment rather than separate group companies, marketing may refer to relevant Purple Frog Entertainment services or trading brands where the applicable marketing permission or other lawful route properly covers that marketing.

We will not extend a narrowly worded consent beyond what the person was reasonably told they were agreeing to.

You may opt out of email marketing at any time.

Every active electronic marketing system we use must provide a straightforward way to unsubscribe or otherwise object to further marketing.

If you opt out, we may retain limited information on a suppression list. This is so that we can respect your request and avoid accidentally adding you back to marketing.

Withdrawing marketing consent does not affect service, booking, contractual or other non-marketing communications that we still need to send for a separate lawful reason.

Where we rely on legitimate interests, those interests may include:

• operating and developing Purple Frog Entertainment;
• responding to genuine enquiries;
• administering customer relationships;
• providing customer service;
• organising and delivering events;
• communicating with appropriate business and venue contacts;
• maintaining accurate operational records;
• protecting our systems;
• preventing fraud, misuse and duplicate transactions;
• maintaining audit trails;
• establishing or defending legal claims; and
• improving the efficiency and security of our operations.

Where required, we balance those interests against the rights, interests and reasonable expectations of the individuals concerned.

You have the right to object to processing based on legitimate interests in certain circumstances.

If you give us another person's personal information — for example, the details of a venue manager or site contact — please:

• provide only information relevant to the booking or event;
• make sure you have an appropriate reason to provide it; and
• where appropriate, tell that person that their information has been supplied to Purple Frog Entertainment and direct them to this Privacy Policy.

Where practical, we may also provide privacy information directly when we first communicate with that person.

We will use such information for the purposes reasonably connected with the relevant event, booking, safety requirement or business communication.

We do not sell personal information.

We may disclose or provide access to personal information where reasonably necessary to:

• technology and hosting providers;
• database and infrastructure providers;
• transactional email providers;
• business email/mailbox providers;
• CRM and customer-management providers;
• AI-assisted technology providers;
• accounting providers, including Xero where used;
• marketing/email campaign providers;
• IT and security providers;
• professional advisers, including accountants and lawyers;
• insurers;
• suppliers, subcontractors and event partners where information is necessary for delivery;
• venues and event organisers where necessary;
• competent authorities, regulators, courts or law-enforcement bodies where legally required; and
• prospective purchasers or advisers in connection with a genuine sale, restructuring or transfer of the business, subject to appropriate safeguards.

A service provider processing personal information on our behalf is expected to process it only for the relevant purposes and in accordance with applicable contractual and data-protection requirements.

We seek to share only the information reasonably necessary for the particular purpose.

Purple Frog Entertainment may use Xero or another accounting platform for formal accounting records.

Where applicable, information sent from our CRM or business systems to the accounting platform may include:

• customer/contact name;
• organisation;
• contact details;
• billing address;
• invoice information;
• transaction values;
• payment information or status;
• accounting references; and
• related identifiers.

Our systems may receive accounting information back, including invoice status, payment status, payment records and accounting identifiers.

Accounting information may need to be retained for longer periods because of legal, tax and financial-record obligations.

We may provide unique secure links to allow authorised recipients to:

• view a quotation;
• accept or decline a quotation;
• provide booking or logistics information;
• view information relevant to an event; or
• acknowledge a crew assignment or operational instruction.

These links may provide access without requiring a conventional username and password. Anyone with access to such a link may therefore potentially be able to access the information made available through it.

Recipients should:

• treat secure links as confidential;
• not forward them to anyone who does not need access; and
• contact us if they believe a link has been disclosed to the wrong person.

Purple Frog Entertainment applies appropriate lifecycle controls to secure links, including expiry and/or revocation appropriate to the type of link and the continuing business need for access.

We may log access to secure links for security, audit and evidential purposes.

We do not keep personal information for longer than we reasonably need it.

The appropriate period depends on the nature of the information, why it was collected, contractual and legal requirements, the possibility of a dispute or legal claim, and whether it remains necessary for operational or security purposes.

Our retention framework is:

Ordinary enquiries that do not result in a booking should normally be retained for up to 24 months after the last meaningful interaction, unless there is a reason to retain them for longer, such as an ongoing dispute, safeguarding matter, legal claim or specific consent for another purpose.

Quotation and associated correspondence that does not result in a booking should normally be retained for up to 24 months after expiry, decline or the last meaningful interaction, subject to any legal or dispute-related reason for longer retention.

Core customer, booking, contractual and job records should normally be retained for up to six years after completion of the relevant contractual relationship or last relevant transaction, reflecting the need to maintain business records and deal with potential contractual disputes.

Information that is no longer necessary within a retained record should be minimised or removed where reasonably practicable.

Records required for tax, VAT, accounting or other financial-record obligations will generally be retained for at least six years or for such longer period as applicable law requires.

Detailed operational and logistics information should normally be retained with the relevant job for as long as reasonably necessary for event administration, dispute handling, safety records and the associated contractual record.

Where detailed information has no continuing evidential, legal or operational purpose, it should not be retained merely because the underlying customer record remains.

Third-party event or venue contact information should be retained only for as long as it remains reasonably necessary in connection with the event, associated records, repeat operational requirements or a legal/dispute requirement.

Active marketing records may be retained while we have an appropriate basis to send the relevant marketing.

If you unsubscribe or object, we may retain the minimum information necessary on a suppression list for as long as reasonably necessary to ensure that your preference continues to be respected.

Evidence of consent, withdrawal, objections and marketing preferences may be retained for as long as reasonably necessary to demonstrate compliance and respect the individual's current preference.

Business correspondence may be retained alongside the enquiry, customer, booking or contractual record to which it relates.

Security, access and technical logs should be retained for a limited period appropriate to their purpose, unless a particular log needs to be retained longer to investigate a security event, fraud, dispute or legal matter.

Where information is relevant to an actual or reasonably anticipated complaint, incident, insurance matter, investigation or legal claim, we may retain it until the matter is resolved and for an appropriate period afterwards.

We periodically review our retention and deletion processes so that the operation of our systems reflects these principles.

Our websites and administrative systems may use cookies, local storage, session storage or similar browser technologies where required for functions such as:

• security;
• authentication;
• administrative sessions;
• form functionality;
• remembering essential state; or
• other technical operation.

We will not describe analytics, advertising or marketing cookies as being in use unless they actually are.

If we introduce non-essential analytics, advertising or similar tracking technologies that require consent, we will update our notices and implement an appropriate consent mechanism before using them where required.

A satellite website may provide additional cookie information where its technical configuration differs from the rest of our websites.

Our email systems may generate technical records such as:

• delivery status;
• bounce status;
• send time;
• message events; and
• where enabled by the relevant service, engagement events such as opens or link interactions.

We use this information where appropriate to administer communications, diagnose delivery problems, maintain records and understand communication effectiveness.

Where marketing technology introduces additional tracking, we will assess the transparency and consent requirements applicable to that technology.

Some technology providers used by Purple Frog Entertainment may process information outside the United Kingdom.

We will not state that all personal information remains exclusively in the UK or EEA unless we have verified that this is true.

Where personal information is transferred internationally and UK data-protection law requires safeguards, we will take appropriate steps to ensure that a lawful transfer mechanism is in place.

Depending on the provider and destination, this may include:

• UK adequacy regulations;
• appropriate contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another transfer mechanism permitted by applicable law.

Information about relevant safeguards can be requested using the contact details in this policy.

Our processor and international-transfer arrangements should be reviewed as providers and infrastructure change.

We use organisational and technical measures intended to protect personal information against accidental or unlawful:

• loss;
• destruction;
• alteration;
• unauthorised disclosure; or
• unauthorised access.

Depending on the system, measures may include:

• restricted administrative access;
• role-based permissions;
• secure customer links;
• server-side controls;
• separation of customer-facing and administrative functionality;
• secure handling of integration credentials;
• rate limiting;
• audit records;
• transaction and idempotency controls;
• controlled brand identities;
• authentication;
• appropriate provider access controls; and
• procedures intended to prevent information being sent through the wrong trading brand.

No internet-connected system can be guaranteed to be completely secure, but we review our controls and seek to address identified risks proportionately.

We take reasonable steps to keep personal information accurate and up to date.

Please tell us if information we hold about you is incorrect or has changed.

Where information is supplied by another person — for example, an event organiser giving us a venue contact — we may rely on the information supplied unless we have reason to believe it is inaccurate.

Depending on the circumstances and the lawful basis involved, UK data-protection law may give you rights including:

You may ask whether we process your personal information and request a copy of personal information we hold about you.

You may ask us to correct inaccurate information or complete information that is incomplete.

In certain circumstances, you may ask us to delete your personal information.

This right is not absolute. We may need to retain information where we have a lawful reason or legal obligation to do so.

In certain circumstances, you may ask us to restrict how we process your personal information.

You may object to certain processing based on our legitimate interests.

YOU HAVE THE RIGHT TO OBJECT TO THE USE OF YOUR PERSONAL INFORMATION FOR DIRECT MARKETING AT ANY TIME.

If you object to direct marketing, we will stop using your personal information for that purpose, subject to retaining appropriate suppression information to respect your request.

Where applicable, you may have the right to receive certain information you provided to us in a structured, commonly used and machine-readable format or ask for it to be transferred to another controller.

You may have rights concerning certain decisions made solely by automated means that have legal or similarly significant effects.

As described above, our current AI-assisted enquiry workflow is not intended to make such decisions about customers without appropriate human involvement.

Where we rely on your consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

To exercise a data-protection right or ask a privacy question, contact:

Purple Frog Entertainment 5 Oxford House 17 London Road Cirencester Gloucestershire GL7 2PU United Kingdom

privacy@purplefrogentertainment.co.uk 03330 151 826

We may need to ask for information to confirm your identity before disclosing or changing personal information.

We will respond in accordance with the timescales required by applicable data-protection law.

You will not normally have to pay a fee to exercise your rights. However, the law allows organisations to respond differently in certain circumstances, including where a request is manifestly unfounded or excessive.

If you have concerns about how we use your personal information, please contact us first so that we can investigate.

You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO).

Current contact information for the ICO can be found through its official website.

Making a complaint to us first does not remove your right to approach the ICO.

We may disclose personal information where we reasonably believe disclosure is necessary to:

• comply with law;
• comply with a court order or lawful regulatory requirement;
• respond to a competent authority;
• prevent or investigate fraud or crime;
• protect the rights or safety of individuals; or
• establish, exercise or defend legal claims.

Where legally permitted and appropriate, we will seek to limit disclosure to what is necessary.

If Purple Frog Entertainment or relevant business assets are sold, transferred, reorganised or restructured in future, personal information may form part of that transaction.

Any recipient would be required to handle personal information in accordance with applicable data-protection law.

This clause does not mean that Purple Frog Entertainment currently operates a parent-company or subsidiary structure.

We may update this Privacy Policy where:

• our services change;
• our technology changes;
• we introduce a new trading brand;
• our processors change;
• our marketing activities change;
• our use of AI changes;
• legal or regulatory requirements change; or
• we identify that greater explanation is appropriate.

The current version will state its effective date.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected individuals where required.

We intend to maintain an authoritative version of this Privacy Policy through Purple Frog Entertainment's central business systems so that our trading-brand websites can present consistent and current privacy information.

For privacy questions, requests or concerns:

Purple Frog Entertainment 5 Oxford House 17 London Road Cirencester Gloucestershire GL7 2PU United Kingdom

Privacy email: privacy@purplefrogentertainment.co.uk

Telephone: 03330 151 826

Company registration: in progress — number to be added when issued.

VAT registration: in progress — number to be added when issued.