Privacy Policy | Front Row Breaks

1. About this policy

This policy explains how Front Row Breaks collects, uses, shares and protects personal data when you use our website at www.frontrowbreaks.com (the "Site"), place a booking with us, contact us, or interact with our marketing. It applies to all personal data we hold about visitors, customers, prospective customers and other individuals whose data we process.

We are committed to handling your data lawfully, fairly and transparently. This policy is written in plain English. If anything in it is unclear, please contact us using the details in section 11.

2. Who is the data controller

Front Row Breaks is the data controller for the personal data we collect through the Site and in connection with bookings made through us. Our registered company details and contact information are set out on our contact page.

3. What personal data we collect

We collect personal data in the following categories:

Account and booking data: name, email address, postal address, telephone number, date of birth (where required by an event organiser), the names of other people travelling on your booking, and any accessibility requirements you tell us about.
Payment data: billing address and the last four digits of the card used. Full card numbers and security codes are entered into our payment provider's secure environment and are not stored on our servers.
Communications: the content of emails, web chat conversations, telephone calls (which may be recorded for quality and training purposes if we tell you so at the start of the call), and contact form submissions.
Technical data: IP address, browser type and version, device type, operating system, referring URL, pages viewed, time spent on pages and other usage data collected by cookies and similar technologies. See our Cookie Policy for the full list.
Marketing preferences: the categories of marketing you have consented to receive (or opted out of), and your responses to our marketing.

4. How we collect personal data

We collect data directly from you when you create an account, place a booking, contact us, sign up for marketing, or otherwise interact with the Site. We also collect technical data automatically through cookies and similar technologies. Occasionally we receive data from third parties such as ticket suppliers (for example, when an event organiser provides us with information about your seat or hospitality allocation) and from payment providers (for example, payment confirmation messages).

5. How we use your personal data and the legal basis

Under UK GDPR we need a legal basis for each use of your data. The bases we rely on are:

Performance of a contract: to take and fulfil your booking, deliver your tickets, process payment, communicate with you about your booking, and handle any change, cancellation or complaint.
Compliance with a legal obligation: to keep accounting records required by HMRC, to respond to lawful requests from regulators or law enforcement, and to defend legal claims.
Legitimate interests: to operate, maintain and improve the Site; to detect and prevent fraud; to keep our network and data secure; and to send service messages to existing customers about products similar to those they have already bought. Where we rely on legitimate interests we have considered your interests and rights and concluded that the use is proportionate.
Consent: to send you marketing communications by email about products you have not previously bought from us; to set non-essential cookies; and to use any sensitive accessibility information you provide to tailor your booking. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Who we share personal data with

We share personal data only with the categories of third party listed below, and only where it is necessary for the purpose described.

Ticket and hospitality suppliers: to issue your tickets and arrange any hospitality elements (for example, naming the guests on the booking, providing dietary requirements where applicable).
Hotel and accommodation suppliers: to make and manage your reservation.
Payment providers: to take payment, process refunds and prevent payment fraud.
Email delivery and communications providers: to send transactional and marketing emails on our behalf.
Analytics and advertising providers: where you have consented to non-essential cookies, to help us understand how the Site is used and to measure marketing performance. See our Cookie Policy for the named providers.
Professional advisers: our accountants, auditors and lawyers, where we have a legal or regulatory need to involve them.
Government bodies and law enforcement: where we are legally required to disclose data, for example in response to a court order or formal request from a regulator.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

7. International transfers

Some of the providers above are based outside the UK or the European Economic Area. Where this is the case we put appropriate safeguards in place, normally the UK International Data Transfer Agreement or the equivalent Standard Contractual Clauses, supplemented by additional measures where required. You can request a copy of the relevant safeguard by contacting us.

8. How long we keep personal data

We retain personal data only for as long as we need it for the purpose for which we collected it, or for longer where the law requires us to. As a guide:

Booking and account data: for seven years from the date of the booking, to comply with HMRC record-keeping rules and to handle any post-event complaints.
Marketing data: until you unsubscribe or otherwise withdraw consent.
Web analytics data: for up to 26 months from collection, unless aggregated.
Customer-service correspondence: for up to three years from the last interaction, unless connected to an ongoing matter.

9. How we protect personal data

We use a combination of technical and organisational measures to protect your data, including encrypted connections (TLS) for traffic to and from the Site, restricted access to systems containing personal data, regular security patching, and staff training on data handling. No system is perfectly secure, so we cannot guarantee absolute security, but we treat protection of your data as a priority.

10. Your rights under UK GDPR

You have the following rights in relation to your personal data:

Access: to a copy of the personal data we hold about you.
Rectification: to ask us to correct data that is inaccurate or incomplete.
Erasure: to ask us to delete your data in certain circumstances (sometimes called "the right to be forgotten").
Restriction: to ask us to restrict the processing of your data in certain circumstances.
Portability: to receive certain categories of your data in a structured, machine-readable format, and to ask us to send it to another controller.
Objection: to object to processing based on our legitimate interests, including for direct marketing.
Withdraw consent: where we rely on consent for a particular use, you can withdraw it at any time.
Complain: to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would appreciate the chance to address your concerns first.

To exercise any of these rights please contact us using the details below. We will respond within one month, although complex requests may take longer in which case we will let you know.

11. Contact

For privacy questions, to exercise any of your rights, or to report a concern, please contact us using the email address listed on our contact page and mark the message for the attention of "Data Protection".

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page shows the most recent revision. If we make significant changes we will draw them to your attention before they take effect, for example by email or by a banner on the Site.