Data & Security Policy

1. GDPR Compliance

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a data controller, we process personal data lawfully, fairly, and transparently.

1.1 Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Consent — When you subscribe to our newsletter, create an account, or store pass/ticket data in your wallet.
• Legitimate Interest — To operate, maintain, and improve the Service, and to protect the security of our systems.
• Contractual Necessity — To provide features you have signed up for, such as account access and pass management.

1.2 Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

• Right of Access — Request a copy of the personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing — Request we limit how we use your data.
• Right to Data Portability — Receive your data in a structured, machine-readable format.
• Right to Object — Object to processing based on legitimate interest.
• Right to Withdraw Consent — Withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at unofficialaltontowers@gmail.com. We will respond within 30 days.

2. Data Sharing & Third Parties

2.1 What We Share

We do not sell your personal data to any third party. We may share limited data with the following categories of processors:

• Hosting & Infrastructure — Our backend infrastructure provider stores account data, pass information, and chat messages using industry-standard encryption at rest and in transit.
• Email Services — If you subscribe to our newsletter, your email address is shared with our email delivery provider solely to send you the content you requested.
• Analytics — We may collect anonymised usage data (pages visited, device type) to improve the Service. This data cannot identify you personally.

2.2 Affiliate Links

This Service contains affiliate links to Alton Towers (altontowers.com), Merlin Annual Pass, and partner websites. When you click these links, those third-party sites may collect data under their own privacy policies. We have no control over, and accept no responsibility for, data collected by third-party websites.

2.3 Law Enforcement

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g. a court or government agency).

3. Data Storage & Retention

• Account data (email, profile information) is retained for as long as your account is active.
• Pass and ticket barcode data you enter is stored in encrypted form and is accessible only to you when authenticated.
• Chat messages are retained for up to 90 days for support purposes and then automatically purged.
• Newsletter subscriber data is retained until you unsubscribe.
• Upon account deletion, all associated personal data is permanently removed within 30 days.

5. Our Security Measures

We take the following steps to protect your data:

• All data is transmitted over HTTPS (TLS 1.2+) encryption.
• Passwords are hashed using industry-standard algorithms and are never stored in plain text.
• The Pass Wallet requires password re-authentication before displaying sensitive barcode data.
• Quick Access Wallet includes geofencing (park-only unlock) and automatic timeout locks.
• Administrative access is restricted via role-based access control (RBAC).
• Database access is governed by row-level security policies ensuring users can only access their own data.

6. Limitation of Liability

To the fullest extent permitted by applicable law, Unofficial Alton Towers and its operators shall not be liable for any loss, damage, or unauthorised access to your data arising from:

• Your failure to maintain the security of your account credentials or device.
• Your decision to store sensitive data (e.g. pass barcodes) within the Service.
• Unauthorised access to your account due to weak, reused, or compromised passwords.
• Actions taken by third-party websites accessed via affiliate links on this Service.
• Any data breach caused by circumstances beyond our reasonable control.

7. Children's Data

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it promptly.

8. International Data Transfers

Your data may be processed on servers located outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the UK Information Commissioner's Office (ICO).

9. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, and will inform affected users without undue delay, in accordance with GDPR Article 33 and 34.

10. Changes to This Policy

We reserve the right to update this policy at any time. Material changes will be communicated via a notice on the Service or by email where appropriate. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact & Complaints

For any questions about this policy or to exercise your data rights, contact us at unofficialaltontowers@gmail.com.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.