Maintaining the privacy and security of your personal data is a priority at Centre VR Ltd, and we are committed to respecting your rights and handling your personal data fairly and legally at all times. We will also be transparent about what data we collect about you and how we use it.
This policy applies to the personal data that Centre VR Ltd collects and holds about you whether you: visit our centres, contact us via phone, email or chat, or visit our website at centrevr.co.uk
It provides you with information about:
- What personal data we collect
- How and when we use and process this data for our legitimate business interests
- The safeguards we have in place to ensure your privacy is maintained
- Your legal rights relating to personal data and how you can instruct us if you prefer to limit the use of this data
What data we collect
We may collect data from you:
- When you purchase services or products from us, in store or online
- When you browse our websites or receive emails from us
- If you contact us via phone, email or chat
- If you visit one of our centres
- If you respond to a feedback survey, enter a competition with us or interact with our social media channels
This data may include the following:
- Name, gender and date of birth
- Contact details including your address, telephone numbers and email address
- Records of your transactions including what and when you purchased from us
- Payment card details
- Marketing preferences and your survey responses
- Correspondence and communications with Centre VR Ltd
- CCTV recordings within our centres or accident & incident reports
- Other publicly available personal data, including any which you have shared via a public platform (such as Twitter, Instagram and public Facebook pages)
Our websites are not intended for use by children and we do not knowingly collect personal data relating to persons under the age of 16. We ask that parents and guardians ensure that children do not submit personal data via our websites or in our centres.
This list is not exhaustive and in specific instances, we may need to collect additional data for the purposes set out in this policy. Some of the above personal data is collected directly, for example when you send an email to our customer contact team. Other personal data is collected indirectly, for example, through your website browsing or transaction activity.
What do we do with this data
Centre VR Ltd and selected partners acting on our behalf may process and use your personal data:
- To provide leisure services and products to you
- To make websites available to you
- To improve our understanding of our customers and to improve the services we provide to them
- To verify your identity
- For crime and fraud prevention and detection
- For the purposes of maintaining the safety and security of our customers and team members
- For market research purposes after your visit
- To help us manage customer service communications with you
- To contact you about promotional offers and services which we think may interest you
- Where we have a legal right or duty to use or disclose your data for example for maintaining adequate accounting records; or in relation to an investigation by a public authority; or in a legal dispute or insurance claim.
Centre VR Ltd never rents or sells personal data to third parties for their marketing purposes.
Centre VR Ltd may use your personal data for electronic marketing purposes primarily where we aim to update you about offers and services which we believe are of interest and relevance to you. We will only do so where we have a lawful basis to do so.
- You have the right to opt out of receiving marketing communications at any time, by:
- The “opt out” link in emails
- Contacting Centre VR Ltd via the contact details listed below:
In order to contact you about services and offers that are relevant to you, we may analyse your browsing and purchasing activity, both on-line, via our customer contact service or in our centres as well as your responses to our marketing communications. We may use software and other automated technology to help us to do this analysis.
Sharing data with third parties
In order to provide our services, securely fulfil transactions and provide you relevant marketing communications, we may need to share your personally identifiable data or anonymised data with selected partners including payment processing companies, IT service providers (such as hosting companies), analytics companies and marketing services agencies.
- Centre VR Ltd only allows its service partners to handle your personal data when they conform to the appropriate data protection and security controls. Our service partners have obligations relating to data protection and security restricting their use of your data to provide services to HBG and to you, and for no other purposes
- We never sell or rent our customer data to other organisations for marketing purposes
Aside from our service partners, Centre VR Ltd will not disclose your personal data to any third party, except as listed below
- governmental bodies, regulators, law enforcement agencies, courts/tribunals and insurers where we are legally required to do so
- to comply with our legal obligations
- to exercise our legal rights (for example in court cases)
- for the prevention, detection, investigation of crime or prosecution of offenders; and
- for the protection of our team members and customers.
How long we keep your data
We will not retain your data for longer than necessary for the purposes set out in this Policy. In general, we will keep your data for the duration of our relationship with you and for a certain period afterwards. In considering how long to keep it, we take into account the nature of the information, the nature of the relationship with you, the relevance of the information, and our obligations to comply with applicable laws and regulations.
The longest we hold any personally identifiable data is 4 years after your last order, interaction with our marketing communications, contact with our customer contact centre or visit to one of our centres. After that time, we anonymise any transactional data that we hold for the purposes of accounting records or business analysis.
How do we protect your data
Centre VR Ltd is committed to keeping your personal data safe and secure and we follow strict security procedures, technical and organisational measures which include:
- cyber security assessments of all service providers who handle your personal data
- regular incident management reviews to ensure we are ready to respond to cyber security attacks and data security incidents
- regular network vulnerability scans
- intrusion detection and monitoring through leading network infrastructure solutions
- security controls which protect the HBG IT infrastructure from external attacks and unauthorised access
- real time scanning to protect against malicious threats to HBG IT infrastructure
- internal policies setting out our data security approach
- data security and data processing training for team members
- secure WEEE disposal of all redundant IT hardware
Extra EEA Transfers
If you are based within the EEA, please note that we may transfer personal information to countries outside the EEA. Not all countries provide the same level of protection in relation to personal information as within the EEA. Where necessary to make such transfers, we will comply with our legal and regulatory obligations in relation to the personal information. This will include having a lawful basis for transferring personal information and putting appropriate safeguards in place to ensure an adequate level of protection for the personal information.
Our legal basis for processing personal data
We process customer data on a carefully considered and specific legal basis. This basis may be where you have given your consent; or for the performance of a contract; or where necessary to comply with a legal obligation; or where necessary to protect the safety or other vital interests of an individual; or where it is necessary for the purposes of the legitimate interests of Centre VR Ltd or another party. Examples of the “Legitimate interests” of Centre VR Ltd, include the interests of Centre VR Ltd in conducting and managing our business to enable us to provide the best experience to our customers including:
- operating networks and systems to allow us to securely sell and supply our goods and services
- processing and analysing data to get a more informed picture of our customers’ behaviour, activities, preferences and needs
- using this insight to help us enhance the products and services we offer our customers
- to better understand how customers, interact with our websites to help us improve the functionality and content of our customer’s online experience
- promoting, marketing and advertising our services and determining the effectiveness of these campaigns to help us improve the relevance of our communications to our customers
- protecting customers, team members and other individuals and maintaining their safety and welfare
- handling customer contacts, queries, complaints or disputes including managing insurance claims
- protecting Centre VR Ltd, our team members and customers, by taking appropriate legal action against third parties who have committed criminal acts or are in breach of legal obligations to Centre VR Ltd
- preventing, investigating and detecting crime, fraud or anti-social behaviour and prosecuting offenders, including working with law enforcement agencies
- handling any legal claims or regulatory enforcement actions taken against HBG
- complying with our legal and regulatory obligations
- fulfilling our duties to our customers, our team members, our shareholders and other stakeholders
When we process your personal data based on our legitimate interests, we make sure we consider and balance any positive or negative impacts on you and your data protection rights against our rights and interests. We will not use your personal data for activities where our interests are over ridden by the impact on you (unless we have your consent or are otherwise permitted by law). Whenever we process your data, we ensure that we always take account of your rights.
Subject to certain exemptions, you have the following rights relating to updating, rectifying and deleting your personal data held with us:
- the right to opt out of any marketing communications that we may send you
- the right to ask what personal data that we hold about you and receive a copy of it
- the right to ask us to update and correct any out-of-date or incorrect personal data that we hold about you
- the right to erasure of your personal data in certain circumstances or to restrict the processing of your data rather than having it erased
- the right to object to the processing of personal data when Centre VR Ltd processes personal data for legitimate purposes but you do not feel that your interests or fundamental rights or freedoms have been protected
- with effect from 25 May 2018, you have the right, in certain circumstances, to obtain personal information you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice
- you have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us
- if we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time
- the right to lodge a complaint about how your data is being used or processed with a supervisory authority (in the UK, that’s the ICO, see their website at https://ico.org.uk/make-a-complaint/ or call their office on 0303 123 1113)
If you have any questions about how Centre VR Ltd uses your personal data that are not answered here, please
This policy was last updated in March 2019.