Last updated: November 2025

INTRODUCTION

Picniq Limited (“we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, store, share, and protect your personal data when you:

• Visit our website at https://www.picniq.co.uk/
• Make bookings or purchases
• Subscribe to communications
• Participate in competitions, surveys, or promotions
• Contact us in any way

It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you do not agree with this Privacy Notice, please do not use our website or services.I

IMPORTANT INFORMATION AND WHO WE ARE

CONTROLLER

Picniq Limited is the data controller responsible for your personal data.

CONTACT DETAILS

Legal entity: Picniq Limited
Contact: Data Privacy Manager
Email: [email protected]

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

AGE RESTRICTIONS

Our services are intended for individuals aged 18 or over.

We do not knowingly collect personal data directly from children. Where bookings involve children:

• Personal data is provided only by a parent or legal guardian
• Data is collected solely for booking, safety, and legal purposes

THE PERSONAL DATA WE COLLECT

Personal data means any information that can identify you.

Identity Data
Name, title, date of birth, gender, username or account identifier.

Contact Data
Billing and delivery address, email address, telephone numbers.

Financial Data
Payments are processed securely by our third-party payment provider, Stripe. We do not store full card details.

We may retain limited transaction information such as:

• Masked card number (last four digits only)
• Card brand and type
• Issuing bank (where provided)
• Transaction reference numbers
• Fraud or security-related decline indicators

Transaction Data
Details of purchases, bookings, and services.

Technical Data
IP address, browser type and version, device information, time zone, and approximate location.

Usage Data
Information about how you use our website, products, and services.

Profile Data
Preferences, feedback, and survey responses.

Marketing and Communications Data
Your marketing preferences and communication history.

Aggregated Data
Statistical or demographic data that does not identify you.

Special category data
We do not intentionally collect special category personal data or criminal conviction data.

IF YOU FAIL TO PROVIDE PERSONAL DATA

Where we need personal data to perform a contract or meet a legal obligation, failure to provide it may mean we cannot:

• Complete a booking
• Deliver products or services
• Process payments

We will notify you if this applies.

HOW WE COLLECT YOUR PERSONAL DATA

We collect data through:

Direct interactions
When you make bookings or purchases, complete forms, subscribe to newsletters, enter competitions or surveys, or contact us by email, phone, or post.

Automated technologies
When you interact with our website, we may collect Technical and Usage Data via cookies and similar technologies, subject to consent.

Third parties
Including payment providers, analytics providers, advertising platforms, and public sources where lawful.

COOKIES AND CONSENT

We use cookies in accordance with the Privacy and Electronic Communications Regulations (PECR).

• Strictly necessary cookies are always active
• Analytics and marketing cookies are used only with your explicit consent
• You can manage or withdraw consent at any time via our cookie banner or settings

Further information about cookies is available at www.aboutcookies.org.

HOW WE USE YOUR PERSONAL DATA (LAWFUL BASES)

We use your personal data only where the law allows us to, including:

• Performance of a contract
• Legal obligations
• Legitimate interests (balanced against your rights)
• Consent, where required

Key purposes include:

• Providing and managing bookings and services
• Processing payments
• Customer communications and support
• Website improvement and analytics
• Fraud prevention and security
• Marketing, where permitted

MARKETING

You will receive marketing communications from us only where permitted by law or where you have opted in.

You may opt out at any time by:

• Clicking the unsubscribe link in our emails
• Contacting [email protected]

We will always obtain explicit consent before sharing your data with third parties for marketing.

DISCLOSURES OF YOUR PERSONAL DATA

We may share your personal data with:

• Payment processors, including Stripe
• IT, hosting, and system providers
• Delivery and customer support partners
• Professional advisers (lawyers, accountants, insurers)
• Regulators and authorities where required by law
• Buyers or successors in the event of a business sale or merger

All third parties are required to keep your personal data secure and process it only in accordance with our instructions and applicable law.

INTERNATIONAL TRANSFERS

Some service providers, including Stripe, operate internationally. This may involve transferring personal data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, including:

• UK adequacy regulations
• UK International Data Transfer Agreements (IDTA)
• UK Addendum to EU Standard Contractual Clauses

You may contact us for further details.

DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data, including access controls, encryption, secure storage, and staff training.

We have procedures in place to respond to personal data breaches and will notify you and the ICO where legally required.

DATA RETENTION

We retain personal data only for as long as necessary.

• Customer and transaction data: up to six (6) years after the end of the customer relationship
• Marketing data: until consent is withdrawn or data becomes inactive
• Analytics data: anonymised or deleted in line with retention policies

YOUR LEGAL RIGHTS

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time

To exercise your rights, contact [email protected].

Requests are normally handled within one month and are free of charge unless excessive or unfounded.

GOVERNING LAW

This Privacy Notice is governed by the laws of England and Wales. The English courts have exclusive jurisdiction.

CONTACT US

If you have questions about this Privacy Notice, your personal data, or cookies, please contact:

Data Privacy Manager
Email: [email protected]