Privacy Policy

1. Who We Are

Contact Airsoft ("we", "us", "our") is a data controller registered with the Information Commissioner's Office (ICO). We are responsible for your personal data and committed to protecting it in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Protection Contact: info@contactairsoft.co.uk

2. What Data We Collect

Player & Participant Data

Data Field	Purpose	Mandatory?
Full name	Identification, booking, safety	Yes
Date of birth	Age verification, safeguarding	Yes
Home address	Booking, liability, identification	Yes
Email address	Booking confirmation, communication	Yes
Phone number	Emergency contact, day-of communication	Yes
Emergency contact name & phone	Medical emergency response	Yes
GP surgery name & phone	Medical emergency response	Yes (under-18), recommended for all
Medical conditions/notes	Safety, first aid response	Voluntary (but critical for safety)
UKARA number	Player verification for own-gun play	Only if applicable
Photography consent	Photo/video usage control	Yes (consent option selected at registration)
Marketing opt-in	Email/newsletter consent	Voluntary

Booking & Payment Data

• Booking details (session type, date, group size, package)
• Payment transaction references (processed via Stripe — we do not store card details)
• Billing address and invoice information

Website & Analytics Data

• IP address and browser type (via Google Analytics 4, IP-anonymised)
• Pages visited and time on site
• Cookie data (with consent — see Section 7)
• Contact form submissions (name, email, message)

3. Legal Basis for Processing

Legal Basis	What It Covers
Contract	Processing needed to fulfil your booking (name, contact, payment, safety data)
Legal obligation	Age verification, safeguarding, ICO registration, insurance/tax records
Legitimate interests	Site security (CCTV), fraud prevention, operational management
Consent	Marketing emails, photography, non-essential cookies
Vital interests	Emergency medical information (GP details, medical conditions)

4. How We Use Your Data

• Bookings: Managing your session, communicating about your booking, processing payments.
• Safety: Age verification, medical emergency response, incident documentation.
• Legal compliance: ICO registration, insurance claims, UKARA player tracking, safeguarding.
• Operations: Session management, capacity planning, equipment tracking.
• Marketing: Emails about events, offers, and news — only with your explicit consent. You can opt out at any time.
• Improvement: Analysing website usage to improve our service (anonymised).

5. Data Retention

We do not keep your data longer than necessary:

Data Type	Retention Period
Adult player records (booking + waiver)	7 years after last visit
Under-18 player records	Until age 25 (safeguarding)
Booking & payment records	6 years (HMRC/tax requirements)
Incident/accident reports	7 years (or until age 25 if involving a minor)
CCTV footage	30 days (unless retained for investigation)
Marketing consent records	Until consent withdrawn
Website analytics	26 months (Google Analytics 4 default)

6. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of all data we hold about you (Subject Access Request — free, responded to within 30 days).
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data (subject to legal retention obligations — e.g., booking/tax records).
• Right to restrict processing: Ask us to limit how we use your data while a concern is resolved.
• Right to data portability: Receive your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests or for marketing.
• Right to withdraw consent: Withdraw consent for marketing, photography, or cookies at any time.

To exercise any of these rights, email info@contactairsoft.co.uk.

7. Cookies

Our website uses cookies in three categories:

• Essential cookies: Required for the site to function (e.g., booking session). Cannot be disabled.
• Analytics cookies: Google Analytics 4 — help us understand how visitors use the site. IP-anonymised. Enabled only with your consent via our cookie banner.
• Marketing cookies: Used for remarketing and ad measurement. Disabled by default.

You can manage your cookie preferences at any time via the cookie banner or browser settings.

8. Data Sharing

We do not sell your data. We share data only with:

Recipient	What is shared	Why
Stripe (payment processor)	Payment details, billing address	Process your payment
UKARA	Name, UKARA number, game count	Player registration (only when you request)
Email provider (e.g., MailerLite)	Name, email	Sending booking confirmations and marketing (with consent)
Insurance provider	Incident details	Insurance claims (only if needed)
ICO / law enforcement	As legally required	Legal compliance, investigations
Local Authority (LADO)	Safeguarding information	Safeguarding referrals (only if required)

We never transfer your data outside the UK/EEA without appropriate safeguards.

9. Data Security

• SSL encryption (HTTPS) on all website forms and transactions.
• Payment processing via Stripe (PCI-DSS compliant — we never see or store your card details).
• Access to personal data restricted to authorised staff only.
• Staff trained on data protection as part of induction.
• Regular password and access reviews.
• CCTV footage access restricted to the Site Manager and Data Protection Lead.

10. Data Breaches

If a personal data breach occurs, we will:

• Assess the severity within 24 hours.
• Notify the ICO within 72 hours if the breach poses a risk to your rights and freedoms.
• Notify affected individuals "without undue delay" if the breach is likely to result in high risk to your rights and freedoms.
• Document all breaches and remedial actions.

11. Children's Data

Our services are available to players aged 12+. For players under 18:

• Parental consent is required for data processing (via the Parental Consent Form at registration).
• We do not knowingly process the data of children under 12.
• Marketing is never sent to under-18s.
• Photography consent for under-18s requires explicit parental opt-in.
• Records for under-18s are retained until age 25 (safeguarding requirement).

12. Your Right to Complain

If you believe we have mishandled your data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We ask that you contact us first so we can attempt to resolve the issue directly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be published on this page with an updated version date. We will notify you by email of any material changes that affect how we process your data.