Privacy policy

This explains what personal information we collect through this website, why, who we share it with, how long we keep it and your rights. We keep it to the minimum we need to run your visit.

Who we are

Small World Play Cafe is run by Small World Play Cafe Ltd, a company registered in England and Wales (company number 17283197), registered office 254–258 Barrack Road, Christchurch, BH23 2BJ. We are the data controller for the information described here. For anything about your data, email hello@smallworldplaycafe.co.uk.

What we collect

Bookings: your name, email address and phone number, the session you booked, how many tickets of each type (walker, non-walker, adult), what you paid and whether you arrived. We don't ask for your children's names or ages.
Allergies and additional needs: anything you choose to write in the notes box when booking. This can include health information about your child, so only share what our team needs to know to keep them safe.
Party enquiries: your name, email address, phone number, preferred date, package, number of guests and your message.
Contact form: your name, email address and message.
Emails you send us and our replies.
How you use the website, only if you accept analytics cookies: the pages you visit, roughly where you are, your device and browser, and anonymous ids that let us tell one visit from another. If you book, we keep that anonymous id with your booking, so once you've paid we can count the booking in Google Analytics.

Why we use it, and our lawful basis

To take and manage your booking, take payment and send your confirmation: because it's needed for our agreement with you (contract).
To keep your child safe using any allergy or additional needs information: with your explicit consent, which you give by choosing to write it in the notes box. You can ask us to delete it at any time.
To reply to party enquiries and messages: because you asked us to (our legitimate interest in answering you).
To keep financial records: because the law requires it (legal obligation).
To keep the website secure, stop automated abuse and fix errors: our legitimate interest in running a safe, working website.
To understand how the website is used and improve it (analytics): only if you accept analytics cookies (consent).

We don't send marketing emails, sell your information or use it for automated decisions about you.

Who we share it with

We use these companies to run the website. They handle your information only on our instructions, except Stripe, which is responsible for the payment details you give it.

Stripe takes card payments on its own secure page. Your card details go to Stripe, not to us: we only see that a booking has been paid for. See Stripe's privacy policy.
Vercel hosts the website, which runs in London.
Neon hosts our database, in London.
Resend sends our emails, such as your booking confirmation.
Google (Google Workspace) hosts our email inbox.
Cloudflare (Turnstile) checks that forms are filled in by a person rather than a bot, using technical details about your browser and connection.
Google Analytics (Google) and Microsoft Clarity (Microsoft) show us how the site is used, only if you accept analytics cookies. Clarity records how you move around and scroll a page, but it never records what you type into our forms: they're hidden from it. Neither runs on the pages that show your booking. When a booking is paid, we tell Google Analytics its reference, total and tickets, never your name, email, phone number or notes.
Sentry tells us when the website breaks. Error reports can include your IP address and approximate location, but we've set it not to collect what you type into forms.

Some of these companies are based in, or use servers in, the United States. Where your information leaves the UK, it's protected by UK adequacy regulations or the data transfer agreements approved by the Information Commissioner's Office (ICO).

How long we keep it

Allergy and additional needs notes: deleted three months after your visit.
Booking and payment records: six years after the end of the financial year they belong to, as the law requires for accounts.
Party enquiries and messages sent through this website: deleted twelve months after they reach us. Emails you send us: kept only as long as we need them to deal with what you asked.
Analytics: Google Analytics keeps it for 14 months. Microsoft Clarity keeps recordings for 30 days and summaries for up to 13 months.

Cookies

We set no cookies unless you accept analytics, and you can change your mind at any time. See our cookies page.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw your consent at any time. Email hello@smallworldplaycafe.co.uk and we'll reply within one month. There's no charge.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the ICO at ico.org.uk or on 0303 123 1113.

Last updated 14 November 2026.