Ownership is a contract question
Assume nothing about who owns the data a platform collects on your behalf. Establish in writing that the attraction owns its visitor data, that it can be exported in a usable format, and what happens to it if the relationship ends.
This is a straightforward conversation with a good supplier and a revealing one with a poor supplier.
Collect less, and say why
Under UK data protection law, personal data should be collected for specified purposes and limited to what is necessary. In practice that means resisting the temptation to gather everything because it might be useful later.
Write the purpose down before adding a field. If nobody can name the decision it supports, remove it.
Make consent honest
Consent gathered through a pre-ticked box or a confusing banner is both poor practice and poor marketing: it fills your list with people who did not choose to be there.
Explain plainly what a guest will receive, how often, and how to stop. Make the opt-out as easy as the opt-in.
- Keep marketing consent separate from operational messages about the visit.
- Record when and how consent was given.
- Review retention periods annually and delete what is no longer needed.
- Check that children's data is handled with additional care.
Know where the data lives
Ask where data is hosted, who can access it, how access is controlled and what security measures apply. Ask for evidence rather than reassurance.
If a supplier cannot answer these questions clearly, your data protection officer will eventually ask you the same ones.
Want this applied to your attraction?
We are happy to talk through your own evaluation, even at an early stage.