NewWave Events
Privacy Notice
Contents
Who we are
NWave Events Ltd (“NewWave Events”, “we”, “us”) is responsible for your personal information as its controller. We are a private limited company registered in England and Wales, company number 12662300, with our registered office at Unit 5 The Old Quarry, Nene Valley Business Park, Oundle, PE8 4HN.
This notice explains how we use personal information about people who:
- visit our websites, newwave-events.co.uk and dragonboatevents.co.uk;
- enquire about, book or manage an event with us;
- take part in our events, including dragon boat festivals, corporate team building, charity and Christmas events;
- receive our marketing; or
- apply to work with us.
If you have any questions, or want to use any of your rights, contact us:
- info@newwave-events.co.uk
- Phone
- 01536 674 748
- Post
- Privacy, NewWave Events, Unit 5 The Old Quarry, Nene Valley Business Park, Oundle, PE8 4HN
We have not appointed a data protection officer because the law does not require us to. Questions about this notice go to the contacts above.
What we collect and where it comes from
Most of the information we hold comes from you. Some comes from the organisation, team captain or charity that booked your place.
- Website visitors: IP address, device and browser details, pages viewed and how you reached our site, collected through cookies (see Cookies below).
- Enquiries and bookings: name, job title, organisation, email, phone, billing address, event details and preferences, payment records, and our correspondence with you. Card payments are handled by our payment provider, Stripe, so we never see your full card number.
- Event participants: name, contact details, team, dietary and access requirements, emergency contact details, any health information you choose to give us for safety, and accident or incident records.
- Photos and video taken at our events.
- Marketing: name, email, organisation and your marketing preferences.
- Job applicants: CV, cover letter and interview notes.
If your employer booked a private event for you. Where your employer gives us participant details to run its own private event, we handle them on its behalf and only on its instructions. Your employer is the controller of that information, so it should tell you how it is used and you can ask it about it. We are still the controller for our own safety records and event photography. For our public festivals, we are the controller of all participant information.
How we use it and why
We use your information only where the law allows it. The table shows each purpose and the lawful basis we rely on. Where we rely on legitimate interests, you can object (see Your rights).
| Purpose | Lawful basis |
|---|---|
| Answering enquiries and sending quotes | Legitimate interests in responding to people who contact us, or steps you ask us to take before a contract |
| Taking bookings and running events | Contract with you; or, where your organisation booked, legitimate interests in delivering the event it booked |
| Invoicing, payments and accounts | Contract; legal obligation under tax and company law |
| Health and safety, including risk assessments, safety briefings, and accident and incident records | Legal obligation under health and safety law; legitimate interests in keeping people safe on and off the water; vital interests in an emergency |
| Insurance and legal claims | Legitimate interests in managing our risks and defending claims |
| Photos and video for publicity | Legitimate interests in promoting our events, with a right to opt out |
| Marketing emails | Legitimate interests for business contacts; consent where you sign up to our newsletter |
| Running our websites and measuring how they are used | Consent for non-essential cookies; legitimate interests in keeping the sites secure |
| Recruitment | Steps before entering a contract; legitimate interests in hiring the right people |
| Meeting requests from regulators, police or courts | Legal obligation |
Health and other sensitive information
Dietary requirements, access needs and health information can reveal your health or religious beliefs, so the law gives them extra protection. We collect only what we need to feed you, make the event accessible and keep you safe.
- Information you give us for safety or access: we use it with your explicit consent, which you can withdraw at any time. If you withdraw it, we may not be able to let you take part in some activities safely.
- Accident and incident records: where these include health information, we keep them to meet our health and safety duties and to establish or defend legal claims.
- Emergencies: we may share health information with emergency services to protect your life if you cannot consent.
- Private events booked by your employer: your employer is responsible for the lawful basis for sharing this information with us.
Only the staff and event partners who need this information can see it. For example, a caterer receives dietary requirements but not names of medical conditions. Participants under 18 need the consent of a parent or guardian to take part.
Photography and video
We and our photographers may photograph and film our events. We use the images on our websites, on social media and in promotional materials, and may share them with the organisation or charity linked to the event. We do this in our legitimate interests in promoting our events.
- Opting out on the day: tell our staff at registration or the safety briefing. We are are exploring an option on future events where we will give you a coloured wristband and take reasonable steps not to use images in which you can be identified.
- Removing a published image: email info@newwave-events.co.uk. We will remove it from our websites and social media within 10 working days and not use it again. We cannot recall printed materials that have already been distributed.
- Under-18s: we do not use images in which a child can be identified for publicity without the consent of a parent or guardian.
- Organisations: if you booked a private event and do not want it used for publicity, tell us in writing before the event.
Marketing
We send business contacts news about our events and similar services in our legitimate interests. If you sign up to our newsletter on our websites, we send it with your consent.
- Every marketing email has an unsubscribe link, or you can email info@newwave-events.co.uk.
- When you unsubscribe, we keep your email address on a suppression list so we do not contact you again.
- We never use participant details that an employer gave us for a private event to send marketing.
- We do not sell personal information or share it with other organisations for their own marketing.
Who we share it with
We share only what each recipient needs. Recipients are:
- venues, caterers, boat and equipment suppliers, safety crews and activity partners who help deliver your event;
- the organisation or charity linked to your booking, such as team lists and fundraising results;
- service providers who run our systems for us, including website and booking system hosting, email delivery (Amazon Web Services), payments (Stripe), business email and documents (Microsoft 365), and website analytics and advertising (Google and LinkedIn);
- our professional advisers, insurers and bank;
- the police, emergency services, regulators or courts where the law requires it or to protect someone's safety; and
- a buyer of our business, if we sell it.
Transfers outside the UK
We keep most information in the UK and the European Economic Area. Where a provider handles it elsewhere, we transfer it only to a country covered by UK adequacy regulations, or under the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). Contact us for details.
How long we keep it
We keep information only as long as we need it, then delete or anonymise it.
| Information | How long we keep it |
|---|---|
| Participant lists, dietary and access requirements | Deleted within 60 days after the event |
| Health information given for safety | Deleted within 60 days after the event, unless it forms part of an accident record |
| Accident and incident records | 3 years after the incident, or longer if a claim is made or the person was under 18 |
| Booking, invoice and payment records | 6 years after the end of the financial year they relate to |
| Enquiries that do not lead to a booking | 2 years after our last contact |
| Photos and video | Published images until you ask us to remove them or we stop using them; unpublished images deleted after 2 years |
| Marketing preferences | Until you unsubscribe; your email then stays on our suppression list |
| Website analytics data | 14 months |
| Job applications | 6 months after the role is filled |
| Complaints and rights requests | 2 years after we close them |
Your rights and how to complain
You have the right to:
- get a copy of the personal information we hold about you;
- have inaccurate information corrected;
- have your information deleted, or its use restricted, in some circumstances;
- object to our use of it where we rely on legitimate interests, and to stop marketing at any time;
- receive information you gave us in a portable format; and
- withdraw your consent at any time, where we rely on it.
We do not make decisions about you by automated means alone. To use any right, email info@newwave-events.co.uk. It is usually free, and we respond within one month. We may need to confirm your identity first. If your request concerns a private event your employer booked, we will pass it to your employer and help it respond.
Complaints to us
If you are unhappy with how we have handled your information, email info@newwave-events.co.uk with “Data protection complaint” in the subject line or use our online contact form at /contact. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
Complaints to the regulator
You can also complain to the Information Commission (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies, security and changes
Cookies
Our websites use cookies that are strictly necessary to make them work. We use analytics and advertising cookies, such as Google Analytics, Google Ads and the LinkedIn Insight Tag, only if you agree through our cookie banner. You can change your choice at any time using the Manage consent link at the bottom of each page.
Security
We protect your information with encrypted connections, firewalled servers, individual staff accounts and confidentiality obligations for everyone who handles it. If a breach puts your information at risk, we will tell you and the ICO where the law requires.
Changes to this notice
We reserve the right to publish any changes on this page. If a change significantly affects how we use your information, we will tell you by email where we can.