NewWave Events

Privacy Notice

Who we are

NWave Events Ltd (“NewWave Events”, “we”, “us”) is responsible for your personal information as its controller. We are a private limited company registered in England and Wales, company number 12662300, with our registered office at Unit 5 The Old Quarry, Nene Valley Business Park, Oundle, PE8 4HN.

This notice explains how we use personal information about people who:

  • visit our websites, newwave-events.co.uk and dragonboatevents.co.uk;
  • enquire about, book or manage an event with us;
  • take part in our events, including dragon boat festivals, corporate team building, charity and Christmas events;
  • receive our marketing; or
  • apply to work with us.

If you have any questions, or want to use any of your rights, contact us:

Email
info@newwave-events.co.uk
Phone
01536 674 748
Post
Privacy, NewWave Events, Unit 5 The Old Quarry, Nene Valley Business Park, Oundle, PE8 4HN

We have not appointed a data protection officer because the law does not require us to. Questions about this notice go to the contacts above.

What we collect and where it comes from

Most of the information we hold comes from you. Some comes from the organisation, team captain or charity that booked your place.

  • Website visitors: IP address, device and browser details, pages viewed and how you reached our site, collected through cookies (see Cookies below).
  • Enquiries and bookings: name, job title, organisation, email, phone, billing address, event details and preferences, payment records, and our correspondence with you. Card payments are handled by our payment provider, Stripe, so we never see your full card number.
  • Event participants: name, contact details, team, dietary and access requirements, emergency contact details, any health information you choose to give us for safety, and accident or incident records.
  • Photos and video taken at our events.
  • Marketing: name, email, organisation and your marketing preferences.
  • Job applicants: CV, cover letter and interview notes.

If your employer booked a private event for you. Where your employer gives us participant details to run its own private event, we handle them on its behalf and only on its instructions. Your employer is the controller of that information, so it should tell you how it is used and you can ask it about it. We are still the controller for our own safety records and event photography. For our public festivals, we are the controller of all participant information.

How we use it and why

We use your information only where the law allows it. The table shows each purpose and the lawful basis we rely on. Where we rely on legitimate interests, you can object (see Your rights).

PurposeLawful basis
Answering enquiries and sending quotesLegitimate interests in responding to people who contact us, or steps you ask us to take before a contract
Taking bookings and running eventsContract with you; or, where your organisation booked, legitimate interests in delivering the event it booked
Invoicing, payments and accountsContract; legal obligation under tax and company law
Health and safety, including risk assessments, safety briefings, and accident and incident recordsLegal obligation under health and safety law; legitimate interests in keeping people safe on and off the water; vital interests in an emergency
Insurance and legal claimsLegitimate interests in managing our risks and defending claims
Photos and video for publicityLegitimate interests in promoting our events, with a right to opt out
Marketing emailsLegitimate interests for business contacts; consent where you sign up to our newsletter
Running our websites and measuring how they are usedConsent for non-essential cookies; legitimate interests in keeping the sites secure
RecruitmentSteps before entering a contract; legitimate interests in hiring the right people
Meeting requests from regulators, police or courtsLegal obligation

Health and other sensitive information

Dietary requirements, access needs and health information can reveal your health or religious beliefs, so the law gives them extra protection. We collect only what we need to feed you, make the event accessible and keep you safe.

  • Information you give us for safety or access: we use it with your explicit consent, which you can withdraw at any time. If you withdraw it, we may not be able to let you take part in some activities safely.
  • Accident and incident records: where these include health information, we keep them to meet our health and safety duties and to establish or defend legal claims.
  • Emergencies: we may share health information with emergency services to protect your life if you cannot consent.
  • Private events booked by your employer: your employer is responsible for the lawful basis for sharing this information with us.

Only the staff and event partners who need this information can see it. For example, a caterer receives dietary requirements but not names of medical conditions. Participants under 18 need the consent of a parent or guardian to take part.

Photography and video

We and our photographers may photograph and film our events. We use the images on our websites, on social media and in promotional materials, and may share them with the organisation or charity linked to the event. We do this in our legitimate interests in promoting our events.

  • Opting out on the day: tell our staff at registration or the safety briefing. We are are exploring an option on future events where we will give you a coloured wristband and take reasonable steps not to use images in which you can be identified.
  • Removing a published image: email info@newwave-events.co.uk. We will remove it from our websites and social media within 10 working days and not use it again. We cannot recall printed materials that have already been distributed.
  • Under-18s: we do not use images in which a child can be identified for publicity without the consent of a parent or guardian.
  • Organisations: if you booked a private event and do not want it used for publicity, tell us in writing before the event.

Marketing

We send business contacts news about our events and similar services in our legitimate interests. If you sign up to our newsletter on our websites, we send it with your consent.

  • Every marketing email has an unsubscribe link, or you can email info@newwave-events.co.uk.
  • When you unsubscribe, we keep your email address on a suppression list so we do not contact you again.
  • We never use participant details that an employer gave us for a private event to send marketing.
  • We do not sell personal information or share it with other organisations for their own marketing.

Who we share it with

We share only what each recipient needs. Recipients are:

  • venues, caterers, boat and equipment suppliers, safety crews and activity partners who help deliver your event;
  • the organisation or charity linked to your booking, such as team lists and fundraising results;
  • service providers who run our systems for us, including website and booking system hosting, email delivery (Amazon Web Services), payments (Stripe), business email and documents (Microsoft 365), and website analytics and advertising (Google and LinkedIn);
  • our professional advisers, insurers and bank;
  • the police, emergency services, regulators or courts where the law requires it or to protect someone's safety; and
  • a buyer of our business, if we sell it.

Transfers outside the UK

We keep most information in the UK and the European Economic Area. Where a provider handles it elsewhere, we transfer it only to a country covered by UK adequacy regulations, or under the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). Contact us for details.

How long we keep it

We keep information only as long as we need it, then delete or anonymise it.

InformationHow long we keep it
Participant lists, dietary and access requirementsDeleted within 60 days after the event
Health information given for safetyDeleted within 60 days after the event, unless it forms part of an accident record
Accident and incident records3 years after the incident, or longer if a claim is made or the person was under 18
Booking, invoice and payment records6 years after the end of the financial year they relate to
Enquiries that do not lead to a booking2 years after our last contact
Photos and videoPublished images until you ask us to remove them or we stop using them; unpublished images deleted after 2 years
Marketing preferencesUntil you unsubscribe; your email then stays on our suppression list
Website analytics data14 months
Job applications6 months after the role is filled
Complaints and rights requests2 years after we close them

Your rights and how to complain

You have the right to:

  • get a copy of the personal information we hold about you;
  • have inaccurate information corrected;
  • have your information deleted, or its use restricted, in some circumstances;
  • object to our use of it where we rely on legitimate interests, and to stop marketing at any time;
  • receive information you gave us in a portable format; and
  • withdraw your consent at any time, where we rely on it.

We do not make decisions about you by automated means alone. To use any right, email info@newwave-events.co.uk. It is usually free, and we respond within one month. We may need to confirm your identity first. If your request concerns a private event your employer booked, we will pass it to your employer and help it respond.

Complaints to us

If you are unhappy with how we have handled your information, email info@newwave-events.co.uk with “Data protection complaint” in the subject line or use our online contact form at /contact. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

Complaints to the regulator

You can also complain to the Information Commission (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies, security and changes

Cookies

Our websites use cookies that are strictly necessary to make them work. We use analytics and advertising cookies, such as Google Analytics, Google Ads and the LinkedIn Insight Tag, only if you agree through our cookie banner. You can change your choice at any time using the Manage consent link at the bottom of each page.

Security

We protect your information with encrypted connections, firewalled servers, individual staff accounts and confidentiality obligations for everyone who handles it. If a breach puts your information at risk, we will tell you and the ICO where the law requires.

Changes to this notice

We reserve the right to publish any changes on this page. If a change significantly affects how we use your information, we will tell you by email where we can.