Privacy policy

GUEST PASS LTD, trading as GuestLab ("GuestLab", "we", "us" or "our"), is committed to protecting your privacy. This privacy policy explains how we collect, use, disclose and safeguard your information when you use this website, contact us, or take part in an experience we have built for an event.

GUEST PASS LTD
Unit 52a Atcham Business Park
Atcham, Shrewsbury, Shropshire
United Kingdom, SY4 4UG

1. Information we collect

1.1 Information you provide

• Contact information: name, email address, phone number and organisation details when you get in touch
• Project information: event details, audiences, briefs, timings and budgets you share with us
• Communications: messages, enquiries and feedback you send to us
• Documents: files you send or share with us in the course of a project
• Participation data: where an experience we build invites guests to contribute, this may include names, photos, drawings, votes, scores or other content guests choose to submit

1.2 Information collected automatically

• Usage data: pages viewed, features used, time spent and interaction patterns
• Device information: IP address, browser type, operating system and device identifiers
• Location data: approximate location based on IP address
• Cookies and tracking: session data, preferences and analytics information
• Interaction data: where an experience uses smart wristbands, scanners or similar, the time and place of each interaction

2. How we use your information

We use the information we collect to:

• Respond to enquiries and provide our services
• Design, build, run and support experiences for events
• Send project updates and communications
• Analyse usage and improve our website and services
• Detect, prevent and address technical issues or fraud
• Comply with legal obligations and enforce our terms
• Send marketing communications, with your consent

3. Legal basis for processing (GDPR)

Under GDPR, we process your personal data based on:

• Contract performance: processing necessary to provide services you have requested
• Legitimate interests: operating and improving our services, fraud prevention and security
• Legal obligations: compliance with applicable laws and regulations
• Consent: marketing communications and optional features, withdrawable at any time

4. Information sharing and disclosure

4.1 Event organisers

Where guests take part in an experience we have built for an event, participation data is shared with the event organiser who commissioned it. Event organisers are independent data controllers responsible for their use of guest data.

4.2 Service providers

We share information with trusted third-party service providers who assist us with:

• Cloud hosting and infrastructure services
• Payment processing and fraud prevention
• Transactional email delivery (Mailgun / Sinch Email)
• Customer support and ticketing systems

We do not share guest data with advertising, marketing or third-party analytics platforms. A full list of sub-processors is available on request.

4.3 Legal requirements

We may disclose information when required by law, legal process, or to:

• Comply with legal obligations
• Protect our rights, property or safety
• Prevent fraud or security issues
• Respond to government requests

4.4 Business transfers

In the event of a merger, acquisition or sale of assets, your information may be transferred to the acquiring entity.

5. International data transfers

We offer region-specific hosting. Where required, project systems are hosted on servers located within the EU or the client's own region, ensuring that event and guest data does not leave that region. Hosting region is agreed with each client prior to deployment.

Where data is transferred outside the hosting region (for example, transactional email delivery), we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions for certain countries
• Strong technical and organisational security measures

6. Data retention

We retain your information for different periods depending on the type of data:

• Contact and enquiry data: retained while we are in contact, plus a reasonable period for legal compliance
• Project and event data: retained as long as needed for the project and post-event purposes, typically 1-3 years
• Payment records: retained for 7 years for tax and accounting purposes
• Guest participation data: retained as determined by event organisers, with deletion options available
• Analytics data: aggregated and anonymised data may be retained indefinitely
• Legal records: retained as required by applicable laws and regulations

You may request deletion of your data subject to legal retention requirements. Event organisers control retention of guest data for their events.

Each client's event systems are stored in a dedicated, isolated environment. When an event organiser requests full data deletion, the entire environment and its database are destroyed, leaving no residual data on our infrastructure.

7. Your rights and choices

7.1 GDPR rights (EU and UK residents)

• Right of access: request a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restriction: limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or for marketing
• Right to withdraw consent: withdraw consent for processing at any time
• Right to lodge a complaint: contact your local data protection authority

7.2 CCPA rights (California residents)

• Right to know: request disclosure of personal information collected, used and shared
• Right to delete: request deletion of personal information
• Right to opt out: opt out of sale of personal information (we do not sell personal data)
• Right to non-discrimination: equal service and pricing regardless of privacy choices

7.3 General rights

• Communication preferences: opt out of marketing emails via unsubscribe links
• Cookie settings: manage cookies through your browser settings
• Data deletion: request deletion of your personal data

To exercise your rights, contact us using the information at the end of this policy. We will respond to your request within 30 days, or as required by applicable law.

8. Data security

We implement enterprise-grade security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Secure payment processing through certified providers
• Employee training on data protection and security
• Incident response and breach notification procedures

8.1 Data isolation architecture

Each client's event systems run in their own dedicated, isolated container environment with a separate database. Client data is never co-mingled with data from other clients, projects or services. Each environment is inaccessible from any other service on our infrastructure. Access to server environments is restricted to authorised operations personnel only.

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Cookies and tracking technologies

We use cookies and similar technologies to:

• Maintain your session and preferences
• Analyse usage and improve our services
• Provide personalised content and features

You can control cookies through your browser settings. Disabling cookies may limit functionality of certain features.

10. Children's privacy

Our services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete such information.

For events involving minors, event organisers are responsible for obtaining appropriate parental consent and complying with applicable children's privacy laws.

11. Changes to this privacy policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice, such as email notification.

Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

12. Contact us

If you have questions, concerns or requests regarding this privacy policy or our data practices, please contact us:

GUEST PASS LTD (trading as GuestLab)
Unit 52a Atcham Business Park
Atcham, Shrewsbury, Shropshire
United Kingdom, SY4 4UG
Email: privacy@guestpass.live
General enquiries: hello@guestpass.live

For GDPR-related enquiries, you may also contact your local data protection authority.