Who looks after your information
George & Friends is responsible for the personal information used to arrange and deliver its visits. Contact us through the Contact Us page, or use the email address or telephone number shown there, for privacy questions, a copy of your information or a request to change or remove it.
Bookings, estimates and enquiries
We collect the contact and organisation details you provide, venue and billing addresses, postcodes, billing email and telephone number, requested dates and times, chosen services, access arrangements, messages and relevant booking notes. We also hold estimates, booking confirmations, deposit requests, invoices and payment status. We use these to answer you, check suitability and availability, calculate travel, arrange the visit and manage accounts. We do not ask for card details in our booking form.
Our reasons for using information
We use booking information to take steps at your request before entering a contract and to fulfil an agreed booking. We rely on legal obligations for records we are required to keep. Our legitimate interests include answering enquiries, keeping accurate records and protecting the website against misuse, while considering your rights. We ask for consent for optional browser technologies and for publishing your Pony Tale or photographs. We do not automatically subscribe enquiries or bookings to marketing.
Sharing information to arrange your visit
We share the relevant details with the George & Friends team and, where needed, the venue contact or service providers supporting the booking. This can include the date, venue, access, setup and billing arrangements. Website hosting, email, document and technical support providers process information to provide those services. GeorgeTech provides website and chat technology; the chat and email services use Supabase infrastructure. Booking and contact form details are sent to the business team by email, and an acknowledgement is sent to the email address you provide. GeorgeTech’s mail service sends these messages on behalf of the business. Cloudflare provides connection and security services where enabled. We may disclose information where required by law. We do not sell your personal information.
Travel and address checks
The postcode and travel services use venue location information to estimate distance and possible road or zone charges. If you enable Google address search, the search terms and selected address are processed by Google. Embedded Google maps receive connection information such as your IP address. Entering your address manually and submitting a booking remain available without these optional features. Travel estimates may need review by the team.
Sign-in and security checks
Team sign-in uses Supabase to verify the account, its company and access role. Two-step verification with an authenticator app is recommended and optional to set up. Once enabled, it must be completed when signing in. Essential session credentials are held in this browser tab’s session storage and removed when you sign out. If you lose access to your password or authenticator, contact GeorgeTech Support for account recovery. Cloudflare Turnstile checks booking, contact enquiry and Pony Tale submissions to reduce automated abuse. Cloudflare receives technical browser and connection information to perform this check; the token is verified on our server before a submission is accepted. These security features do not depend on enabling optional embeds or live chat.
Live website chat
If you enable live chat, the widget connects to the GeorgeTech chat service. The service processes your messages and the contact details or other fields you choose to provide, together with conversation identifiers, timestamps, site information and technical connection details. These let the team respond, continue a conversation, handle an offline enquiry and deal with support issues. Chat information is available to authorised operators and service providers running the system. Please do not send passwords, payment card details, medical records or other sensitive documents through chat.
Pony Tales, photographs and sensitive details
Approved Pony Tales display the name, visit description and photographs you submit. Only upload material you have the right to use, with permission from people shown and a parent or guardian where appropriate. You can contact us to request removal or withdraw permission for future publication. Copies already downloaded or shared by others may remain outside our control. Please avoid naming children or sharing medical information in public contributions. For booking accessibility requirements, describe the practical support needed rather than a person’s diagnosis; contact the team before sending any sensitive personal information.
Storage, access and retention
Booking and enquiry records are stored on the website server; visiting from a different device does not create a separate business record store. We limit access to people who need the information and use appropriate security measures. Information is kept for the period needed to manage the enquiry, visit, accounts, complaints or legal obligations, and then removed or anonymised. Accounting records may need to be kept for statutory periods. Authorised team members may receive encrypted-in-transit email notifications and JSON record backups where enabled. Automatic backup snapshots are rotated and removed when records are permanently deleted; copies already downloaded or emailed must be handled separately by the team. We review unsuccessful enquiries, chat records and published contributions when they are no longer needed. Contact us for the retention period that applies to a particular record.
Providers and overseas processing
Some providers may process information outside the UK. Where a restricted international transfer takes place, appropriate safeguards or another valid transfer mechanism must be used. You can ask us which providers handle your information and about the safeguards that apply. Choosing an external link takes you to a service with its own privacy notice. Optional embedded services are controlled through our cookie settings.
Your choices and rights
Depending on the circumstances, you can ask to access or correct your information, erase it, restrict its use, receive a portable copy, or object to processing based on legitimate interests. You can withdraw consent at any time; this does not affect earlier lawful processing. Some records must be retained for legal reasons. We may need to verify your identity before responding. You may complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first if you would like us to resolve a concern.
Changes to this notice
We update this notice when the website or our use of information changes. Updated 17 October 2026.