Over Farm Privacy Policy

Over Farm Privacy Policy

Last updated: 16/12/25

We care about your privacy and want to be clear about how and why we use personal information. This policy explains what data we collect, how we use it, and the choices you have.

This policy applies to everyone who visits Over Farm, uses our websites, books tickets or events, contacts us, or works with us.

1. Who we are

Over Farm is the data controller for the personal information described in this policy.

Trading name: Over Farm
Legal entities:
R Keene & Sons (Partnership)
Over Farm Retail Ltd

Registered address: Over Farm, Over, Gloucester, GL2 8DB
Email: [email protected]

If you have any questions about this policy or how we use your data, please contact us using the details above.

2. What personal data we collect

We only collect information that we genuinely need. Depending on how you interact with us, this may include:

• Your name

• Email address

• Phone number

• Postal address

• Booking and payment details

• Communications you send to us

• Accessibility or carer information (where relevant)

• Information required for health and safety or legal reasons

We do not collect unnecessary information and we do not sell personal data.

3. How we collect your data

We collect personal data when you:

• Visit our websites

• Book tickets, events, or services

• Sign up to newsletters or marketing updates

• Contact us by email, phone, forms, or social media

• Take part in surveys or feedback

• Visit our site or attend events (including via CCTV where in use)

• Apply for a job or work for us

4. How we use your data

We use personal data to:

• Respond to enquiries and messages

• Process bookings and deliver services

• Keep visitors, staff, and the public safe

• Manage accessibility and carer arrangements

• Send service updates and (where you’ve agreed) marketing emails

• Improve our services and customer experience

• Meet legal, regulatory, and contractual obligations

We only use your data where we have a valid legal reason to do so.

5. Our legal bases for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract – when we need your data to provide a service or fulfil a booking

• Legal obligation – where the law requires us to process information (for example health & safety or employment law)

• Legitimate interests – for running and improving Over Farm, provided this does not override your rights

• Consent – for marketing communications and certain optional activities

You can withdraw consent at any time.

6. Marketing communications

We will only send you marketing emails if:

• You have actively signed up, or

• You are an existing customer and the law allows us to contact you

All marketing emails include an unsubscribe link, and you can opt out at any time.

We use Mailchimp to manage email communications. Your email address is stored securely and only used in line with this policy.

We also use social media and digital advertising platforms such as Facebook and Instagram (Meta), Google, and TikTok to promote Over Farm and our events. These platforms may process personal data such as interactions with our posts, adverts, or website links in accordance with their own privacy policies. In some cases, these platforms act as independent or joint data controllers.

You can control how your data is used for advertising through your privacy settings on those platforms.

7. Visiting Over Farm and attending events

When you visit the farm or attend an event, we may process personal data to:

• Manage ticketing and entry

• Process payments

• Ensure safety and security (including CCTV where in use)

• Manage accessibility needs and carer entry

• Capture photographs or video for promotional purposes, including images of visitors and groups, in a proportionate and respectful way

If photography or filming is taking place, we aim to make this clear on site. Images are used to promote the experience at Over Farm rather than to identify individuals, and visitors can speak to a member of staff if they have concerns.

8. Children’s data

Over Farm is a family destination. Bookings and accounts must be made by a parent or legal guardian.

We only collect limited information about children where necessary to deliver our services safely and appropriately. We take extra care to protect children’s data. Where photographs or video include children and are used for marketing purposes, this is done in a proportionate way, with appropriate notices on site, and with a clear focus on promoting the experience rather than identifying individual children.

9. Who we share data with

We only share personal data where necessary, including with:

• Trusted service providers (such as ticketing, payment, and email systems)

• Professional advisers

• Regulatory bodies where required by law

All third parties are required to keep your data secure and only use it for agreed purposes.

Some providers (such as Mailchimp) are based outside the UK. Where this happens, appropriate safeguards are in place.

10. How long we keep your data

We keep personal data only for as long as necessary:

• Enquiries: up to 1 year

• Customer and booking records: up to 6 years

• Marketing data: until you unsubscribe

• Employment records: up to 6 years after employment ends

After this, data is securely deleted or anonymised.

11. How we protect your data

We use appropriate technical and organisational measures to keep personal data secure, including:

• Access controls and permissions

• Secure systems and providers

• Staff training and confidentiality

• Limiting data to what is necessary

12. Your rights

You have the right to:

• Access your personal data

• Correct inaccurate information

• Request deletion (in certain circumstances)

• Restrict or object to processing

• Withdraw consent for marketing

• Request data portability where applicable

To exercise your rights, contact us at [email protected] We may ask you to verify your identity before responding.

13. Complaints

If you have concerns about how we handle your data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO):

ICO
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113
www.ico.org.uk

14. Cookies

Our websites use cookies to work properly and to help us understand how they are used.

Details about cookies, how we use them, and how you can manage preferences are set out in our separate Cookie Policy.

If you’d like a copy of this policy in a different format, please contact us.

DigiTickets Privacy Policy

Policy Owner

This policy is owned and distributed by IT and Compliance manager of Digital Ticketing Systems Limited

Who we are

In this Privacy Policy, references to "we", "us", and "our"" are to Digital Ticketing Systems Limited (Company number 07044584). References to "our Website" or "the Website" are to *.digitickets.co.uk.

Digital Ticketing Systems Limited is the data controller responsible for the personal information collected through this Website.

Information We Collect

We may collect and process the following categories of personal information:

Information You Provide Directly

When you contact us, make a purchase, register for services, or complete forms on our Website, we may collect information such as:

• Name
• Postal address
• Email address
• Telephone number
• Purchase and booking information
• Any other information voluntarily provided by you

Payment Information

Payments made through our Website are processed by authorised payment service providers. We do not store your full credit or debit card details on our systems.

Our payment providers may process payment information and carry out fraud prevention and verification checks. Where international transfers are required, appropriate safeguards will be applied in accordance with applicable data protection laws.

Digital Ticketing Systems is PCI DSS v4.0.1 compliant and are annually assessed/certified.

Website Usage Information

When you visit our Website, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Screen resolution
• Operating system
• Referral source
• Pages visited and actions taken on the Website
• Date and time of access

Marketing Preferences

If you choose to receive marketing communications, we will record your preferences and any interactions with our emails, including whether emails are opened or links are clicked.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our Website, remember your preferences, analyse usage, and improve user experience. Further information is provided in our Cookie Policy below.

How We Use Your Information

We process personal information for the following purposes:

• To provide products and services you request
• To process transactions and fulfil orders
• To provide customer support and after-sales services
• To manage bookings and accounts
• To improve our Website, products, and services
• To ensure Website security and prevent fraud
• To comply with legal and regulatory obligations
• To send marketing communications where we have your consent or another lawful basis to do so

Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Performance of a contract: to provide goods or services you have requested.
• Legal obligation: where processing is necessary to comply with legal requirements.
• Legitimate interests: to manage and improve our business, Website security, and customer experience.
• Consent: where required, including for certain cookies and marketing communications.

Where we rely on consent, you may withdraw it at any time.

Sharing Your Information

We may share your personal information with:

• Payment processors
• Hosting and IT service providers
• Delivery and fulfilment partners
• Marketing and communications providers
• Analytics and Website performance providers
• Professional advisers and auditors
• Regulatory authorities, law enforcement agencies, or courts where required by law

All third-party service providers are required to process personal information only on our instructions and in accordance with applicable data protection laws.

We do not sell personal information to third parties.

International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as:

• Transfers to countries deemed to provide an adequate level of protection; or
• Approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, regulatory, and reporting requirements.

Retention periods vary depending on the type of information and the purpose for which it is processed.

Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember preferences, improve performance, and provide analytics information.

How We Use Cookies

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie management tools.

Cookie	Purpose	Duration
PHPSESSID	Maintains user session and shopping basket functionality	Session / 24 minutes
dtAnalyticsConsent	Records cookie consent preferences	1 year

Analytics Cookies

These cookies help us understand how visitors interact with the Website so that we can improve performance and usability.

These cookies are only placed with your consent.

Google Analytics

Examples include:

• _ga
• _ga<container-id>
• _gid
• _gat_<tracker-name>

Used to collect aggregated statistical information about Website usage.

Google Privacy Information:

https://support.google.com/analytics/answer/6004245

Microsoft Clarity

Examples include:

• _clck
• _clsk
• CLID
• ANONCHK
• MR
• MUID
• SM

Used to analyse user interactions and improve Website usability.

Microsoft Clarity Information:

• https://clarity.microsoft.com/blog/cookies-in-clarity/
• https://learn.microsoft.com/en-us/clarity/

Performance Monitoring Cookies

Performance monitoring tools help us identify technical issues and improve Website reliability.

Examples may include cookies used by services such as New Relic.

Managing Cookies

When you first visit our Website, you will be presented with a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Choose your cookie preferences

You may change your preferences at any time through our cookie settings tool.

You can also manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

Your Data Protection Rights

Under UK GDPR, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Restrict processing
• Object to processing
• Request portability of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

For more information about your rights, visit:

https://ico.org.uk/

Automated Decision-Making

We do not generally make decisions producing legal or similarly significant effects using solely automated processing.

Where automated tools are used for fraud prevention, security monitoring, or service administration, appropriate safeguards will be applied in accordance with applicable data protection legislation.

Childrens Data

Our Website is not intended to knowingly collect personal information from children unless necessary to provide services requested by a parent, guardian, school, attraction, venue, or authorised organisation.

Where we process children's personal information, we take additional care to ensure appropriate protections are in place.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Digital Ticketing Systems (t/a DigiTickets)

Sentio House, Pynes Hill, Exeter, Devon, EX2 5AZ

www.digitickets.co.uk/compliance-request

If you have concerns about how we use your personal information, you may submit a privacy complaint to us using the contact details above.

We will acknowledge your complaint and investigate it in accordance with applicable data protection legislation. We aim to respond without undue delay and within the timescales required by law.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

Other Websites

This Privacy Policy applies only to this Website. Links to third-party websites are provided for convenience only. We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies before providing any personal information.

Last Updated: 5 August 2026