Privacy Policy

Last updated: May 2026

This privacy policy explains how Hocus Pocus Play Ltd and Magic Beans Cafe Ltd ("we", "us", "our") collect, use and protect your personal data when you visit our website or make a booking with us. We are committed to protecting your privacy and handling your data in an open and transparent way.

This policy applies to data collected via hocuspocusplay.co.uk and all associated pages. It complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

The data controllers are Hocus Pocus Play Ltd and Magic Beans Cafe Ltd, both operating from Fairford Waterski Club, Whelford Road, Fairford, Gloucestershire, GL7 4DT.

You can contact us about data matters at: magicbeanscafeltd@gmail.com

2. What Data We Collect

We may collect the following personal data:

• Booking data: your name, email address, phone number, number of children, and session preferences when you make a booking via Bookwhen.
• Payment data: payment is processed by Stripe. We do not store your card details — Stripe handles all payment security. See Stripe's Privacy Policy.
• Contact enquiries: your name, email address and message when you contact us by email or phone.
• Website usage data: anonymised data about how you use our website, collected via cookies (see section 7).

We do not collect sensitive personal data (such as health data) unless you choose to share it with us directly, for example to inform us of a child's additional needs.

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and manage your session bookings.
• To send you booking confirmation and reminders.
• To respond to your enquiries.
• To manage session capacity and prepare the venue appropriately.
• To comply with our legal obligations.

Our lawful basis for processing booking and contact data is contract (processing is necessary to carry out the service you have requested) and legitimate interests (managing our business operations).

4. Booking Platform — Bookwhen

We use Bookwhen as our online booking platform. When you make a booking, your data is processed by Bookwhen on our behalf. Bookwhen stores booking data securely and we retain full control and ownership of our booking data. Bookwhen does not sell your data to third parties.

For more information, see Bookwhen's Privacy Policy.

5. Payment Processing — Stripe

All payments are processed securely by Stripe. Your card details are entered directly into Stripe's secure payment form and never pass through or are stored on our systems. Stripe is PCI-DSS compliant.

For more information, see Stripe's Privacy Policy.

6. How Long We Keep Your Data

We retain booking and contact data for up to 3 years after your last interaction with us, unless we are required by law to keep it longer (for example, financial records which must be kept for 6 years under UK tax law).

After this period your data is securely deleted.

7. Cookies

Our website uses cookies — small text files stored on your device. We use the following types:

• Essential cookies: required for the website to function, including remembering your cookie preference. These cannot be disabled.
• Analytics cookies: anonymised data about how visitors use the site (e.g. pages visited, time on site). These are only set if you accept cookies. We use this data to improve the website.

You can manage or withdraw your cookie consent at any time by clearing your browser storage or using your browser's cookie settings. Declining analytics cookies will not affect your ability to use the site or make bookings.

8. Sharing Your Data

We do not sell your personal data. We share it only with:

• Bookwhen — to process and manage your booking.
• Stripe — to process your payment.
• Legal authorities — if required to do so by law.

All third-party processors we use are UK GDPR compliant.

9. Your Rights

Under UK GDPR you have the following rights:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your data (subject to legal obligations).
• Right to restrict processing — you can ask us to limit how we use your data.
• Right to data portability — you can request your data in a portable format.
• Right to object — you can object to processing based on legitimate interests.

To exercise any of these rights, email us at magicbeanscafeltd@gmail.com. We will respond within one calendar month.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Data Security

Our website is served over HTTPS with an up-to-date SSL certificate. We apply appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, or disclosure.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "last updated" date at the top of the page. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us:

• Email: magicbeanscafeltd@gmail.com
• Phone: 01285 711606 (during opening hours)
• Post: Fairford Waterski Club, Whelford Road, Fairford, Gloucestershire, GL7 4DT