Effective Date: 5th Nov 2025
Company Number: SC595805
Email: hello@zoneevents.co.uk
Website: www.zoneevents.co.uk
Zone Events Limited (“Zone Events”, “we”,“us”, “our”) is committed to protecting and respecting your privacy.We deliver adventurous outdoor, height-based and challenge events across the UK, including the Beast Race, Discovery Mast Climb, The Kelpies Experience and a range of charity abseils and bespoke adventure experiences.
This Privacy Policy explains how we collect, store, use and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and how we ensure your rights are protected.
This policy applies to all participants, visitors, customers, contractors and partners interacting with Zone Events in any way — whether through our websites, event registration systems, digital Participation Agreements, or paper forms.
Lawfulness, fairness and transparency – data processed lawfully and openly.
Purpose limitation – used only for specified, legitimate purposes.
Data minimisation – only what is necessary is collected.
Accuracy – data kept accurate and up to date.
Storage limitation – retaind only as long as required.
Integrity and confidentiality –secure handling at all times.
Accountability – we can demonstrate compliance with all applicable laws.
Depending on your interaction with us, we may collect:
A. Participant and Booking Data:
Full name, postal address, phone number and email address·
Date of birth, age and gender
Emergency contact details
Booking and ticketing information
Payment details (processed through third-party providers such as Stripe, Race Space or Ticket Tailor)
B. Health and Safety Information
Medical conditions or disabilities relevant to participation
Information disclosed within Participation Agreements or Event Terms & Conditions
Incident or accident reports,risk assessments and insurance data·
Emergency medical consent and contact details
C. Photography, Video and Media
Still and video imagery captured by official photographers, videographers and drones·
Consent declarations for photo/video use where appropriate.
For the Beast Race and other large-scale public events: Photography and videography are integral to event operations and unavoidable. Your image may appear in media coverage, photography or event videos. Such imagery is processed under legitimate interests (UK GDPR Article6(1)(f)) and forms part of the event experience.
D. CCTV
On occasion Footage from event sites, venues or operational areas for safety and security purposes.
E. Online and Communications Data·
Email correspondence, enquiry forms and customer communications
Website usage data (e.g. IP address, browser type, device information and cookies)
We collect data through secure systems and controlled processes:
A. Smartwaiver (Digital Participation Agreements and Event Terms & Conditions)
We use Smartwaiver (www.smartwaiver.com) as our digital platform for collecting and managing Participation Agreements and Event Terms & Conditions for participants taking part in our events —particularly at-height activities such as abseil events, aerial climbs and guided rope-based experiences operated by Zone Events.
These Participation Agreements set out the terms under which you take part in our activities, confirm your understanding of the risks involved and record your emergency and medical information to ensure your safety and that of others.
Data submitted via Smartwaiveris collected and processed for the purposes of event administration, participant identification, safety management and compliance with our legal and insurance obligations.
Smartwaiver stores data onAmazon Web Services (AWS) servers located in the United States. Smartwaiver maintains a UK/EUPrivacy Notice and uses Standard Contractual Clauses (SCCs) to provide lawfulmechanisms for international data transfers.
Zone Events Limited remains the data controller for all Participation Agreements collected via Smartwaiver andensures these are retained, accessed and deleted in accordance with thisPrivacy Policy and UK data-protection law.·
Smartwaiver does not own or use the data for its own purposes — it acts only as our data processor under the UKGDPR.
B. Race Space (Ticketing for the BeastRace)
We use Race Space (www.racespace.com) to manage participant registrations, payments and ticketing for the Beast Race.
Race Space acts as our data processor for these services and collects participant and payment data under contract with us.
C. Dropbox (Data Storage and FileManagement)
We use Dropbox for secure digital storageof administrative and event-related data. Dropbox complies with UK GDPR and uses SCCs for any transfers outside the UK/EEA.
Access to stored data is strictly limited to authorised personnel.
D. Paper-Based Participation Agreements
In certain circumstances, paper forms maybe used for participant registration or on-site signing. All physical records containing personal data are:·
Stored in a locked cabinet or secure office on Zone Events premises;·
Access restricted to authorised staff only;
Retained only for the necessary retention period; and:
Securely destroyed at the end of the retention period using a cross-cut shredder or an approved confidential-waste contractor, in line with ICO best-practice guidance.
Purpose: To process registrations, Participation Agreements and ticket purchases
Lawful Basis: Contract
Purpose: To ensure participant safety and deliver the event
Lawful Basis: Contract & vital interests
Purpose: To comply with health, safety and insurance obligations
Lawful Basis: Legal obligation
Purpose: To contact you with event updates or operational information
Lawful Basis: Contract & legitimate interests
Purpose: To manage imagery and promotional media
Lawful Basis: Consent or legitimate interests
Purpose: To operate CCTV for site safety and security
Lawful Basis: Legitimate interests
Purpose: To manage financial records and legal compliance
Lawful Basis: Legal obligation
Purpose: To send marketing or newsletters about upcoming events
Lawful Basis: Consent or legitimate interests
We may capture images and videos at events for marketing, press, social-media and archival purposes. For smaller or controlled experiences, we will seek your explicit consent for identifiable imagery. For large public events (e.g. BeastRace), consent is not practical and legitimate interest is used as the lawful basis. Participants may request removal of identifiable content on official Zone Events channels by emailing hello@zoneevents.co.uk or info@beastrace.co.uk. All media remains the property of ZoneEvents Limited or our licensors and may be used globally and indefinitely.
CCTV operates at certain sites for participant safety, crowd management and asset protection. Footage is stored securely for a maximum of 30 days, unless required for investigation or legal proceedings, and is accessible only to authorised personnel
We share personal data only where strictly necessary and lawful.
Data may be shared with:·
Event partners (venue operators, heritage trusts, local authorities)
Contractors and suppliers (e.g.medical teams, riggers, photographers)
Ticketing and data platforms (Smartwaiver, Race Space, Stripe)
Insurers, solicitors and regulatory bodies
Emergency services in case of accident or illness
All third-party processors are bound by confidentiality and data-processing agreements compliant with UK GDPR.
Certain data (e.g. Smartwaiver and Dropbox)may be stored outside the UK. We ensure such transfers comply with the UK GDPR through adequacy decisions, where available, or Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (ICO). Zone Events remains responsible for ensuring lawful international data transfers and records these arrangements in our internal data-protection register
Participation Agreements / Event Terms & Conditions - Up to 6 years
Accident / incident records - Up to 10 years
Payment / financial records - Up to 7 years
CCTV footage 30 days (maximum)
Marketing lists until consent withdrawn
You have the right to:
Access your personal data
Rectify inaccurate information
Request erasure (“right to beforgotten”)
Restrict or object to processing
Withdraw consent at any time
Lodge a complaint with the ICO
To exercise your rights, contacthello@zoneevents.co.uk.
We respond within one month of verified request.
Secure cloud storage and encryption in transit and at rest
Restricted, role-based staff access
Regular staff data-protection training
Secure disposal and shredding policies
Breach-notification procedures compliant with the UK GDPR
Children’s Data Participants under 16 require parent or guardian consent. Such information is handled with enhanced confidentiality and only shared as required for safety or compliance.
With your consent (or where legitimate interests apply), we may send updates about future events or charity partnerships.You can withdraw consent at any time by emailing hello@zoneevents.co.uk or using the “unsubscribe” link in any marketing email.
Please see our separate Cookies Policy Here Our websites use cookies to enhance functionality and understand visitor usage.You can manage or disable cookies through your browser settings. Analytics data are anonymised wherever possible.
Data Protection Lead Zone Events Limited
Email: hello@zoneevents.co.uk
If you believe we have not handled your data lawfully, you can contact the Information Commissioner’s Office (ICO):www.ico.org.uk | Tel 0303 123 111317.
Updates to this PolicyThis Privacy Policy is reviewed regularly and may be updated to reflect operational or legal changes.