1. Who we are
Neverland London Limited (company number 10109699) operates the Neverland venue-discovery and enquiry platform. Its registered office is 80 Compair Crescent, Ipswich, Suffolk, IP2 0EH. For data protection enquiries, contact hello@neverlandlondon.com. Unless stated otherwise, Neverland is the controller of personal data it collects through this website.
2. Who this notice covers
This notice applies to people browsing or searching for venues, making enquiries, contacting Neverland, subscribing to communications, and venue operators or their staff creating and maintaining business listings and accounts. Where a venue operator receives an enquiry, that operator will usually act as a separate controller of the enquiry information for its own response and booking activities; its own privacy notice also applies.
3. Information we collect
Depending on how you use our services, we may collect: contact and enquiry details (such as name, email, phone, event needs, budget, location, date and message); account and business information (such as operator name, role, venue, billing contact and account access records); listing details and photographs supplied by operators; communications with us; subscription status, invoice and transaction references (payment-card processing is handled by Stripe); and technical information such as IP address, browser/device information, approximate location, cookie preferences and security logs.
We also collect search and website interaction information such as queries, filters, zero-result searches, listings viewed, favourites, and enquiry starts or submissions. Where technically enabled, these events may be linked using a pseudonymous visitor or session identifier to help us understand the visitor journey. Pseudonymous records can still be personal data. We do not intentionally request sensitive personal data in venue enquiries; please do not include it unless necessary.
4. Where the information comes from
We obtain information directly from visitors, enquirers, account users and venue operators; automatically from use of the website and its technical services; from transaction and delivery notifications provided by our payment and email providers; and, for business listings, from venue operators or other authorised business/public sources.
5. Why we use information and our legal bases
We use information to provide search and enquiry functionality and respond to requests (legitimate interests in operating a venue-discovery service, and steps toward a contract where applicable); create, administer and secure operator accounts and paid subscriptions (contract and legitimate interests); transmit enquiries to the chosen venue operator (legitimate interests in responding to an enquiry initiated by the user); process transactions and keep necessary financial records (contract and legal obligation); prevent misuse, protect accounts and maintain service reliability (legitimate interests and, where applicable, legal obligation); and analyse search behaviour, demand and technical performance to improve our service (legitimate interests where the processing does not require consent, and consent for non-essential tracking where applicable).
We send promotional electronic marketing where we have the consent required by law or another lawful permission applies; recipients can opt out at any time.
6. Search journeys and analytics
Search terms, filters, zero-result queries and interactions may be associated with a pseudonymous visitor/session identifier so that multiple actions in a journey can be connected. We use this to improve search relevance, understand unmet demand and assess how enquiries start. The agreed maximum retention for detailed linked visitor records is 13 months from the original collection date, after which they are deleted or genuinely anonymised. Exporting a record does not restart this period: any copies exported by Neverland must also be deleted or anonymised within 13 months of the original collection date. Anonymous daily totals with no visitor identifier may be retained long term.
These linked records are only created for visitors who accept optional cookies (see section 10), and are deleted automatically 13 months after they were collected. Neverland staff can download them as a CSV file or through a secure automated feed. Google Analytics keeps its own event data under its own retention setting (see section 9).
7. Sharing information
When you enquire about a venue, we share the enquiry and contact details you submit with the relevant venue operator so it can respond. We also use service providers for hosting and administration, search, maps, email delivery, payments, analytics and security. Our known integration providers include WP Engine (hosting), Algolia (search), Google services (Maps, Analytics and Fonts), Postmark (email delivery) and Stripe (payments), as relevant to your use of the site. Google Fonts, Google Maps and Algolia search run for every visitor, because the site needs them to show its text, maps and search results; Google Analytics only runs if you accept optional cookies. GoDaddy provides our domain name (DNS) only. These providers process information under their own applicable terms and roles. We may also disclose information where required by law, to professional advisers, or in a legitimate business transaction subject to appropriate safeguards. We do not sell personal information to advertisers.
8. International transfers
Some service providers may process information outside the United Kingdom. Google, Stripe, Postmark and Algolia are US companies, so some information is processed in the United States. Where the UK GDPR requires safeguards, we use appropriate transfer arrangements, such as a UK adequacy regulation or approved contractual safeguards. You can ask us about the safeguards applicable to your information by emailing hello@neverlandlondon.com.
9. How long we keep information
Detailed linked search/visitor-journey records and any exported copies: no longer than 13 months from original collection, followed by deletion or genuine anonymisation. Anonymous daily aggregate totals without visitor identifiers: may be retained long term. Account and operator information: generally kept while the account or business relationship remains active and thereafter for a period justified by legitimate business, legal or dispute needs. Enquiry correspondence, support records, security records and billing documents: retained according to their purposes and applicable statutory, contractual and operational requirements.
As currently configured: detailed linked visitor records are deleted automatically by a daily process 13 months after collection; enquiries are deleted automatically two years after they were received; operator accounts are kept in our website database until we delete them; Postmark keeps copies of the emails the site sends for 45 days by default; Google Analytics keeps its event data for the period set in our Analytics account; Stripe keeps payment records as its own legal obligations require; and our hosting provider keeps backups of the website.
10. Cookies and similar technologies
Essential cookies or equivalent technologies may support secure sessions, account access, checkout and user preferences. Optional analytics, advertising or other non-essential technologies will only be used in accordance with applicable consent requirements. Where consent is required, visitors should be able to accept or reject optional technologies and later change their choice. The cookies and similar technologies this site uses are set out below.
Nothing optional runs until you choose Accept on our cookie notice. Your choice is stored in your browser (neverland_analytics_consent), and you can change it at any time using the Cookie settings link at the bottom of every page.
If you accept: Google Analytics sets its cookies (_ga and _ga_KDD7GZ0SS5, kept for up to 2 years), and we set one cookie of our own (nl_vid). It holds a random ID with no name or email address, and links your searches, venue views, saves and enquiries for 13 months.
If you decline: neither is set, and your visit only counts towards anonymous daily totals.
Always on: venue partners and staff who log in receive standard WordPress login cookies; Stripe sets its own cookies on its checkout and billing pages; and any venues you save as favourites, and the enquiry details you enter during a visit, are kept in your own browser only.
11. Your rights
Subject to the circumstances and applicable law, you may request access to, correction or deletion of your personal information, restriction of processing, portability of certain information, or object to processing based on legitimate interests. You have the right to object to direct marketing at any time. Where processing is based on consent, you may withdraw consent without affecting the lawfulness of earlier processing. Contact hello@neverlandlondon.com to make a request. We may need to verify identity before acting.
12. Complaints
If you have a concern about our use of personal information, please contact us first at hello@neverlandlondon.com. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
13. Security and children
We use appropriate organisational and technical measures designed to protect the personal information we hold, although no online service is completely secure. The account and subscription service is intended for adults acting for a business; please contact us if you believe a child has provided personal information improperly.
14. Changes to this notice
We may amend this notice to reflect changes in the website, processing or applicable law. The published page will show its effective date, and we will draw attention to material changes where appropriate.