Policy and Commitments to Privacy at Merlin's Magic Wand
Merlin’s Magic Wand – Privacy Policy & Cookies – version 2023
Merlin’s Magic Wand Children's Charity is a charitable trust registered with the Charity Commission for England and Wales, with charity registration number 1124081. Merlin’s Magic Wand Trustees Limited is a company incorporated in England and Wales with registered number 06511344.
We are also registered with the Information Commissioner's Office with registration number Z1996464. This registration covers the uses of personal information set out below.
How we collect your personal information and why
Merlin's Magic Wand (we, us, our, MMW) may need to collect personal information about you, and there are different ways that we might do so; this privacy notice tells you what to expect when we collect personal information on:
1.1 Visitors to our websites
Our website (including the application forms) is managed by Merlin’s Magic Wand Team, Merlin Entertainments IT team, and Merkle. Teams work together to maintain the security and the performance of our website.
2.1.2 Cookies
Cookies are small files of letters and numbers that we store on your browser or the hard drive of your device. Like most websites, we use cookies on our website for our legitimate interests. There are different types of cookies that we use for different purposes; however generally speaking cookies help us to distinguish you from other users of our website, which allows us to provide you with a better experience and allows us to improve our website.
You can block cookies at any time by activating the setting on your browser that allows you to refuse some or all cookies. However, if you do block cookies there may be parts of our website that you will be unable to access or that will not function properly.
We use the following types of cookies:
(a) Strictly necessary cookies:
These are cookies that are essential for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
2.1.3 Third-party services
(a) Whenever you visit our website, www.merlinsmagicwand.org we use a third-party service, Google Analytics, on our behalf and for our legitimate interests, to collect standard information about your website use, such as internet logs and details of your visitor behaviour patterns. The reason we use this service is so that we can find out how many people visit the website and the various parts of the website. This information helps us to find out how our website is working and how to improve it. We do not identify anyone, and we do not make or allow Google Analytics to (or attempt to) identify anyone visiting our website.
(b) We use a third party (Salesforce) to send you confirmation emails after you have contacted us.
(c) We have YouTube video content embedded on our website. YouTube controls any information that is collected by viewing their content. YouTube's privacy policy can be located at https://www.google.co.uk/intl/en-GB/policies/privacy/.
2.2 Social media
Our website contains links to our social media pages. Any information you provide to us via social media (including messaging, "liking", "following" and other communications) is controlled by the social media network.
We currently use:
2.2.1 Facebook, which has its own privacy notice that can be located at https://www.facebook.com/privacy/explanation. We recommend that you read their privacy notices and contact them directly if you have any concerns regarding their use of your personal information.
2.2.2 Twitter, which has its own privacy notice that can be located at https://twitter.com/en/privacy.
We recommend that you read their privacy notices and contact them directly if you have any concerns regarding their use of your personal information.
2.2.3 Instagram, which has its own privacy notice that can be located at Data policy | Instagram Help Centre. We recommend that you read their privacy notices and contact them directly if you have any concerns regarding their use of your personal information.
2.2.4 LinkedIn, Which has its own privacy notice that can be located at LinkedIn Privacy Policy.
We recommend that you read their privacy notices and contact them directly if you have any concerns regarding their use of your personal information.
2.2.5 TikTok, which has its own privacy notice that can be located at Privacy Policy | TikTok. We recommend that you read their privacy notices and contact them directly if you have any concerns regarding their use of your personal information.
2.3 Contacting us (other than about an application)
Our website provides you with different ways to contact us. All communications are handled, reviewed, and responded to internally by us. Please note, however, that:
(a) email monitoring or blocking software may also be used and you have a responsibility to ensure that any email you send to us is within the bounds of the law.
2.4 Application – personal information about children
We only accept applications that relate to children between the ages of 2 and 18. As part of the application, we will ask you for information about the child that the application relates to. The personal information we collect about the child is treated slightly differently depending on what type of information it is.
2.4.1 Special categories of data
We collect personal information about a child during the process of applying for a Magical Day Out from us. If you have made an application on behalf of a child based on a disability or illness, then you will have explicitly consented to our use of the personal information that relates to the child's condition, and you will have the right to withdraw consent (explained below). This information is what allows us to keep a record of beneficiaries. This information is needed to make sure we’re meeting the rules and policy of our programmes and includes the following personal information, which we refer to as special categories of data:
(a) a description of the child's disability, illness or other need stated in our criteria.
(b) confirmation of whether the child has a statement of educational needs or an Education, Health, and Care Plan.
(c) the name, if any, of any other organisation(s) or other charity(es) that support the child's disability or illness, if its name by itself, would help identify that there is a disability or illness.
(d) the name of the child's school if the name of the school, by itself, would help identify that there is a disability, illness or criteria need.
(e) proof of the child's condition
(f) any other information relating to the child's disability, illness, or criteria that you may decide to provide in support of your application.
As a registered charity we make sure that we are allocating Magical Days Out properly and following our charity objectives. We need the special categories of data listed above so that we can ensure that the child qualifies for a day out per our eligibility criteria and so that we are complying with our charitable aims.
We understand how important special categories of data are, so we will not share the child's special categories of data with any other person other than our external auditors, who will only use them to monitor our compliance with our charitable aims.
We will destroy the child's special categories of data on the later of:
(a) 12 months from when it is provided; or
(b) after an audit is carried out by our external auditors
This is usually no later than 2 years after the special categories of data is collected.
Please note that our external auditors are under a professional duty of confidentiality and will not share the special categories of data or use it for any other purpose. In very limited circumstances, where an application is being made on a last-minute basis, we may need to let the attraction the child will be visiting have the reason for the last-minute application; this may include special categories of data relating to the child's disability or illness. This is to ensure that the attraction expedites arranging the Magical Day Out for the child.
2.4.2 Child's personal information (other than their special categories of data)
We will also need to collect personal information about the child to process the application. This will be information that is in our legitimate interests to have, including the child's adversity (where the adversity is not a disability or illness) name and age, the school the child goes to and any organisations or charities that support the child's condition (where the school or organisation name do not identify the fact that the child has a disability or illness) and the child's preferred attraction to visit, to:
- verify the application
- verify the eligibility of the child
- process the application about a particular attraction
We will retain some personal data information, namely the child’s surname, the postcode and the email address used to make the application, for a period of up to 16 years for the sole purpose of checking whether the child has already benefitted from tickets through Merlin’s Magic Wand before, as we aim to reach as many new children as possible and therefore do not accept repeat applications.
Due to the high demand for tickets, we only accept applications from those families/households or children that we have not previously supported/have not visited us before. Because of this, we need to retain personal information in applications for as long as we reasonably require for cross-referencing to make sure that we are complying with our "one grant rule". We will delete this personal data when we reasonably consider that we no longer need it for this purpose. We will retain this personal information separately from the special categories of data and will keep it secure. Special categories of data will not be retained for these purposes.
We only arrange days out at attractions within the Merlin Group of Attractions. Please note that a list of the Merlin attractions available to you can be located within the application form.
We will only ever send personal information to the attraction where the child's day out is requested. The attraction needs this personal information to be able to arrange the day out, to send information to and otherwise communicate with you and the child.
2.5 Application – personal information relating to a parent relevant to the application
In some circumstances, we will collect personal information about a parent during the process of applying for a day out for a child, where the parent's life-limiting condition is relevant to the application. If we have requested this information, then you will have explicitly consented to our use of the personal information that relates to the parent's condition, and you will have the right to withdraw consent (explained below). This information includes:
(a) a description of the parent's disability or illness
(b) the name, if any, of any other organisation(s) or other charity(es) that support the parent or the child, if its name by itself, would help identify that there is a disability or illness
(c) proof of the parent's condition
(d) any other information relating to the parent's disability or illness that you may decide to provide in support of your application.
Where we have collected personal information in respect of a parent's condition, we will treat it in the same way as we treat the special categories of data for a child.
2.6 Application – personal information of the person making the application or a parent/guardian of a child
As part of the application, you will also submit personal information about yourself that we require in our legitimate interest. This includes your name, address, additional contact details and relationship status with the child. You will also provide details of your preferred attraction and any financial assistance you require with the day out.
Any personal information that is provided in and during the application process is used only to review the application, grant a day out and conduct the ongoing administration and management of any days out that are awarded. We may contact you separately if we want to create a news story or (electronic or physical) publication regarding your application and/or day out. It is in our interests to provide regular updates and feedback to our donors to be transparent about how our funds are being used. We will not use your (or the child's) personal information in an identifiable manner in any publication without your further explicit consent.
Due to the high demand for tickets, we only accept applications from those families/households or children we have not previously supported/have not visited us before. Because of this, we need to retain this personal information for as long as we reasonably require for cross-referencing to make sure that we are complying with our "one grant rule". We will delete this personal data when we reasonably consider that we no longer need it for this purpose.
We only arrange days out at attractions within the Merlin Group of Attractions. Please note that a list of the Merlin attractions available to you and their restricted dates for Magic Wand applicants can be located on this site. We will only ever send personal information to the attraction where the child's day out is arranged at. The attraction needs this personal information to be able to arrange the day out and to send tickets and other communications.
If you have applied for financial support for the day out at an attraction and are based outside of the UK, we will also request your bank account details. It is a contractual necessity for you to provide this so that we can pay the amount of our financial contribution to you. If you do not provide this information, you will not be able to receive our financial contribution. Your bank details will be deleted at the same time as special categories of data.
Please note that we may need to contact you about the application through any post, email, or telephone. Please can you make sure that you keep us updated on any changes to your contact details.
2.7 Personal information collected through our online shop or donations
If you donate through our online donation form, we will collect personal information about you for the contractual necessity to complete the financial transaction. The personal information we collect includes your name, address and contact details. If you do not provide this information, we cannot process the transaction with you.
We use JustGiving for processing the financial details relating to donations. JustGiving will also collect personal information that allows it to collect Gift Aid on donations. JustGiving does not share your payment details with us. To view JustGiving's privacy notice, please visit https://www.justgiving.com/info/privacy
Any personal information we obtain through a purchase made on our website is destroyed after 6 months.
2.8 Subscribing to our newsletter
We will collect your contact details (name and email address) in our legitimate interest if you have opted to subscribe to our e-newsletter. We will provide you with a clear choice in an application or purchase to opt-out of receiving our newsletter at the time of your application. Where you have not completed an application or made a purchase, you may still choose to receive our newsletter, but you will have to opt-in to receive it or contact us to explicitly ask to receive it.
If you ever decide you no longer wish to receive our newsletter, you can do so at any time by unsubscribing from the mailing list, using the link provided in the newsletter email. If you do unsubscribe, please note that Campaign Monitor will keep your email in a separate secure list on our behalf so that we can make sure that you do not receive our newsletter again in the future.
2.9 Feedback Questionnaire
We may send a survey out to the named applicant and, where different to an applicant, to any parent or guardian whose email contact details have been provided as part of the application process, following a visit to one of our attractions. We have a legitimate interest in doing this to find out about your and the child's experience through the application process and at the attraction. This will help us to improve our services for future applicants. The form itself is completed anonymously and does not involve any further processing or retention of personally identifiable information beyond what is set out above.
3 Disclosure of personal information
As mentioned in Section 2 above, we may provide certain personal information about the applicant and child to the attraction that the child will be visiting. If you have chosen an attraction that is located outside of the European Union, then this means that the personal information will also be transferred outside the European Union. To protect your personal information, we have taken steps to ensure that the attractions comply with our guidelines and policies on the protection of your personal information.
We will not usually disclose your (or the child's) personal information other than as already explained in Section 2 above. However, there may be circumstances where we need to share personal information other than as anticipated in Section 2 above. These include:
3.1.1 where an application or communication is made in a language other than English, we will use third-party translation services to translate the communication or application and all its content; the third party will not use the personal information for any other purpose.
3.1.2 where we are legally required to disclose the information. This includes sharing personal information with tax authorities and law enforcement agencies for the prevention and detection of crime.
3.1.3 where we need to disclose the personal information for or in connection with any legal proceedings or to obtain legal advice, or the disclosure is otherwise necessary for establishing, exercising, or defending legal rights.
3.1.4 disclosure is required to protect the charity's interests, or someone else's interests (for example, to prevent fraud).
3.1.5 disclosure is necessary to protect your or a child's vital interests (for example if the child is unwell on a day out, we or the attraction, may need to seek medical assistance).
3.1.6 it is to a third party to provide administrative or processing services on our behalf. If such disclosure is required, we will take steps to ensure that the third party protects the personal information in the same way that we do.
4 Keeping personal information secure
We know that you provide your personal information in good faith and expect it to be looked after. Therefore, we take the security of your personal information seriously. This means that we have taken steps internally to ensure that our systems adequately protect your personal information. This includes:
(a) keeping special categories of data in a separate password-protected file to all other personal information
(b) locating all personal information that we control on internal servers located in the United Kingdom
(c) ensuring strict access controls on a need-to-know basis
(d) monitoring access to personal information; and
(e) double encryption of the personal information on our servers.
5 Your rights
You have rights in respect of your personal information and this section explains a bit more about those rights that apply to what we do with your personal information and when you can exercise them. If you would like more information about any of your rights, please contact us on the details set out below.
5.1 Withdrawing consent
Where you have explicitly consented to us processing special categories of data, you can withdraw consent to our processing the special categories of data at any time during the application process. If you wish to withdraw consent, please do so in writing by sending your request in writing to our contact details below. Unfortunately, since we need to use the special categories of data to prove we have used our charitable funds correctly, we are unable to continue with your application if you withdraw consent. Therefore, by withdrawing consent, you acknowledge and accept that you are also waiving your right to any grant of a day out from us.
5.2 Accessing your personal information
We want you to fully understand and be comfortable with how we use your personal information. You can contact us at any time to ask whether we process any personal information about you. If we do hold or use your personal information in any way, you have the right to access that personal information. All we ask is that:
5.2.1 you make your request to access in writing the contact details below
5.2.2 you verify your identity; and
5.2.3 you are fair and reasonable with how often you make this kind of request.
Please allow us up to 30 days from receipt of your request to respond.
5.3 Requesting more information
We hope that you can understand that it is very difficult to cover all the possible ways in which we collect and use personal information. We have tried to be as clear and as open as we can. However, if you have any questions regarding our use of your personal information, we will be happy to give you peace of mind by answering any questions or providing any additional information that we can. If you do have any specific questions or need anything explained, please get in touch on the contact details below.
5.4 Additional rights
We may publish a policy, from time to time, to explain how we will handle your rights and what you can expect from us when you request to exercise your rights. If we do publish any such policy, we will provide a link to it here. In each instance, we may ask you to make your request in writing to the contact addresses below and provide verification of your identity.
5.4.1 You have the right to request that we rectify any inaccuracy about you that we may hold, in which case we may ask you to verify the corrected information (for example, we may ask for a recent utility bill for proof of a change of address)
5.4.2 You have the right to request that we erase your personal information. Please be aware that we can only comply with such a request if
(a) your personal information is no longer required for the purposes it was collected (for example, we need your personal information to process an application
(b) the collection, storage, or use of personal information by us is prevented by law
However, we can continue to retain your personal information if, without limitation, we require your personal information for establishing, exercising, or defending a legal claim such as in the conduct of legal proceedings.
5.4.3 You have the right to request that we restrict or refrain from processing your personal information:
(a) for the time it takes us to verify the accuracy of your personal information where you have disputed its accuracy
(b) where the collection, storage, or use of the personal information by us is unlawful but you decide not to ask for the erasure
(c) where we no longer need your personal information, but you need them for establishing, exercising, or defending a legal claim
(d) for the time it takes to determine whether we have an overriding legitimate ground to continue to process your personal information, where you have exercised your right to object to processing.
5.4.4 You have the right to data portability in respect of the information we have collected from you based on consent or for the reason of entering a contract. If you exercise this right, we will transfer a copy of the information that you have provided to us at your request.
5.4.5 You have the right to object to our use of your personal information:
(a) where we are using that information based on our legitimate interests, and where we do not have compelling overriding grounds to continue to use your personal information; or
(b) at any time, where we use your personal information to send you the newsletter or any other type of direct marketing, in which case it will no longer be used for that purpose, but it may be used for another lawful purpose.
6 Complaints
You are important to us, and so is protecting your personal information. We have high standards when it comes to collecting and using personal information. For this reason, we take any complaints we receive from you about our use of your personal information very seriously and request that you bring any issues to our attention.
Where you are communicating with us to make a complaint, we will only use your personal information to handle, investigate and respond to the complaint and to check on the level of service we provide. Where the complaint is about a member of MMW's team, we may have to disclose your identity to whomever the complaint is about. You may let us know that you don't want information that identifies you to be disclosed and we will try to respect your request; however, it may not be always possible to handle a complaint on an anonymous basis.
If you are unhappy, you can also contact the Information Commissioner's office to make a complaint directly.
7 Updating this privacy notice
We keep our privacy notice under regular review to ensure that it properly reflects our use of personal information. This privacy notice was last updated on 26th October 2022.
8 How to contact us
You can contact us by:
8.1 Post: For the attention of Head of Merlin's Magic Wand, Merlin's Magic Wand Trustees Limited, Link House, 25 West Street, Poole, Dorset, BH15 1LD.
8.2 Email: Complete the contact us form on the Merlin’s Magic Wand website.
