< Home

PRIVACY NOTICE

Merlin Annual Pass Backstage (Research Community)

1. Who We Are

Merlin Attractions Operations Limited (“MAOL” or “Merlin”), a Member of the Merlin Group, (“we”, “us”, “our”) is the data controller responsible for your personal data in connection with the Research Community.

We are located in Arbor Building, 16th Floor 255 Blackfriars Road London SE1 9AX.

Contact details for privacy matters:

• Email: data.protection@merlinentertainments.biz

If you are located in the UK, you may also contact the Information Commissioner’s Office (ICO): www.ico.org.uk.

2. About This Notice

This notice applies to individuals who hold an annual pass and have accepted the Research Community terms and conditions. It explains what personal data we collect, why we collect it, how we use it, and your rights.

This notice should be read alongside the general privacy notice applicable to annual pass holders and the Research Community terms and conditions.

3. Personal Data We Collect

3.1 Registration and Screener Data

The following data is collected when you register for the Research Community:

• Name and email address
• Date of birth
• Gender
• Household income (self-reported, used for research segmentation purposes)
• Location: UK members — region; US members — state, county, and zip code
• Whether children under 13 are present in your household, and their age range (under 6, 7–10, or 11–13) — collected for research segmentation purposes only and not used to make decisions about you as an individual
• Merlin annual pass membership status and membership number
• Records of your acceptance of the Research Community terms and conditions

3.2 Survey and Research Data

The following data may be collected through ad-hoc surveys and research tasks. The specific data collected will vary by survey:

• Written survey responses, including open-ended text responses
• User-submitted media: video recordings, voice recordings, and photographs, where a survey task requires this
• Self-reported visitation behaviour: attractions visited, who you visited with, and when
• Records of survey participation and completion

3.3 Forum and Community Data

• Posts, comments, and messages you submit to the Research Community forum
• Interactions with other members on the forum

Please note: the forum includes instructions asking members not to include personal data in their posts. We nonetheless recommend that you avoid sharing personal information about yourself or others in forum posts.

3.4 Technical and Platform Data

• Device type and browser used to access the platform
• Platform usage data: last login, and record of activities completed (e.g. surveys taken, comments posted)

Some of this technical data is collected via cookies and similar technologies, as well as server-side logging. Please refer to our Cookie Notice for further information about how cookies are used on the platform.

3.5 Communications and Incentive Data

• Records of communications sent to you about surveys and the Research Community
• Details of any incentives offered or redeemed (e.g. park discounts)

4. How and Why We Use Your Personal Data

4.1 Research and Surveys

We use your survey responses and related data to conduct research that informs decisions about park operations, visitor experience, and marketing. This includes the use of automated tools and artificial intelligence to assist in analysing survey responses at an aggregated level.

The AI-assisted analysis produces aggregated insights (for example, identifying common themes across responses). It does not produce decisions that are directed at you individually or have a legal or similarly significant effect on you as an individual.

Legal basis (UK GDPR): Consent — Article 6(1)(a). You provide consent when you accept the Research Community terms and conditions and participate in surveys. You may withdraw your consent at any time (see Section 9).

4.2 Forum

We process data you submit to the forum to operate and moderate the community forum and to facilitate communication between members.

Legal basis (UK GDPR): Consent — Article 6(1)(a), provided at registration.

4.3 Communications

We use your contact details to send you communications about surveys, Research Community updates, and information about incentives for participation.

Legal basis (UK GDPR): Consent — Article 6(1)(a).

4.4 Incentives

Where you are offered an incentive to participate (such as a discount at the park), we process the data necessary to administer and fulfil that incentive.

Legal basis (UK GDPR): Performance of a contract or steps taken at your request — Article 6(1)(b), or consent where separately obtained.

5. Artificial Intelligence and Automated Processing

Survey responses submitted through the Research Community are processed using an AI tool operated by a third-party service provider acting as our data processor. Where surveys include requests for video, voice, or photo submissions, those media files are also processed by the AI tool, in addition to being reviewed by our internal research teams.

The AI tool is used to carry out thematic and content analysis (identifying common topics, themes, and patterns across responses) and sentiment analysis (assessing the overall tone or sentiment expressed in written, spoken, or visual responses). This analysis is conducted across the Research Community as a whole to generate aggregated insights.

This AI-assisted processing:

• Operates at an aggregated level across survey responses
• Does not produce decisions directed at you as an individual
• Does not produce legal effects or similarly significant effects on you
• Informs general business decisions about park operations, services, and marketing over time

The third-party AI processor is contractually bound to process your data only on our documented instructions and in accordance with applicable data protection law.

6. Who We Share Your Data With

We do not sell your personal data. We may share it with:

• AI and survey analysis service providers acting as data processors on our behalf
• IT and platform providers supporting the Research Community
• Park operations and marketing teams within our group, for the purposes described in Section 4
• Regulatory authorities or law enforcement, where required by law

All third-party processors are subject to appropriate contractual safeguards. Where data is transferred outside the UK, we ensure appropriate transfer mechanisms are in place in accordance with UK GDPR.

7. How Long We Keep Your Data

We retain your personal data for as long as you hold an active annual pass and remain a member of the Research Community, and for a reasonable period thereafter as necessary for the purposes described in this notice. The following specific retention periods apply:

• Registration and screener data: retained for the duration of the Research Community agreement
• Forum data: retained for the duration of the Research Community agreement
• Ad-hoc survey data (including written responses, video, voice, photo, and map task data): deleted after 2 years from the date of collection

You may request deletion of your data at any time (see Section 9).

8. Your Rights

As a data subject under UK GDPR, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restriction — to request that we limit processing in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing in certain circumstances
• Right to withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at dpo@strat7.com

9. Withdrawing Consent

You may withdraw your consent to participation in the Research Community at any time by contacting us at dpo@strat7.com or by following the unsubscribe process in any survey communication.

Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal. It will mean you no longer receive surveys or Research Community communications, and your forum access will cease.

If you wish to withdraw your consent and leave the Research Community entirely, you may delete your account at any time via your account settings. Account deletion is immediate and will result in the permanent deletion of all your personal data. You do not need to contact us to do this.

10. Additional Information for US Residents

This section applies to residents of US states with applicable consumer privacy laws, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and equivalent laws in other states.

Note: The applicability of US state privacy laws to your specific situation may depend on factors such as your state of residence, the nature of the data, and applicable thresholds. This section is provided for transparency; you should take independent advice if you have questions about which laws apply to you.

10.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (name, email address)
• Commercial information (incentive redemption records, membership details)
• Internet or other electronic network activity (forum activity, survey completion records)
• Inferences drawn from personal information (aggregated research insights derived from survey responses)

10.2 Purposes of Collection

Personal information is collected and used for the purposes described in Section 4 of this notice: research and analysis, community operation, communications, and incentive administration.

10.3 Sale or Sharing of Personal Information

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioural advertising.

10.4 Your Rights Under US State Laws

Subject to applicable law and verification of your identity, you may have the right to:

• Know what personal information we have collected, used, or disclosed about you
• Access your personal information
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share)
• Non-discrimination for exercising your privacy rights

California residents may also designate an authorised agent to make requests on their behalf. To submit a rights request, contact us at dpo@strat7.com. We will respond within the timeframe required by applicable law.

11. Map Tasks

The community platform includes an optional map feature powered by the Google Maps API. Members may be invited to take part in map tasks once they have joined the Research Community. Participation in map tasks is entirely optional and is not a condition of joining or remaining a member of the Research Community.

11.1 What the Map Feature Does

Where a map task is available, members may manually drop a pin on a map within the app to indicate a location they have visited (for example, a park area or attraction). The following applies to this feature:

• Location data is only recorded when you manually drop a pin. The app does not track your location in real time and does not collect location data passively or continuously.
• The pin location you submit is associated with your member account and used for the research purposes described in Section 4.
• The map functionality is provided via the Google Maps API. Google’s own terms and privacy policy apply to the delivery of the map service itself. Please refer to Google’s privacy policy for details of how Google processes data in connection with the Maps API.

11.2 Legal Basis for Map Task Processing

Legal basis (UK GDPR): Consent — Article 6(1)(a), captured at Research Community registration.

12. Changes to This Notice

We may update this notice from time to time. Where changes are material, we will notify you by email or via the Research Community platform. The current version will always be accessible within the Research Community portal.

13. Contact Us

For any questions about this notice or about how we handle your personal data, please contact us at dpo@strat7.com.