PRIVACY POLICY

Data Protection and Customer Privacy Policy
Balloons for U and Events for U

1. Purpose
Balloons for U and Events for U are committed to protecting the privacy and personal information of our customers, employees, suppliers and business contacts.
We handle personal information responsibly and in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

This policy explains what information we collect, why we collect it, how we use and protect it, and the rights individuals have over their personal information.

2. Scope
This policy applies to personal information collected or processed through:
•Customer enquiries and booking forms.
•Weddings, parties and corporate event bookings.
•Balloon styling, decoration and installation services.
•Customer telephone calls, emails, text messages and social media enquiries.
•Payments, deposits, invoices and refunds.
•Website forms and online booking systems.
•Employee, supplier and contractor records.

 

3. Information We Collect
Depending on the service provided, we may collect:
•Names and contact details, including telephone numbers and email addresses.
•Billing addresses, event venue addresses and delivery instructions.
•Event dates, times, guest requirements and booking preferences.
•Design briefs, photographs, inspiration images and decoration specifications.

•Booking confirmations, contracts, invoices, deposits and payment records.
•Relevant communications and customer feedback.
•Information needed to accommodate accessibility requirements or other specific event arrangements, where appropriate.

 

We will only collect information that is reasonably necessary for the relevant business purpose.

 

We do not intentionally collect sensitive personal information unless there is a legitimate and appropriate reason to do so and the relevant legal requirements are met.

 

4. How We Use Personal Information
We use personal information to:
•Respond to enquiries and provide quotations.
•Manage bookings, contracts, deposits and payments.
•Plan and deliver balloon decorations and event services.
•Arrange access to venues, deliveries, installations and collections.
•Communicate changes, confirmations and important event information.
•Manage refunds, complaints and customer service.
•Maintain business, tax and accounting records.
•Protect our business, prevent fraud and establish or defend legal claims.
•Send marketing communications where legally permitted.

 

We will not use personal information for unrelated purposes without an appropriate lawful basis and, where required, providing further information or obtaining consent.

 

5. Lawful Basis for Processing
We will identify an appropriate lawful basis for each use of personal information. Depending on the circumstances, this may include:
•Contract: where information is needed to provide a quotation, manage a booking or fulfil an agreement.
•Legal obligation: where information must be retained for tax, accounting or other legal requirements.
•Legitimate interests: where we have a genuine business need, such as managing enquiries, maintaining records or protecting our services, provided these interests do not override the individual's rights.
•Consent: where consent is legally required, such as for certain marketing activities or optional uses of photographs.
Where we rely on consent, individuals may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

6. Payments and Financial Information
Payments may be processed through banks, payment providers or secure online payment systems.

 

We will take reasonable steps to protect payment and financial information.
We will not routinely retain full payment card numbers or card security codes (CVV/CVC). Customers should use approved payment methods and should not send card security details through ordinary email, text message or social media.

 

Payment confirmations, transaction references, invoices and other financial records may be retained where necessary for accounting, dispute resolution or legal compliance.

7. Sharing Personal Information
We will only share personal information where necessary and lawful.
This may include sharing relevant information with:
•Payment processors and banks.
•Accountants, payroll providers and professional advisers.
•Delivery companies and installation contractors.
•Event venues and suppliers involved in fulfilling a booking.
•IT, email, website hosting and booking-system providers.
•Insurers, regulators, law enforcement or other authorities where legally required or justified.

 

We will share only the information reasonably necessary for the relevant purpose.
Where third-party service providers process personal information on our behalf, we will take appropriate steps to ensure suitable data protection arrangements are in place.

We will not sell customers' personal information to third parties.

8. Customer Photographs and Event Images
We may receive photographs from customers to help plan balloon designs and event styling.

Photographs may contain identifiable people and will be treated as personal information where applicable.

We will use photographs for booking and design purposes as agreed. We may publish it for marketing.

Before using identifiable customer or guest images for promotional purposes, we will establish an appropriate lawful basis and obtain consent where required.

Customers should avoid sending photographs containing unnecessary personal information

.
9. Data Security
We will take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
•Password-protecting devices and accounts.
•Using appropriate access controls and secure storage.
•Limiting access to booking information to authorised personnel.
•Keeping paper records in secure locations.
•Avoiding unnecessary sharing of customer details through messaging apps or social media.
•Using reputable payment and booking providers.
•Securely deleting or destroying information when it is no longer required.

 

Employees and contractors who have access to customer information must keep it confidential and use it only for authorised business purposes.

10. Retention of Personal Information
We will not keep personal information indefinitely. Records will be retained only for as long as necessary for the purpose for which they were collected, taking account of legal, accounting and business requirements.

 

Our general retention approach is:
•Unsuccessful enquiries: normally up to 12 months after the last meaningful contact.
•Booking and event records: normally up to 24 months after the event, unless a longer period is justified by a dispute, warranty, insurance or other legitimate requirement.
•Invoices and financial records: for the applicable statutory accounting and tax retention period, generally six years for relevant company accounting records.
•Marketing records: until consent is withdrawn or the individual objects, subject to keeping a minimal suppression record where needed to respect that choice.
•Complaints and legal claims: for as long as reasonably necessary to investigate, resolve or defend the matter.

 

These are proposed standard periods and will be adjusted where specific legal obligations or circumstances require a different period. Information will be securely deleted or destroyed when no longer required.

11. Customer Rights
Under data protection law, individuals may have the right to:
•Request access to their personal information.
•Ask for inaccurate information to be corrected.
•Request deletion of information in certain circumstances.
•Request restriction of processing in certain circumstances.
•Object to processing where the law provides that right.
•Request a portable copy of certain information.
•Withdraw consent where processing is based on consent.
•Complain to the Information Commissioner's Office (ICO).

These rights are subject to legal conditions and exceptions. We will respond to valid requests within the applicable statutory timeframe, normally one month.
Requests should be sent to the contact details in Section 14. We may need to verify the identity of the person making a request before releasing information.

12. Marketing Communications
We may send service-related messages needed to manage an enquiry or booking.
Marketing emails or text messages will only be sent in accordance with applicable electronic marketing and data protection rules. Where c

onsent is required, it will be obtained separately from the booking process.
Individuals can unsubscribe or opt out of marketing communications at any time. Opting out of marketing will not prevent us from sending essential communications about an existing booking or contract.

13. Data Breaches
Any suspected loss, unauthorised access or disclosure of personal information must be reported to management promptly.

We will investigate incidents, take steps to contain and reduce any harm, keep appropriate records and notify the ICO and affected individuals where legally required.

14. Contact Details and Complaints
For questions about this policy, requests relating to personal information or privacy concerns, please contact:
Business: Balloons for U / Events for U

Privacy contact: Management

Email: sales@balloonsforu.co.uk

Telephone: 01256 819200

If an individual is unhappy with how their personal information has been handled, they should contact us first so we can try to resolve the issue.

Individuals may also complain to the Information Commissioner's Office through its website: https://ico.org.uk/make-a-complaint/

15. Policy Review
This policy will be reviewed at least annually and whenever there are significant changes to our services, booking systems, data processing activities or applicable legislation.

The policy will be made available to customers at the point their personal information is collected and through our website or other appropriate customer communications.

 

Version:  January 2026