Privacy policy.

1. Who is responsible for your information?

Priv Eastbourne Ltd., trading as PRIV @ The Works, is the data controller for the personal information we use to manage our website and respond to your enquiries. This means we decide why and how that information is used.

You can contact us about your information, exercise your rights or make a privacy complaint:

This policy covers this website and the enquiries and booking communications that follow from it. It explains our approach under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended, including by the Data (Use and Access) Act 2025.

2. What information we receive

• When you contact us: your name, email address, enquiry subject, message and any contact details or attachments you choose to send.
• For a private hire or booking enquiry: your preferred date, occasion, expected guest numbers, food and drink preferences, and the arrangements we discuss with you.
• When you browse: technical information needed to deliver and protect the website, such as your IP address, browser and device information, requested pages, request times and security signals, processed by our hosting and security providers.
• For a privacy request or complaint: the information needed to understand and answer it, and proportionate identity or authority checks where necessary.

We normally receive enquiry information directly from you. An event organiser or someone acting on your behalf may also give us information needed to arrange your visit. Please share only necessary details about other people and make them aware of this policy. Where required, we will also provide privacy information to them directly.

The website does not have customer accounts or take online payments. Please do not send payment card details, identification documents or unnecessary sensitive information through an enquiry. We do not ask for health information in these forms. If a particular request needs health information, such as an accessibility or allergy-related requirement, we will explain its use and obtain explicit consent where required before using it.

3. How the enquiry forms work

Our forms prepare a message in your own email app. Clicking the enquiry button does not send your message to PRIV or save the form contents on our website servers. You need to review and send the email yourself. Your email app or provider may save a draft under its own settings and privacy policy.

Once you send an email, we receive and retain it as business correspondence. Your email provider and our email service process it to deliver and store the message.

You do not have to contact us or supply personal information to browse the website. If you want a reply or a booking, we need enough contact and arrangement details to help you. Without them, we may be unable to answer your enquiry or organise the service you have requested.

4. Why we use information and our lawful bases

Answering general enquiries

We use your contact details and message to respond and handle relevant follow-up. Our lawful basis is legitimate interests: communicating with people who contact the business and providing helpful customer service.

Arranging and managing a booking

Where you are the customer, we use necessary information to take steps at your request before entering a contract and to perform that contract. If you are organising something for an employer or another customer, we rely on legitimate interests in coordinating that customer’s booking and keeping the right contact informed.

Running and protecting the website

Our legitimate interests are providing a working website, maintaining security, troubleshooting faults and preventing misuse. We consider the impact on your privacy and use information proportionately for these purposes.

Meeting legal responsibilities

We use necessary information to comply with legal obligations, including applicable accounting requirements and responding to data protection rights requests and complaints. Where necessary to establish, exercise or defend legal claims, we rely on our legitimate interests in protecting legal rights.

Uses that require consent

Where we ask for consent for a separate purpose, we will explain that purpose when we ask. For health information that requires explicit consent, that consent is also the relevant special-category condition. You can withdraw consent at any time by contacting us; withdrawal does not affect lawful use before that point.

Sending an enquiry does not subscribe you to marketing. These forms are for responding to you and arranging the service you request. This website does not make solely automated decisions about you with legal or similarly significant effects, or build advertising profiles.

5. Who information is shared with

Information is available to people who need it to deal with your enquiry, provide the requested service or meet a legal responsibility. Depending on the information and purpose, this includes:

• PRIV staff responsible for customer enquiries and arrangements;
• our business email, IT and website service providers;
• professional advisers, such as accountants, insurers or legal advisers, where necessary; and
• regulators, courts or public authorities where disclosure is legally required or otherwise lawfully necessary.

The website uses OpenAI’s Sites hosting service and Cloudflare’s delivery and security infrastructure. They process technical information when the website is requested. The enquiry forms do not send their contents to these services as a form submission.

We do not sell your enquiry details or provide them to other businesses for their own marketing. Where a provider processes information on our behalf, it must do so under the applicable data protection arrangements. Providers may also have their own responsibilities for information they process for their own security or legal purposes.

6. Information processed outside the UK

Our hosting and security providers operate internationally, including in the United States, so technical information may be processed outside the UK.

OpenAI describes using adequacy decisions or standard contractual clauses with the UK International Data Transfer Addendum. Cloudflare describes relying on the UK Extension to the EU–US Data Privacy Framework for covered US transfers, and contractual safeguards for other relevant transfers.

You can read more in OpenAI’s privacy policy and Cloudflare’s privacy policy. Where we are responsible for a restricted transfer, an appropriate UK transfer mechanism must be in place. Contact us for details of a transfer affecting your information or to request a copy of the relevant safeguards.

7. How long information is kept

We keep information for the purpose it is needed for, rather than keeping every enquiry indefinitely. The criteria depend on the record:

• General enquiries: until the enquiry and relevant follow-up are complete. If it becomes a booking, necessary details form part of that booking record.
• Booking correspondence: while arranging and delivering the booking and settling any outstanding matters. After that, we retain only records needed for applicable accounting requirements, a complaint or a legal claim.
• Privacy requests and complaints: while handling the matter and for as long as necessary to evidence our response or deal with a related regulatory enquiry or legal claim.
• Technical and security records: according to the hosting providers’ retention criteria, including the time needed to deliver the service, investigate misuse and meet legal obligations. Their privacy policies explain those criteria; the security cookie described below has its own expiry period.

When deciding whether a record is still needed, we consider unresolved issues, applicable legal record-keeping and claim periods, the sensitivity of the information and whether the purpose can be met with less detail. We delete or anonymise information that is no longer needed. You can ask us about the retention of a particular enquiry or record.

8. Cookies, security and other websites

We have not added analytics tools, advertising pixels or social media tracking scripts to this website. Its own code does not store your enquiry in cookies or browser storage. Essential security cookies can still be set by the hosting infrastructure.

The cookie banner offers equally prominent Accept and Reject optional choices. Only essential cookies are currently used, so either choice leaves the same necessary security and preference functions active. Clicking Accept does not authorise any future analytics, advertising or other optional purpose. We will explain any new purpose and ask for fresh consent before introducing technologies that require it.

Security checks can vary with the traffic being assessed. Cloudflare explains its security technologies in its cookie documentation. You can remove or block cookies using your browser settings, although blocking necessary security cookies may affect access to the site. If we introduce optional tracking technologies that require consent, we will provide the relevant choice before using them and update this policy.

Instagram, Facebook and map links take you to separate services. We use ordinary links, rather than embedded social feeds or maps. If you follow a link, that service’s privacy and cookie policies apply to your use of it.

9. Protecting your information

The website uses HTTPS to protect information in transit between your browser and the hosting service. We limit access to enquiry information to staff and service providers who need it for the purposes described here. Please send only the information needed for your enquiry; no internet or email service can guarantee complete security.

10. Your data protection rights

Depending on the circumstances and the lawful basis, you can ask to access your personal information, correct inaccurate or incomplete information, erase it, restrict its use, or receive information you provided in a portable format where the legal conditions apply.

You can also withdraw consent for any consent-based use by contacting us. This will not affect processing that was lawful before withdrawal.

To make a request, email hello@priv-eastbourne.co.uk, write to the address above or speak to us at the venue. You do not have to use a special form or legal wording. We may need proportionate information to confirm your identity or your authority to act for someone else.

We normally respond without undue delay and within one calendar month, without a fee. Where the law permits an extension for a complex request or several requests, we can take up to two further months and will explain this within the initial response period. If a lawful exception or adjustment to the time limit applies, we will explain it. These rights are not absolute; if we cannot fulfil a request, we will explain why and how you can challenge our response.

11. Questions and complaints

If you are concerned about how we have handled your information, contact hello@priv-eastbourne.co.uk, write to Priv Eastbourne Ltd. at the address above, or raise the matter with us at the venue. Tell us what happened and how you would like us to contact you. You do not have to label your message as a formal complaint.

We will acknowledge a data protection complaint within 30 days of receiving it, investigate without undue delay, keep you informed and explain the outcome and any action taken.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Visit ico.org.uk/make-a-complaint for its current contact details and complaint process. The ICO generally recommends raising your concern with the organisation first; this does not remove your right to complain to the regulator.

12. Changes to this policy

We will update this page when the website or our handling of information changes. The date at the top shows the latest update. If a change affects how we use information you have already provided, we will give any additional notice or obtain any consent required by law.