Little Nasa : GDPR & Data Protection Policy

Last updated: 3 August 2026

Little Nasa Limited is committed to protecting the privacy and personal data of all customers, children, parents, staff, and visitors. This policy explains how we collect, use, store, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our website or services, you agree to the terms of this policy.

1. Who We Are

Little Nasa Limited Company number: 17308502 Correspondence address: c/o Azets, Orion House, Orion Way, Kettering, Northamptonshire, NN15 6PE Email: info@littlenasa.com

Little Nasa Limited is the Data Controller for all personal data processed by our business.

2. What Personal Data We Collect

Customer & Parent Information

  • Name

  • Email address

  • Phone number (if provided)

  • Booking details

  • Payment information (processed securely by third‑party providers)

  • Any information submitted through our contact forms or email

Child Information

  • Full name

  • Age (to ensure safe and appropriate play)

  • Allergy or dietary information (only when voluntarily provided)

Website Data

  • IP address

  • Cookie data

  • Browsing behaviour

  • Contact form submissions

CCTV Footage

Little Nasa operates CCTV for:

  • Safety and safeguarding

  • Security and crime prevention

  • Monitoring incidents within the premises

CCTV footage is stored securely for a limited period (typically 30 days) unless required for investigation.

We will only release CCTV footage when formally requested by the police or a governing body, and only when appropriate paperwork or legal authority is provided. We do not release CCTV footage to members of the public.

3. How We Use Your Data

We use personal data to:

  • Manage bookings and payments

  • Communicate with you about your visit

  • Ensure the safety and wellbeing of children

  • Provide party and event services

  • Respond to enquiries

  • Improve our website and customer experience

  • Meet legal and regulatory obligations

We never sell your data or share it with third parties for marketing.

4. Lawful Bases for Processing

Under UK GDPR, we rely on:

  • Contract – to provide the services you have booked

  • Consent – for optional information such as dietary needs

  • Legal obligation – for accounting, incident reporting, or safety requirements

  • Legitimate interests – for CCTV, fraud prevention, and service improvement

5. How We Store & Protect Your Data

We take appropriate technical and organisational measures to keep your data secure, including:

  • Encrypted payment processing

  • Secure booking systems

  • Restricted staff access

  • Regular security reviews

  • Secure deletion of data when no longer required

CCTV footage is stored on secure systems with restricted access.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary:

  • Booking and payment records: up to 6 years (legal requirement)

  • General enquiries: 12 months

  • CCTV footage: typically 30 days, unless required for investigation

  • Incident reports: as required by law

7. Your Rights Under UK GDPR

You have the right to:

  • Access your personal data

  • Request correction of inaccurate data

  • Request deletion of your data

  • Object to certain types of processing

  • Request restriction of processing

  • Request data portability

  • Withdraw consent at any time (where applicable)

To exercise any of these rights, email us at: info@littlenasa.com

8. Subject Access Requests (SARs)

(Aligned with ICO guidance)

What is a SAR?

A Subject Access Request allows you to ask for a copy of the personal data we hold about you and information about how it is used.

How to Make a SAR

You can make a SAR verbally or in writing. For clarity, we recommend emailing: info@littlenasa.com

Please include:

  • Your name

  • Contact details

  • Details of the information you are requesting

  • Proof of identity (we will request this before releasing data)

Response Time

We will respond within one month of receiving your request and verifying your identity. If the request is complex or involves large volumes of data, we may extend the deadline by up to two additional months, and we will notify you if this is necessary.

Fees

SARs are free of charge, unless the request is clearly unfounded or excessive. In such cases, we may charge a reasonable fee or refuse the request, as permitted by the ICO.

What You Will Receive

We will provide:

  • Confirmation that we process your data

  • A copy of the personal data we hold

  • The purposes of processing

  • Who we share data with

  • How long we keep it

  • Information about your rights

CCTV Footage & SARs

Under ICO guidance, individuals do not automatically have the right to receive CCTV footage if it identifies other people. Therefore:

  • We do not release CCTV footage to members of the public.

  • We only release footage to the police or authorised governing bodies with the correct legal documentation.

  • If you submit a SAR relating to CCTV, we may provide a written summary of any relevant incident involving you, where appropriate.

9. Sharing Your Data

We may share data with:

  • Payment processors

  • Booking system providers

  • Insurers (for incident reporting)

  • Law enforcement (only when legally required)

All third parties must comply with UK GDPR.

10. Children’s Data

We only collect the minimum information necessary to ensure safe play. Parents or guardians must provide consent for any optional data.

11. Cookies & Website Tracking

Our website uses cookies to improve user experience. You can manage or disable cookies through your browser settings.

12. Changes to This Policy

We may update this policy occasionally. The latest version will always be available on our website.

13. Contact Us

For any questions about this policy or your data rights, please contact: info@littlenasa.com