Privacy Policy
PB London Experience Limited
Last updated: 9 June 20261. Introduction
This Privacy Policy explains what personal information PB London Experience Limited collects when you sign up to our waiting list or mailing list, how we use it, who we share it with, how long we keep it, and what rights you have. Please read this policy carefully before providing us with your personal data.
By signing up to our mailing list you are accepting and consenting to the practices described in this policy. You may withdraw your consent at any time (see Section 9 below).
2. Who We Are
PB London Experience Limited (Company No. 17189202), Northburgh House, 10 Northburgh Street, London, England, EC1V 0AT is the Data Controller in respect of personal data collected through this website.
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions, please contact the DPO at:
Email: info@peakyblinders.london
3. What Does This Policy Cover?
This policy applies to personal data collected through this website only. It does not cover:
- Ticket purchases, which are handled by Gigantic Tickets — please see https://www.gigantic.com/privacy-policy for details.
- Third-party websites linked from this site. We are not responsible for the privacy practices of those websites and recommend you review their policies before providing any personal data.
4. What Information Do We Collect?
When you sign up to our waiting list or mailing list, we collect:
- First name
- Last name
- Email address
When you browse our website, we may also collect technical data automatically, including your IP address, browser type, pages visited, session duration, and approximate geographic location (via cookies and analytics tools). See Section 8 (Cookies and Analytics) below.
We do not collect any special categories of personal data (such as racial or ethnic origin, health data, biometric data, or data about criminal convictions).
5. Lawful Basis for Processing
The following sets out each purpose for which we process your personal data, the data involved, the lawful basis we rely on, and whether the relevant entity acts as a Controller or Processor in relation to your data.
Note on Controllers and Processors: Where we share your data with a third party that processes it for its own purposes (such as its own marketing), that party is an independent Controller and is responsible for its own compliance with data protection law. Where we share data with a party that processes it only on our instructions (such as an analytics tool), that party is a Processor and we remain responsible.
---
Purpose: Mailing list — informing you when tickets go on sale
Personal Data Processed: First name, last name, email address
Lawful Basis: Consent (Art. 6(1)(a) UK GDPR). You opt in at sign-up. You may withdraw consent at any time.
Controller / Processor Role: PB London Experience Ltd (Controller)
---
Purpose: Marketing — informing you of future exhibitions and events operated by PB London Experience Limited
Personal Data Processed: First name, last name, email address
Lawful Basis: Consent (Art. 6(1)(a) UK GDPR). You agree to receive these communications at sign-up. You may withdraw at any time.
Controller / Processor Role: PB London Experience Ltd (Controller)
---
Purpose: Sharing with Banijay Rights Limited for co-production and marketing of future Peaky Blinders brand events and products
Personal Data Processed: First name, last name, email address
Lawful Basis: Consent (Art. 6(1)(a) UK GDPR). A separate, granular consent is obtained at the point of data collection for this sharing.
Controller / Processor Role: Banijay Rights Ltd (Independent Controller). Banijay processes data for its own purposes under its own privacy policy.
---
Purpose: Sharing with Kilimanjaro Live Limited (MyTicket) for ticket fulfilment and marketing of future events
Personal Data Processed: First name, last name, email address
Lawful Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) — to enable the ticketing service you have requested and to market related events. We have conducted a legitimate interests assessment (LIA); a copy is available on request.
Controller / Processor Role: Kilimanjaro Live Ltd (Independent Controller). Kilimanjaro processes data for its own ticketing and marketing purposes under its own privacy policy.
---
Purpose: Sharing with The Arches at London Bridge Limited for venue operations and marketing
Personal Data Processed: First name, last name, email address
Lawful Basis: Legitimate interests (Art. 6(1)(f) UK GDPR) — necessary for the operation of the venue at which events take place. We have conducted a LIA; a copy is available on request.
Controller / Processor Role: Arches at London Bridge Ltd (Independent Controller). Arches processes data for its own operational and marketing purposes under its own privacy policy.
---
Purpose: Website analytics and service improvement (including use of cookies and similar technologies)
Personal Data Processed: IP address, browser type, pages visited, session duration, approximate location, email address (where logged in)
Lawful Basis: Consent (Art. 6(1)(a) UK GDPR) for non-essential analytics cookies, obtained via our cookie consent banner. Legitimate interests (Art. 6(1)(f) UK GDPR) for strictly necessary technical cookies.
Controller / Processor Role: PB London Experience Ltd (Controller). Analytics providers (e.g. Google Analytics) act as Processors under data processing agreements.
---
6. When and With Whom Do We Share Personal Data?
We do not sell your personal data. We share it only as described in the lawful basis table above and as set out below.
6.1 Independent Controllers
The following organisations receive your data and process it as independent Data Controllers under their own privacy policies. Once data is transferred to them, they are separately responsible for their own processing:
Banijay Rights Limited — Company No. 06857521, Shepherds Building Central, Charecroft Way, London, W14 0EE. Shared for co-production and Peaky Blinders brand marketing. Privacy policy: banijayrights.com/privacy-policy
Kilimanjaro Live Limited (MyTicket) — Company No. 06355160, 1F Northburgh House, 10 Northburgh Street, London, EC1V 0AT. Shared for ticket fulfilment and marketing. Privacy policy: myticket.co.uk/privacy-policy
The Arches at London Bridge Limited — Company No. 12749855, First Floor, Northburgh House, 10 Northburgh Street, London, EC1V 0AT. Shared for venue operations and marketing. Privacy policy: archeslondonbridge.co.uk/privacy-policy
6.2 Processors
We also engage the following categories of service providers who process personal data only on our instructions as Processors:
- Email marketing platform providers (acting on our instructions to send communications to our mailing list)
- Website hosting and infrastructure providers
- Analytics providers (see Section 8)
All Processors are required to implement appropriate security measures and may only process data in accordance with our written instructions.
7. How Long Do We Keep Your Personal Data?
We retain personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with applicable law. The following sets out our specific retention periods. Where law or regulation requires a longer period, we will retain data for that period.
---
Category: Mailing list — name and email address
Purpose of Retention: Informing you when tickets go on sale; general marketing by PB London Experience Ltd
Retention Period: Until you withdraw consent or unsubscribe, plus up to 6 years from the date of withdrawal to comply with limitation periods and defend any legal claims
Retention Trigger: Withdrawal of consent / unsubscribe action
---
Category: Marketing consents and consent records
Purpose of Retention: Demonstrating compliance with consent requirements under UK GDPR
Retention Period: 6 years from the date consent was given, amended or withdrawn
Retention Trigger: Date of consent event
---
Category: Data shared with Banijay Rights Ltd (consent-based)
Purpose of Retention: Co-production and Peaky Blinders brand marketing
Retention Period: Until you withdraw consent from Banijay directly (see their privacy policy), or up to 6 years from the date consent was given to us, whichever is earlier
Retention Trigger: Withdrawal of consent or expiry of 6-year period
---
Category: Data shared with Kilimanjaro Live Ltd / MyTicket (legitimate interests)
Purpose of Retention: Ticket fulfilment and event marketing
Retention Period: Up to 6 years from the date of sharing, subject to Kilimanjaro's own retention policy
Retention Trigger: Date of data transfer
---
Category: Data shared with Arches at London Bridge Ltd (legitimate interests)
Purpose of Retention: Venue operations and marketing
Retention Period: Up to 6 years from the date of sharing, subject to Arches' own retention policy
Retention Trigger: Date of data transfer
---
Category: Website analytics data (cookies, usage logs)
Purpose of Retention: Website improvement and service analytics
Retention Period: Up to 26 months from the date of collection (in line with ICO guidance on analytics retention), unless you withdraw cookie consent earlier
Retention Trigger: Date of collection or consent withdrawal
---
Category: Security and technical logs (server logs, access logs)
Purpose of Retention: Security monitoring and incident investigation
Retention Period: Up to 12 months from the date of creation
Retention Trigger: Date of log creation
---
Where data is shared with independent Controllers (see Section 6.1), those organisations apply their own retention periods in accordance with their own policies. We encourage you to review those policies. On expiry of any retention period, we will securely delete or anonymise your personal data.
8. Cookies and Analytics
We use cookies and similar tracking technologies on our website. Cookies are small text files placed on your device. We use the following categories of cookies:
- Required for the website to function (e.g. session management). These do not require your consent under the Privacy and Electronic Communications Regulations (PECR).
- We use Google Analytics (or similar) to understand how visitors use our site (e.g. pages visited, session duration, device type). These cookies are only placed with your consent, obtained through our cookie consent banner when you first visit the site.
You may withdraw or manage your cookie consent at any time by clicking the 'Manage Cookies' link in the footer of our website, or by adjusting your browser settings. Withdrawing cookie consent will not affect the lawfulness of processing carried out before withdrawal.
Analytics data collected via cookies is retained for up to 26 months in accordance with ICO guidance. IP addresses collected for analytics purposes are anonymised where possible.
9. International Transfers of Personal Data
Some of our service providers (including analytics providers such as Google Analytics) may transfer or store your personal data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place to protect your data in accordance with UK GDPR, including:
- Transfers to countries that the UK Government has determined provide an adequate level of data protection (adequacy decisions); or
- Use of the UK International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses; or
- Other lawful transfer mechanisms recognised under applicable UK data protection law.
You may request further information about the specific safeguards in place for any international transfer by contacting us at info@peakyblinders.london.
10. How Do We Protect Your Personal Data?
We have implemented appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration or disclosure. These include:
- Storing data on secure, access-controlled servers
- Restricting access to personal data to employees and contractors who have a business need to process it
- Requiring all staff with access to personal data to be subject to appropriate confidentiality obligations
- Maintaining data processing agreements with all Processors
Please note that transmission of information over the internet is not completely secure. We cannot guarantee the security of data in transit; any transmission is at your own risk. Once received, we apply robust controls to protect your data.
11. Your Rights Under Data Protection Law
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. We will respond to all valid requests within one month (or within three months for complex or multiple requests, in which case we will notify you of the extension and the reasons for it).
Right of Access (Subject Access Request): You have the right to obtain a copy of the personal data we hold about you, together with supplementary information about how we process it.
Right to Rectification: You have the right to require us to correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure ('Right to be Forgotten'): You have the right to ask us to delete your personal data where there is no longer a legitimate reason for us to process it, or where you have successfully exercised your right to object (see below). This right is not absolute and may not apply where we are required to retain data by law.
Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances (for example, while we verify the accuracy of data you have disputed).
Right to Data Portability: Where we process your personal data based on your consent or on the performance of a contract, and the processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transferred to another controller where technically feasible.
Right to Object: Where we rely on legitimate interests as our lawful basis, you have the right to object to that processing at any time on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise or defence of legal claims.
Right to Withdraw Consent: Where we rely on consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. You can withdraw consent by clicking 'unsubscribe' in any marketing email, or by contacting us at info@peakyblinders.london.
Rights in Relation to Automated Decision-Making: We do not carry out solely automated decision-making, including profiling, that produces legal or similarly significant effects on you. If this changes, we will update this policy and notify you.
To exercise any of the above rights, please contact us at info@peakyblinders.london. We may need to verify your identity before processing your request. There is generally no fee for exercising your rights, although we may charge a reasonable fee or decline clearly unfounded or excessive requests.
Right to Lodge a Complaint: If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns before you approach the ICO.
12. Marketing Communications and Opt-Out
You may unsubscribe from our marketing communications at any time by:
- Clicking the 'unsubscribe' link in any marketing email we send you; or
- Contacting us at info@peakyblinders.london.
We will action all unsubscribe requests within 10 business days. Please note that if you have also provided consent to a third-party Controller (e.g. Banijay Rights), you will need to withdraw that consent directly with that party.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The date at the top of this policy indicates when it was last revised. We will notify you of material changes by email where we hold your contact details, or by a prominent notice on our website.
14. How to Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:
PB London Experience Limited
Northburgh House, 10 Northburgh Street, London, England, EC1V 0AT
Email: info@peakyblinders.london
Data Protection Officer: info@peakyblinders.london