Last reviewed: 1 September 2026
Privacy and cookies
This notice explains how Cliff House Trust Limited collects, uses, shares and protects personal information through the website and its activities.
1. Who we are
Cliff House Trust Limited is the data controller for personal information used to operate Cliff House venue activity, events, Friends and community activity, member resources, newsletters and the Cliff House Trust 200 Club.
- Data controller
- Cliff House Trust Limited
- Company number
- 07752930
- Registered charity
- 1146359
- Registered office
- Cliff House, Cliff Road, Salcombe, Devon, TQ8 8JQ
- Privacy contact
- [email protected]
- Telephone
- 01548 844704
2. Information we collect and why
Depending on how you use the website or our services, we may collect your name, contact details, enquiry and booking information, event-ticket holder details, newsletter preferences, member account activity, authorised uploads, technical and security logs, and 200 Club application, payment-matching, ticket, draw and prize records. We also receive information you choose to give us in correspondence.
If a buyer or gift payer gives us another person’s details, they must have permission to do so. We use a ticket holder’s address only to deliver and administer their ticket unless they separately choose to receive marketing.
We usually obtain information directly from you. We may also receive it from a ticket buyer or gift payer, our payment provider or bank, authorised Cliff House staff and volunteers, website and security providers, or a public source where this is necessary and lawful.
| Purpose | Lawful basis |
|---|---|
| Answering venue, event and general enquiries and taking requested steps before a booking | Contract or steps requested before a contract; otherwise legitimate interests |
| Taking bookings, issuing tickets, delivering tickets and operating event check-in | Contract and legitimate interests |
| Operating member accounts and protecting restricted resources | Legitimate interests |
| Administering 200 Club applications, payments, tickets, draws, prizes, returns and audit records | Contract, steps requested before a contract and legal obligation |
| Preventing fraud, misuse and security incidents | Legitimate interests and, where applicable, legal obligation |
| Sending optional newsletters, fundraising, event or supporter marketing | Consent, with a minimal suppression record kept after withdrawal |
| Publishing authorised event, community or historical material | Legitimate interests, consent or another appropriate basis for the material |
| Establishing, exercising or defending legal claims | Legitimate interests and applicable legal obligations |
Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations. We do not sell personal information.
3. Marketing
We send optional newsletters and supporter, event or fundraising messages only where we have an appropriate permission or other lawful route. You may unsubscribe from a message or contact us at any time. Withdrawing marketing consent does not affect a booking, membership or 200 Club participation.
4. Who receives information
Access is limited to authorised Cliff House staff, trustees, volunteers and appointed officers who need the information for their role. We may use service providers acting on our instructions, including our WordPress hosting and infrastructure providers, Cloudflare, Google Workspace, our email relay, Simon Roberts Solutions, backup and security providers, professional advisers and payment providers. We may also disclose information to banks, regulators, licensing authorities or law-enforcement bodies where required or permitted by law.
We do not publish private 200 Club member, contact, payment or ticket-register information. Public draw results use ticket labels and public-safe totals.
5. International transfers
Some providers may store information, or permit authorised support access, outside the UK. Where this happens, we use an applicable adequacy regulation or appropriate contractual safeguards. You may contact us for more information about the safeguards relevant to your information.
6. How long we keep information
- 200 Club draw, ticket, payment reconciliation, return and audit records: at least three years after the relevant draw, or longer for an unresolved complaint, claim or regulatory enquiry.
- Unpaid or cancelled 200 Club applications: normally 12 months after cancellation or last meaningful contact.
- Prize and accounting records: normally six years after the end of the relevant accounting period.
- Venue and event enquiries that do not proceed: normally 24 months after last meaningful contact.
- Booking and event records: normally six years after completion where needed for contractual, tax or accounting records.
- Newsletter records: until consent is withdrawn or the service ends, with a minimal suppression record afterwards.
- Member accounts: while active and normally for 12 months afterwards, except where an audit or safeguarding record must be kept.
- Routine website security logs: normally 90 days, unless needed to investigate an incident or meet a legal obligation.
- Authorised community uploads: while relevant and authorised, subject to periodic review.
7. Your data protection rights
Depending on the circumstances and lawful basis, you may ask for access to your information, correction, erasure, restriction, objection or portability, and may withdraw consent at any time where we rely on consent. Some rights do not apply where information must be retained to meet lottery, accounting or other legal obligations.
To exercise a right, email us or write to the registered office. We may need to confirm your identity. If you are unhappy with our response, you may complain to the Information Commissioner’s Office. Make a complaint to the ICO.
8. Automated processing and children
The 200 Club system allocates an available ticket label after payment has been checked. Winners are selected electronically from the locked eligible paid-ticket list using the published draw process. Selection is not based on identity or personal characteristics, and authorised people oversee the draw and publication. This is not profiling or credit scoring.
The general website is not designed to collect information directly from children. Participation in the 200 Club is limited to people aged 16 or over. A gift payer must confirm that each intended recipient is aged 16 or over and that they have permission to provide their details.
10. Security, external links and changes
We use access controls, restricted administration, security services, backups and operational procedures intended to protect personal information. No online service can be guaranteed completely secure; please contact us promptly if you believe information has been exposed or misused.
Links to services operated by other organisations, including Google, Facebook and Instagram, are governed by those organisations’ privacy information. We review this notice regularly and will publish material changes here.