1. What’s a “Critter Chaos”?

Critter Chaos Ltd (Company Number 12224268) is an interactive street theatre company who specialise in bringing the cartoon world into daily life.

Through this policy, “we”, “us” and “our” refers to Critter Chaos Ltd.

2. What kind of deets are you keeping?

It takes a lot of planning to make sure our Critters can provide the best experience for your guests - I mean, have you ever tried wrangling 50 giant animals?!

We collect a variety of information to help make every event a success:

When you first enquire: Our web form will take your name, email address, event date and any details you wish to include in the event field.

We ask that you do not include sensitive information about specific guests’ accessibility or medical needs in your submissions, and instead focus on overall improvements (such as wheelchair access or the scheduling of SEN sessions). Specific guest needs can be discussed in person during the event.

This is to protect individuals’ dignity and privacy, and avoid the storage of special category data. We’ll delete any sensitive data we receive promptly upon being discovered, and let you know what we’ve done.

As we prepare to confirm your booking: We’ll take down a large amount of information that helps us make things run smoothly on the day, including personal information such as your name and contact details, the name and phone number of our on-site contact, venue safeguarding contact, your billing address (for invoicing) and the details of the organiser of the event (if it differs from yourself).

After the booking: We love to get feedback from our clients on how the event went for them, and have an optional tick box for if you're willing for us to include your feedback in our testimonials. We also keep internal feedback from our teams to record how each event went, which may include names of people involved in delivering or attending the event.

3. How did you know?!

Well, you told us! Most information we collect is gained directly from you either via our website enquiry form, over email, or via phone/video call or meetings during planning.

Clients may sometimes pass information about others involved in the event to us (such as their on-site contact) as part of our legitimate interests in running the event smoothly. They should be informed their details are being shared and pointed towards this privacy policy for further information.

4. Do I need to give you all of this?

I’m afraid, yes! Without your event and contact details, we wouldn’t be able to confirm availability, plan the booking or deliver your event. We don’t ask for anything we don’t need - and without the information we need, we won’t be able to process your enquiry or fulfil your booking.

Feedback, testimonials and staged photo-shoots with written consent are the only exceptions - those are always optional.

5. Why do you want it (and legally need it)?

This information is essential to help us carry out your event in the smoothest way possible. Purposes include:

Handling enquiries - a legitimate interest that involves responding effectively to enquiries and assessing our availability / travel.

Delivering a booked event - Performance of our contract formed when a booking is confirmed and signed.

Invoicing - Whilst the Critters don’t do taxes, sadly we still do. We must meet the legal obligations of HMRC regarding UK tax law and the keeping of financial records.

Event Feedback - Part of our legitimate interest in improving our services and keeping the Critters under control (with the same also applying to internal feedback).

Marketing testimonials - only relevant if you’ve given consent by ticking the relevant box on our feedback form. You can withdraw this consent at any time by contacting us.

Safeguarding - a recognised legitimate interest in safeguarding vulnerable individuals (Article 6(1)(ea) UK GDPR), alongside the Schedule 1 safeguarding condition where the information includes special category data.

Handling complaints - a legitimate interest in resolving issues and maintaining service quality.

6. Who are you telling?

Only those involved in delivering or promoting our work:

The performers booked for your specific event - who need relevant contact and access details to attend and deliver the performance.

Clients / Partner Organisations - Who may sometimes ask for delivery evidence such as photos of us out at events.

Where you raise a complaint, relevant details may be shared with the client or venue involved, where necessary to investigate it, and only the details needed - see our Complaints Procedure for how this works.

Social Media Platforms (Instagram / Facebook) - who we use to share photos of our work and promote our business.

Microsoft Teams - Who we use to conduct video calls with clients, and for internal communication to coordinate bookings and share event information within the company.

Where a client asks us to join a video call hosted on a different platform, the choice of platform and any data transfer involved is their responsibility. We don't record video calls; instead we take notes directly into our booking forms.

Webflow.io - who host our website and process enquiry form submissions.

PrivateEmail.com (provided by Namecheap) - who host our business emails.

Where we engage an accountant, they may access relevant financial information (such as invoices) for bookkeeping and tax purposes. Any accountant or accounting software we use is bound by their own confidentiality and data protection obligations.

We don’t sell your personal data, and we don’t share it for any third party’s own marketing purposes. Our studio is already enough of a barnyard as it is without data brokers getting involved!

7. Where are you keeping it all? Does my data need a passport or is it staycationing?

Whilst we keep the majority of information for our own records stored locally on an encrypted drive, some of our providers are based in the United States.

Webflow, who host our website and our web form/s, relies on the UK Extension to the EU-US Data Privacy Framework for this. You can verify their current certification at dataprivacyframework.gov.

Microsoft (Who operate Microsoft Teams) relies on the UK Extension to the EU-US Data Privacy Framework for any data transferred outside the UK.

For PrivateEmail.com (Namecheap), their published data protection documentation has not been updated to reflect the UK's current transfer framework. We've asked them to confirm in writing which safeguard currently applies, and will update this policy once we know. Contact us at Privacy@CritterChaos.co.uk with any questions in the meantime.

8. How long do you keep it for?

That depends on the type of information:

• Enquiries that don’t result in a booking are deleted 1 week after the proposed event start date.

• Printed event briefs are securely destroyed upon return from the event.

• Digital event briefs, booking confirmations and email correspondence are deleted 1 year after the event’s start date.

• Invoices are retained for 6 years from the end of the financial year they relate to, as required by HMRC.

• Feedback you have chosen to submit using our event feedback forms is kept on our records for as long as they serve the business needs in the improvement of our services (with review every 5 years), or until you request deletion.

• Internal event feedback is similarly kept for as long as it supports our marketing and service improvement needs (with review every 5 years), or until you request deletion (where personal data appears in the form). We may also choose to remove Personally Identifiable Information from form submissions.

• Likewise, testimonials submitted using our event feedback forms (where marketing use has been ticked) are kept for as long as they support our marketing and service improvement needs (with review every 5 years), or until you request deletion.

• Event information shared internally via Microsoft Teams is cleared within 1 week of the event's start date.

• Records of complaints, rights requests or safeguarding concerns/investigations are kept for 3 years, in case of dispute.

• For media content (such as marketing/portfolio images and event proof photos), see Section 13 for retention.

• Signed consent forms are kept for as long as the related content is in use.

9. Does a human make your decisions? I bet you’re just robots!

All human (and Critter) made over here! We don’t use automated decision-making, profiling, or squirrelomancy.

10. What can I do about it?

Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; request erasure (except where we’re legally required to retain it, such as invoices within their 6 year retention period); object to processing; restrict processing; withdraw consent; receive your data in a portable format. To exercise any of these, contact us via Privacy@CritterChaos.co.uk.

Where we rely on legitimate interests, you can object at any time. We'll stop unless we have compelling reasons to continue, and if the information is needed for your booking, we'll talk you through the options.

As part of your rights, if you believe we’ve mishandled your data, you can also submit a complaint to our team via Privacy@CritterChaos.co.uk (or by your contact method of choice), where we’ll acknowledge your submission within 30 days and respond to your complaint without undue delay. We'll keep you updated while we look into it, and let you know the outcome. If you’re not happy with how we handle your complaint, you can then complain to the Information Commission (ICO, ICO.org.uk).

We respond to all rights requests within one month (extendable by up to two months for complex requests).

11. Who has the super cool title of “Data Protection Officer”?

Redd really wanted it, but we had to remind him that we’re not required to appoint a Data Protection Officer under UK GDPR since we don’t carry out large-scale regular and systematic monitoring or process special category data on a large-scale as a core part of our business… and also he’s a squirrel and not eligible to become a Data Protection Officer.

He’s planning to start a petition to allow squirrels to be eligible.

12. How about the dibbuns?

We’re sometimes given drawings and gifts by kids at events (which we always treasure)! That said, we don’t record or retain any personal information related to these, and as an entertainment provider, we don’t otherwise collect personal data directly from children. Kids do sometimes appear in our event photos, and we handle those images as set out in Section 13.

13. Fabulous poses, darling

We love to take photos and videos of our characters out and about at events to help show the world what our Critters get up to.

We use this content for a variety of purposes, including:

Marketing and Promotion - Showing our work on our website, social media and to prospective clients for the legitimate interest of promoting our business

Evidence of Contract - Sometimes we (or a partner organisation) might want evidence the booked event was delivered as agreed, so we may take photos, on the legal basis of legitimate interest in the completion of our contracts.

Where we’ve been given signed media consent for specific individuals - Sometimes, some amazing people will help our Critters out by allowing us to do staged photo-shoots or videos. For these, we rely on written consent and only use those images for the purpose described in the consent given. You can withdraw this consent at any time, the same as for testimonials, and we'll stop using the image.

Our Critters are always our focus for media, but sometimes we may capture members of the public in the background of our shots. We review images before using them and where someone is clearly a focus of the shot rather than incidental, we will take extra care to crop/alter the content to hide their face or choose not to use the content at all unless we have explicit consent. Where a child is identifiable in a photo, we don't use it for marketing unless a parent or guardian has given consent.

If you’d like to withdraw consent given for a published photo, or have noticed yourself in a photo and would like to be removed / have the photo taken down, contact our team at Privacy@CritterChaos.co.uk and we’ll act on it promptly. Withdrawing consent does not affect anything we did with your image before you withdrew it.

Our Performers and any photographers we are working with are covered by a separate internal privacy policy.

Marketing and portfolio images are kept for as long as they continue to serve that purpose (with review every 5 years), or until you ask us to remove a specific one. Event proof photos are kept for no longer than 1 year or until you ask for removal (and will never be shared publicly).

14. Cookies

For information on the cookies our website uses, please visit CritterChaos.co.uk/legal/cookies.

15. Changes to this Policy

We’ll post any updates to this policy here, along with the date it was last revised.

16. Contact Us

If you have any questions about this policy or how we handle your data, please contact our team at Privacy@CritterChaos.co.uk

‍

‍

Critter Chaos Ltd

Last Updated: 23/09/2026

Next Review: 23/09/2027

‍