Introduction

This Privacy Notice describes Our policies and procedures on the collection, use and disclosure of your information when you use Our services and tells you about your privacy rights and how the law protects you.

Who We Are

Hospital Records Limited (“We”, “Us”, “Our” “The Company”) is the data controller for the personal data collected through this website.

Registered Office

Thomas Harris 1929 Shop Merton Abbey Mills, 18 Watermill Way, London, United Kingdom, SW19 2RD

Company Registration: 04503533 

ICO Registration Number: ZC204760

Contact Details: shop@hospitalrecords.com 

Definitions

For the purposes of this Privacy Notice:

Cookies are small files that are placed on your computer, mobile device or any other device by a website, containing the details of your browsing history on that website among its many uses

Country refers to the United Kingdom

Device means any device that can access Our services such as a computer, a mobile phone or a digital tablet

Personal Data is any information that relates to an identified or identifiable individual.

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit)

You means the individual accessing or using Our services, or the company, or other legal entity on behalf of which such individual is accessing or using Our services, as applicable

Types of Data Collected

Personal Data

While using Our services, We may ask you to provide Us with personal data that can be used to contact or identify you. Personal data collected and processed includes, but is not limited to: 

• Your contact information including:
• Name;
• Email address
• Phone number
• Postal address
• Your usage information including:
• Account details
• IP address
• Browser type
• Operating System
• Usage information
• Consent data
• Order and transaction details
• Other information such as:
• Age
• Gender/Sex
• Information provided when registering for marketing communications
• Any information provided through any communications with Us, including through surveys, competitions, chat forums, when making an enquiry or when submitting a complaint

In addition to this, photographs and video recordings may be taken during Our events for promotional, marketing and brand awareness purposes. Appropriate signage will be displayed at Our events where photography or filming is taking place. If you appear in published material and wish to request its removal where appropriate, please contact Us using the details provided in this Privacy Notice.

In some cases, providing Personal Data is necessary for Us to enter into or perform a contract with you, such as processing orders or responding to enquiries. Where you choose not to provide requested information, We may be unable to provide certain services or fulfil Our contractual obligations.

We do not routinely or intentionally collect any Special Category Data or information regarding criminal convictions or offences.

Sources of Personal Data

We may collect your Personal Data from the following sources:

• Directly from you when you contact Us, purchase tickets, consent to marketing communications or otherwise interact with Us
• Automatically when you use Our website
• From third parties acting on your behalf, such as ticketing providers, event partners, brand partners, or service providers
  
  

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

Reason for using personal data

Lawful Basis

To provide and maintain Our Service, including to monitor the usage of Our services:

Contractual Obligation (where necessary to deliver requested services) and Legitimate Interests (to ensure the ongoing operation and functionality of our platform).

To notify you about changes to Our service, such as legislative updates and new features:

Contractual Obligation (keeping you updated about services you use) or Legitimate Interests (informing users about service changes).

To allow you to participate in interactive features of Our service, including competitions and customer feedback:

Consent (where optional participation is required) or Performance of a Contract (where entry into a competition involves terms and conditions).

To provide customer care and support, so that we can assist you with queries or issues you may be experiencing:

Performance of a Contract (resolving order or service issues) and Legitimate Interests (providing good customer service).

To provide analysis or valuable information so that we can improve Our service, such as website streamlining or changes to accessibility:

Legitimate Interests (improving user experience, accessibility, and operational efficiency).

To detect, prevent and address technical issues, including website glitches and display problems:

Legitimate Interests (ensuring platform security, stability, and proper performance). Performance of a Contract (to ensure a smooth service is provided)

For the performance of a contract, including the development, compliance and undertaking of the purchase contract for Our services:

Performance of a Contract (fulfilling sales, purchases, ticket delivery, or agreements).

To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication regarding updates, security updates, or informative communications:

Performance of a Contract (essential transactional/service updates) or Legitimate Interests (security updates and essential administrative messaging).

To provide you with news, general information about other goods, services and events similar to those you have already used or enquired about:

Legitimate Interests (for existing customers under the 'soft opt-in' rule under PECR) or Consent (where explicit opt-in consent is required). Note: You can opt out at any time.

To analyse engagement with Our social media channels, improve Our marketing activities and, where permitted, provide more relevant advertising:

Consent (where non-essential cookies or ad-trackers are involved) and Legitimate Interests (analysing brand reach and effectiveness).

To manage your requests to Us, including complaints, availability queries and data rights requests:

Legal Obligation (responding to statutory data rights requests or legal compliance complaints) and Legitimate Interests (handling general customer queries effectively).

For other internal evaluation purposes, such as data analysis, identifying usage trends, and determining promotional effectiveness:

Legitimate Interests (developing business strategy and evaluating commercial performance).

To prevent, detect and investigate fraud, and any other unlawful activities:

Legal Obligation (complying with financial regulations and anti-fraud laws) and Legitimate Interests (safeguarding our platform, business, and customers from fraudulent activity).

Where We rely on Legitimate Interests as Our lawful basis, We have balanced Our interests against your rights and freedoms to ensure that Our processing is fair, necessary and proportionate.

Data Sharing

The company may process and share your personal data with the following recipients:

• Service providers who perform services on Our/your behalf
• E-commerce and payment platform providers, including Shopify, to facilitate online sales, payment processing, order fulfilment and customer account management
• Business partners, supplier and sub-contractors for business operations
• Members of Our group of companies
• Our insurers
• Our legal advisers
• Our IT and CRM providers
• Government, law enforcement agencies and other regulators e.g. the Police, Home Office, HMRC
• Any other organisations you ask Us to share your data with

Except as set out in this Privacy Notice or where required or permitted by law, We will not sell or otherwise disclose your personal information to third parties.

Disclosure of Your Personal Data

Law enforcement

Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a valid request made by a public authority such as a court or government agency
• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability
  
  

Transfer of Your Personal Data

Your information may be transferred to, and maintained on, computers located outside of the location in which it was collected, and the data protection laws in those locations may differ than those from your jurisdiction.

If data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions
• EU Standard Contractual Clauses
• The UK Addendum to the EU Standard Contractual Clauses, and
• Transfer Risk Assessments
• Any other relevant Data Protection Framework, such as the UK Extension to the EU-US DPF

The Company will take all steps reasonably necessary to ensure that your data is treated securely, and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place ensuring the security of your Personal Data.

Retention of Your Personal Data

The Company will retain your Personal Data for:

• Marketing Information: We retain this information until your consent is withdrawn.
• Account Information: We retain this information while your account is active and for a period of 6 years thereafter.
• Transaction Information: We retain this information for a period of 6 years.
• Fraud Information: We retain this information for a period of 6 years. 

We will retain and use your Personal Data to the extent necessary to comply with Our legal obligations. We may also use it to resolve disputes and enforce Our legal agreements and policies. Once the data is no longer required for any purpose, it will be securely disposed of or destroyed.

Security of Your Personal Data

All reasonable measures will be taken to ensure the security of your personal data. This includes, but is not limited to:

• Role Based Access Control
• Data Breach management procedures
• Staff training
• Data encryption

Although we will do Our best to protect your personal data, the transmission of information via the internet is never completely secure, and we cannot guarantee the security of your data transmitted to Our site; any transmission is at your own risk.

Children’s Data

Our services and events are not intended for individuals under the age of 18, and we do not knowingly collect personal data from children. If we become aware that personal data relating to a child has been collected without appropriate authority, we will take reasonable steps to delete that information.

Your Rights

The UK GDPR sets out the following key rights applicable to data subjects:

• the right of access: to request copies of your data which is held by the company
• the right to rectification: to request the company correct any inaccurate data it holds
• the right to erasure (also known as the ‘right to be forgotten’): to request the data held by the company is erased
• the right to restrict processing: to request that the company stops processing your data
• the right to data portability: to request that your data is provided to you or another entity
• the right to object: to provide your objection to the company’s processing of your data
• rights with respect to automated decision-making and profiling: to ensure that any automated decision making is carried out correctly and can be reviewed if required by a human alternative

We do not carry out solely automated decision-making or profiling that produces legal or similarly significant effects on individuals. If this changes, this Privacy Notice will be updated as appropriate.

You may withdraw your consent to receive marketing communications at any time by using the unsubscribe link included in Our emails or by contacting us using the details in this Privacy Notice.

Some of these rights may only be applicable under certain circumstances or have exceptions. To exercise any of your rights please contact Us via the email address above. Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Notice of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our website and store certain information to improve and analyse Our services. Further information an explanation of how you can opt out of certain types of cookies, please see Our Cookie Policy.

Complaints

If your complaint relates to the handling, sharing or processing of your personal data please contact Us in the first instance.  We would like the opportunity to investigate and put this right so please contact at shop@hospitalrecords.com in the first instance, and we will be more than happy to review your query. A copy of Our Data Complaints Procedure can be provided upon request.

If you are unhappy with the outcome of your complaint you may escalate this to the Information Commissioners Office who can be contacted at:

www.ico.org.uk/for-the-public/ 

The Information Commissioners Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 

0303 123 1113

www.ico.org.uk

casework@ico.org.uk

Changes to this Privacy Notice

This policy is reviewed at least annually and, following any significant changes to processing activity or following regulatory/legislative changes and may be updated. We will notify you of any changes by posting the new Privacy Notice on this page. You are advised to review this Privacy Notice periodically for any changes. Changes to this Privacy Notice are effective when they are posted on this page.

This Privacy Notice was last updated in July 2026.