Privacy and Cookie Policy

Last updated: 4th Jun 2026

This Privacy Notice for Chai Wu ('we', 'us', or 'our'), describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

Visit our website at chaiwu.co.uk or any website of ours that links to this Privacy Notice
Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@chaiwu.co.uk.

External Websites: This Privacy Notice does not apply to the websites of external parties to which the Platform links. We do not endorse and are not responsible for the content of such websites, their policies or practices, or any product or service that they offer. Any activity you perform on such external websites will be subject to the privacy policies and other terms and conditions expressed therein. We recommend that you review external website terms before providing any personal information to them.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? Some of the information may be considered 'special' or 'sensitive' in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, religious beliefs, and allergen data.

Do we collect any information from third parties? We may sometimes collect information about you from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties.

How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

You may provide us information directly when you use the Platform, such as:

Contact information, such as your name, email address, phone number, and mailing address.
Demographic information, such as date of birth and gender.
Purchase information, such as event information, number of tickets purchased, transaction amount, venue name, event date, artist, billing address.
Payment information for purchases made through the Platform, which we transmit securely to our payment processor. After transmission, we store only the last 4 digits of the card used to make the purchase.
Reservation Notes, such as seating preferences, food and beverage preferences, and allergy information that you provide us, whether you showed up for your reservation, venue, reservation date and time, party size, amount spent.
Venue Admissions, such as records regarding when a ticket, wristband, VIP bar card, party pass, pre-paid table, or reservation is fulfilled at a particular venue.
Identity or Audio or Visual Information, including scans of government-issued identification documents (where required), CCTV footage, and audio recordings of customer service interactions.
Referral source information, if you were referred to us by someone.
Correspondence between you and us and records of such correspondence, such as the contents of emails you send us.
Music Preferences, such as musical artists and genres that you have expressed an interest in.
Rewards Program information, such as what rewards you redeem and preferences regarding our various venues.
Marketing preferences, such as requests to opt out of marketing phone calls or emails.

CCTV and Security Monitoring

To help maintain the safety and security of our customers, staff, visitors, and premises, we operate CCTV and other security monitoring systems at certain locations.

CCTV footage may capture images of individuals visiting or entering our venues. We use this information for purposes including:

Crime prevention and detection;
Protecting the safety and security of customers, staff, and visitors;
Investigating incidents, complaints, or suspected unlawful activity;
Protecting our property and assets; and
Complying with legal or regulatory obligations.

Access to CCTV footage is restricted to authorised personnel and, where necessary, may be shared with law enforcement agencies, insurers, legal advisers, or regulatory authorities.

CCTV recordings are retained only for as long as reasonably necessary for the purposes described above, unless a longer retention period is required in connection with an investigation, legal claim, or regulatory requirement.

We implement appropriate technical and organisational measures to protect CCTV footage against unauthorised access, disclosure, alteration, or destruction.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We may automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information.

This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called 'crash dumps'), and hardware settings).
Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.

2. HOW DO WE PROCESS YOUR INFORMATION?

We may use the information we collect for the following purposes:

To provide and operate the Platform;
To fulfill your reservations, orders and purchases;
To send you information about your relationship or transactions with us;
To respond to your inquiries and send information that we believe is of interest to you, including via email, and (with your consent) phone and text message;
To market the Services to you, including, but not limited to, discounts, events, shows, news about our Services, other services, and/or special offers;
For internal research and reporting and data analytics;
To improve the content and features of the Services and/or develop new Services;
To allow us and our advertising partners to personalize the content and advertising that you see on the Platform and on third-party platforms;
To comply with applicable laws, including laws pertaining age restrictions at our venues;
To protect the safety of others and maintain security at our venues and with respect to our Services;
To enforce the legal or contractual terms that govern your use of the Platform or defend our legal rights; and
To administer and troubleshoot the Platform.

We may also combine information that we collect from you with information we obtain about you from third parties.

We may aggregate and/or de-identify any information collected through the Platform. We may use de-identified and/or aggregated data for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any third parties, including without limitation, advertisers, promotional partners, sponsors, event promoters, and/or others.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

Consent. We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.
Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
Legitimate Interests. We may process your personal information where it is reasonably necessary for our legitimate business interests and those interests are not overridden by your interests, fundamental rights, or freedoms. These interests may include operating and improving our Services, maintaining the security of our venues and systems, preventing fraud, responding to customer enquiries, conducting analytics, and protecting our legal rights.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e. express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e. implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
For investigations and fraud detection and prevention
For business transactions provided certain conditions are met
If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
For identifying injured, ill, or deceased persons and communicating with next of kin
If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
If the collection is solely for journalistic, artistic, or literary purposes
If the information is publicly available and is specified by the regulations

We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

4. WHEN AND WITH WHOM DO WE DISCLOSE PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
When we use Google Maps Platform APIs. We may share your information with certain Google Maps Platform APIs (e.g. Google Maps API, Places API). Google Maps uses GPS, Wi-Fi, and cell towers to estimate your location. GPS is accurate to about 20 meters, while Wi-Fi and cell towers help improve accuracy when GPS signals are weak, like indoors. This data helps Google Maps provide directions, but it is not always perfectly precise.
Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honour this Privacy Notice. Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.

International Transfers of Personal Data

Some of the third-party service providers, affiliates, business partners, and technology platforms we use may process or store personal data outside the United Kingdom.

Where we transfer personal data outside the United Kingdom, we will ensure that appropriate safeguards are implemented in accordance with applicable data protection laws. These safeguards may include:

Transfers to countries that have been recognised as providing an adequate level of data protection by the UK Government;
The use of the UK International Data Transfer Agreement (IDTA) or other approved transfer mechanisms;
The use of contractual protections and security measures designed to safeguard personal data.

We take reasonable steps to ensure that any recipient of personal data outside the United Kingdom provides an appropriate level of protection and processes personal data in accordance with applicable data protection laws.

If you would like further information regarding international transfers of your personal data and the safeguards applied, please contact us using the details provided in this Privacy Notice.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather

information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

To the extent these online tracking technologies are deemed to be a 'sale'/'sharing' (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by submitting a request as described below under section 'DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?'

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

Google Analytics

We may share your information with Google Analytics to track and analyse the use of the Services. The Google Analytics Advertising Features that we may use include: Google Display Network Impressions Reporting, Remarketing with Google Analytics and Google Analytics Demographics and Interests Reporting. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. You can opt out of Google Analytics Advertising Features through Ads Settings and Ad Settings for mobile apps. Other opt out means include http://optout.networkadvertising.org/ and http://www.networkadvertising.org/mobile-choice. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only retain your Personal Data for so long as we reasonably need to use it for the purposes set out above “How we use your Personal Data and why.”, unless a longer retention period is required by law (for example for regulatory purposes).

The table below shows our standard retention practices:

Category of Personal Data	Retention period
Identity Data	Where you have not opted in to receive marketing communications from us or for your data to be held on our customer database, your Identity Data will be deleted after two (2) years from the date of your last visit.
Contact Data	Where you have not opted in to receive marketing communications from us or for your data to be held on our customer database, your Contact Data will be deleted after two (2) years from the date of your last visit.
Financial Data	We pass any Financial Data we receive from you immediately to our third party payment processors. We do not store any of your Financial Data.
Transactions Data	We store Transactions Data for a period of two (2) years from the date of your last visit.