Privacy Notice

Last updated 20 October 2026

Who we are

MGH Consultants, trading as Revisita, is the data controller for the account and business information of attractions that subscribe, and for how we run the service. Each attraction is the controller for the member data it collects. We process that data on the attraction's behalf.

What we collect and why

• Account data (staff names, emails, login details): to create accounts and provide the service. The legal basis is contract.
• Business details (trading and legal names, company and VAT numbers, addresses, logo): to provide the service and for invoicing. The legal basis is contract and legal obligation.
• Member data entered by attractions (name, email, postal address, postcode, visits, vouchers): to run passes and perks for the attraction. The legal basis is contract, on the attraction's instructions.
• Usage and device data (IP address, browser, logs): for security, fraud prevention and improving the service. The legal basis is legitimate interests.
• Support messages: to help you. The legal basis is legitimate interests.

Who we share it with

We share data with hosting and infrastructure providers who process it for us, and with Paddle.com as Merchant of Record for sales, subscription management, payments, tax and invoicing. We may also share it with professional advisers such as lawyers and accountants, and with authorities where the law requires. We do not sell personal data.

International transfers

Some providers may process data outside the UK or EEA. Where they do, we rely on adequacy decisions or standard contractual clauses.

How long we keep it

We keep data for as long as your subscription is active, then for up to 30 days so you can export it. After that we delete or anonymise it, unless the law requires us to keep it longer, for example for invoices.

Your rights

Under UK GDPR you have the right to access, correct, erase, restrict, move or object to the processing of your data, and to withdraw consent. You can also complain to the Information Commissioner's Office. We reply to requests within one month. Members should contact the attraction that holds their pass.

Security

We use encryption in transit, access controls and separation between attractions' data to protect personal information.

Cookies

We only use essential storage needed to keep you signed in. We don't use advertising cookies.