Privacy notice
Last updated: 12 October 2026
This notice explains what personal information That Decade collects, why, who it's shared with, how long it's kept, and your rights. We collect only what we need to run your mystery or reply to you, and we never sell your data.
Who we are
That Decade is a trading name of Lyndon Mills, a sole trader based in the North East of England. We are the data controller for the information described here. To contact us about your data, use the enquiry page, message us on Instagram at @that.decade, or reply to any email from us.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Enquiries (by our form or Instagram message): your name, email or Instagram username, what you're interested in, and optionally your event date, guest numbers and message | To reply to you and, if you ask, to quote | Legitimate interests in replying to an enquiry you sent, and steps before a contract |
| Orders: your name, email, phone (if given), party date, guest numbers, setting and package | To write and deliver your mystery | Contract |
| Your guests' details: first names, how they know each other, a fact or in-joke, and topics to avoid | To write each guest into the story | Legitimate interests (writing the mystery you ordered). Please only share what your guests would be happy for us to use, and nothing sensitive such as health or beliefs. |
| Payment | To take payment | Contract. Payments are handled by our payment provider; we never see or store your full card number. |
| Event bookings: names, dietary needs, allergies and access needs | To run a hosted event safely | Contract, and your explicit consent for health-related details such as allergies |
| News of future events, if you tick the box | To tell you about future events | Consent, which you can withdraw at any time |
| Business records of sales | Tax and accounting | Legal obligation |
We count visits to this website with Cloudflare Web Analytics, which doesn't use cookies, doesn't store anything on your device and doesn't track you across other websites. We don't use advertising cookies or tracking pixels. See our cookie policy.
Who we share it with
Only the services we need to run the business. Each one handles your data on our instructions or under its own privacy terms:
- Jotform, which runs our order, enquiry and waiting-list forms. Jotform may store data outside the UK, under its own safeguards for international transfers.
- Our payment provider (Stripe or PayPal, through Jotform's checkout), which processes your payment.
- Instagram (Meta), if you message us there. Messages are handled under Instagram's own terms and privacy policy.
- Our email provider, where enquiries and orders arrive and from which we reply and send your mystery.
- Cloudflare, which hosts this website, protects it from attacks and provides cookie-free visitor statistics. Like any host, it processes technical data such as IP addresses to deliver pages securely.
- For hosted events only: the venue, chef or transport provider receive the minimum they need, such as names and dietary needs.
- Anyone we're legally required to share it with.
How long we keep it
- Enquiries that don't lead to a booking: up to 12 months.
- Your guests' details and the in-jokes you send us: deleted within 3 months of your party date. We keep the finished story itself, without your guests' personal details, to improve our templates.
- Dietary, allergy and access details for hosted events: deleted within one month of the event.
- Records of sales: six years, as required for tax.
- News emails: until you unsubscribe.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, or withdraw consent at any time. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Our services are for adults. You must be 18 or over to order or book, and all guests at our hosted events must be 18 or over.
Keeping it safe
We use reputable providers, keep accounts protected with strong passwords and two-step sign-in, and only keep data for as long as set out above. Please don't send card details or sensitive information through the enquiry form.
Changes
If we change this notice, we'll update the date at the top.