Halo Experiences Privacy Policy

PRIVACY POLICY

WHO ARE WE?

We are Right Formula Ltd (registered number 06969725 and with registered offices at 5 Riverlight Quay, Nine Elms Lane, London, United Kingdom, SW11 8DX) (“Right Formula”, “we”, “us”, “our”).

Halo is our enterprise event management platform, made available via our website, web-based services and mobile applications (including iOS and Android) which provides a secure and centralised environment for guest logistics, ticketing and hospitality workflows (the “Platform”). When you register, access and use our Platform, we may collect certain information from which you are personally identifiable (referred to as personal data) depending on whether you are a client (or an employee of a client) of Right Formula (an “RF Client”) or you are a customer or a guest of an RF Client that accesses and uses our Platform (a “User”). This privacy policy aims to give you information on how Right Formula collects and processes that personal data as the Platform operator.

Right Formula shall be: (i) the data controller of your personal data in respect of operating the Platform and any log in credentials relating to a User or an RF Client; and (ii) a data processor of your personal data in connection with providing services to an RF Client (and in such circumstances, the RF Client would be the data controller). This privacy policy only relates to our activities as a data controller. For information, where the RF Client is the data controller, please refer to their relevant privacy policy.

Please read the following policy carefully to understand our views and practices regarding your personal data and how we will fulfil our commitment to protecting and respecting your privacy.

SCOPE OF THIS PRIVACY POLICY

This privacy policy applies to personal data collected when you access or use the Platform, whether via our website, web-based services or mobile applications. It also applies to any communications you have with us in connection with the Platform.

CHANGES TO OUR PRIVACY POLICY

Any changes we may make to our privacy policy in the future will be posted on our website and, where appropriate, notified to you by email. However, we advise that you check this page regularly to keep up to date with any necessary changes.

This privacy policy was last updated on 18th February 2026.

DATA THAT WE MAY COLLECT ABOUT YOU

You may provide to us, or we may collect from you, the following types of personal data when you interact with us through the Platform:

Profile: first name, surname, email address, contact number and address
Contact: your preferences for marketing, your contact history and feedback on your experiences (through reviews and surveys)

We may also collect the following types of personal data from you when you use the Platform. Please read the Cookies Notice section below carefully for more information.

Technical: this may include device IDs, IP address, browser or app type, operating system, app version, hardware type, network and software identifiers, system configuration, diagnostic data, crash logs, log files and similar technical information generated when you access or use the Platform via a web browser or mobile application.
Usage: visitor information e.g. time spent on page, click-throughs, download errors, browsing patterns

We also collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific Platform feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

The Platform is intended for use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services in connection with the Platform). In this case, we may have to cancel relevant services you have with us (including access to the Platform) but we will notify you if this is the case at the time. You don’t have to provide other data but if you don’t, you may not be able to use certain functions of the Platform and may not receive the optimal user experience.

WHY DO WE USE YOUR DATA AND WHAT ARE OUR LEGAL GROUNDS

The table below sets out how we use your personal data and our lawful basis for doing so in each case.

Why we use your data	What data we use	Why we’re allowed to use your data for these purposes
Registering your account as a User or RF Client	Profile	Perform our contract with you Our legitimate interests and those of the RF Client in providing the service
Providing you with products or services that you request	Profile	Perform our contract with you Our legitimate interests and those of the RF Client in providing the service
Notifying you of changes to our Privacy Policy or relevant terms of service, or changes to our services	Profile	Perform our contract with you Necessary to comply with a legal obligation
Internal administration and record keeping purposes	All	Perform our contract with you Necessary to comply with a legal obligation Our legitimate interests (for the effective operation of our business)
Verifying your identity and detecting fraud and security issues	Profile, Profile, Technical, Usage	Our legitimate interests (to prevent/detect fraud and criminal activity) or other unauthorised activities
Administering and protecting our company, our Platform and our services/products (including troubleshooting, data analysis, testing, maintenance and support)	Profile, Technical, Usage	Our legitimate interests (for the effective administration of our Platform and services/products) Necessary to comply with a legal obligation
Using data analytics to improve our Platform, services/products, marketing, user relationships and experiences	Profile, Technical, Usage	Our legitimate interests (to keep our Platform updated and relevant, to develop our organisation and to inform our marketing strategy)
Providing support, including answering your questions by email or phone or other support channels	All	Perform our contract with you Our legitimate interests (to ensure our customers are satisfied with our services and to provide customer support in respect of both RF Clients and Users)
Getting in touch with you about relevant Right Formula products and services	Profile, Contact	Our legitimate interests (to promote our services) Consent
Enabling you to feedback to Right Formula through reviews and surveys	Profile, Contact, Technical, Usage	Our legitimate interests (to develop our business, services and products)

DISCLOSURE OF YOUR INFORMATION

We may disclose your personal data to the following types of third parties:

a relevant RF Client;
service providers, employees or contractors that we have retained to perform services or work on our behalf;
our external consultants who assist with the development and delivery of our Platform;
analytics and search engine providers that assist us in the improvement and optimisation of our Platform and any related services or products;
companies who assist with our marketing, customer surveys and feedback tools;
third parties who help us detect fraud or criminal activity; and
our group companies, affiliates and licensees.

We may also need to disclose your personal data in the following circumstances:

if we are required to do so by law or pursuant to a binding regulatory request (in each case, such disclosure will be solely to the extent required by law or the applicable regulatory request);
in the event that we sell or buy any business or assets we may be required to disclose certain of your personal data to the prospective seller or buyer of such business or assets;
in order to enforce or apply our terms of use and other agreements; or
when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.

DO WE TRANSFER/HANDLE YOUR DATA OUTSIDE OF THE EEA?

Some of our external third parties are also based outside the UK / EEA so their processing of your personal data will involve a transfer of data outside the UK / EEA. Whenever we transfer your personal data out of the UK / EEA, we ensure a similar degree of protection is afforded to it by ensuring that appropriate safeguards are implemented.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK / EEA.

HOW DO WE KEEP YOUR DATA SECURE?

We have put in place appropriate security measures (including strict access controls, encryption and compliance measures) to protect against loss, misuse or unauthorised access, disclosure, alteration or destruction of your personal data. We also make sure that when we are required to share your information with third parties, they are subject to suitable confidentiality and security standards.

Despite the security measures that we implement, please be aware that the transmission of data via the internet is not completely secure. As such, we cannot guarantee that information transmitted to us via the internet will be completely secure and any transmission is at your own risk.

HOW LONG WILL WE KEEP YOUR DATA?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Please note that we also anonymise and aggregate personal data (so that it does not personally identify you) as necessary but, as this means the data is not personally identifiable, we are allowed to use such data for any purpose (e.g. testing our systems and carrying out customer research and analysis).

THIRD PARTY SITES

The Platform may provide links to other websites for your convenience and information, including those provided by RF Clients. These websites may operate independently from the Platform. We have no control over third parties’ or RF Clients’ policies or the terms of the relevant third party or RF Client website and we are not responsible for their content, maintenance or availability. You should therefore check their policy before continuing to access the website.

YOUR RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right to:

ask us for a copy of the personal data we hold about you;
correct or update your personal data;
request that we delete your personal data;
object to the handling of your personal data where we are relying on a legitimate interest (as set out in the above table);
restrict the processing of your personal data;
request the transfer of your personal data (or some of it) to a third party service provider; or
where you have provided your consent for something, in certain circumstances, you may withdraw this consent (but note that we may continue to use your personal data if we have legal grounds for doing so).

Please contact us using the details below if you would like to exercise your rights, which you can do for free. We may charge a reasonable fee in certain circumstances, including where your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. Otherwise, we will always respond within one month (unless there is a reason for us to take longer in which case we will inform you).

If it is not clear to us who is making the request, we may ask you to confirm your identity before we proceed.

You may also contact the ICO (Information Commissioner’s Office) if you have any concerns about the way we are handling your personal data. However, where possible, please speak to us first as we would appreciate the opportunity to help with your concern.

HOW TO OPT-OUT OF COMMUNICATIONS

If at any time you decide you would like us to remove you from our marketing emails or newsletters, or to unsubscribe from our database, you can contact us using the details provided at the bottom of this privacy policy. You must include your name, email address, and clear instructions regarding changes you are requesting. You may also unsubscribe from email newsletters by clicking on the “unsubscribe” link found at the bottom of the email.

HOW TO CONTACT US

If you wish to exercise any of your rights in relation to your personal data or if you have any queries about how we use your personal data, please let us know by contacting us at the following address: privacy@rightformula.com.

BROWSER-BASED LOCAL STORAGE TECHNOLOGIES

A cookie is a small file of letters and numbers that we store on your device or the hard drive of your computer if you agree. However, we do not use cookies on our Platform to store data relating to our users or to distinguish one user from another.

Instead, we use the browser-based local storage technology, IndexedDB, via Firebase to store certain information locally on the device you use to access our Platform. This enables us to provide a seamless and responsive user experience – e.g. to keep you logged in or to save your preferences. Data which is stored in IndexedDB will only be accessible via your browser and we will not share such data with third parties, unless required for the operation of the Platform or as described elsewhere in this privacy policy. No personal data will be stored in IndexedDB.

Our mobile applications do not use cookies. However, they may use local storage and software development kits (SDKs) to enable core features, improve performance and maintain security.

You may clear any data stored in IndexedDB at any time by clearing your browser’s site data for the Platform.