Lysorion Limited, which operates 360 Dublin at 1 Central Plaza, Dame Street, Dublin 2, D02 K7K5 (“we”, “us”), is the data controller for personal data collected through this website and during visits to the attraction. This policy explains what we collect, why, and the rights you have. Last updated: 8 October 2026.
1. What We Collect
- Booking details: your name, email address, phone number and the tickets you buy. Payments are processed by our ticketing and payment partners; we never see or store your full card number.
- Form submissions: anything you send us through the contact, lost & found or report-an-issue forms.
- Marketing preferences: your email address if you sign up for news and offers.
- CCTV: cameras operate throughout the attraction for the safety of visitors and staff.
- Website usage: limited technical data as described in our Cookie Policy.
2. How We Use It
We use your data to fulfil your booking (contract), to respond to your enquiries and lost property reports (legitimate interest), to keep visitors and staff safe (legitimate interest), to meet our legal and accounting obligations, and, only where you’ve opted in, to send you marketing emails (consent). Every marketing email includes an unsubscribe link, and you can withdraw consent at any time.
3. Who We Share It With
We share data only where needed to run the attraction: with our ticketing and payment processing partners to handle your booking, with events partners when you book a private event, and with the IT providers who host our website and email. All of them act under contract and can’t use your data for their own purposes. We never sell your personal data. Where a provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place.
4. How Long We Keep It
- Booking records: 7 years, to meet accounting and tax obligations.
- Contact and issue-report submissions: 12 months after the enquiry is resolved.
- Lost & found reports: 6 months (unclaimed items are held for 30 days).
- CCTV footage: 30 days, unless needed for an incident investigation.
- Marketing lists: until you unsubscribe.
5. Your Rights
Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. To exercise any of these rights, use the contact form; we’ll respond within one month. If you’re unhappy with how we handle your data, you can complain to the Data Protection Commission (dataprotection.ie), Ireland’s supervisory authority.