Privacy Policy

Last Updated: 15th October 2025

1. Introduction

Tiptree Christmas Street Festival CIC ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect and process the following types of personal information:

2.1 Stallholder and Vendor Information

When you register as a stallholder or vendor for our festival, we collect:

• Name and contact details (email address, phone number)
• Business name and trading information
• Bank account details (for payment processing via bank transfer)
• Any other information you provide in your registration application

2.2 Website Analytics

We use Google Analytics to collect information about how visitors use our website, including:

• IP addresses (anonymized)
• Browser type and version
• Pages visited and time spent on pages
• Referring website addresses
• Device information

2.3 Communications

When you contact us via email or social media (including Facebook Messenger), we collect the information you provide in your message.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: To fulfill our contract with stallholders and vendors for participation in the festival
• Legitimate interests: To organize and manage the festival, improve our services, and communicate with participants
• Consent: For the use of cookies and analytics on our website (which you can manage through your browser settings)

4. How We Use Your Information

We use your personal information for the following purposes:

• To process stallholder and vendor applications
• To organize and manage the Tiptree Christmas Street Festival
• To send transactional emails related to your application or participation (e.g., confirmation emails, event logistics, important updates)
• To process payments via bank transfer
• To respond to your enquiries and provide customer support
• To improve our website and services through analytics
• To comply with legal obligations

We do not send marketing emails or newsletters. All communications are strictly transactional and related to your participation in the festival.

5. Data Sharing and Third Parties

We do not share, sell, or disclose your personal data to third parties, except in the following limited circumstances:

• Legal obligations: Where required by law, regulation, or court order
• Service providers: Google Analytics processes anonymized website data on our behalf (see Section 7 for more details)

We do not share stallholder or vendor personal information with local councils, emergency services, insurance companies, or any other third parties for marketing or commercial purposes.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Stallholder/vendor information: We retain your data for 12 months following the festival event. After this period, your personal data will be securely deleted unless you participate in a subsequent festival.
• Financial records: Bank transfer records may be retained for up to 6 years to comply with accounting and tax requirements.
• Email communications: Transactional emails are retained for 12 months.
• Website analytics: Google Analytics data is automatically deleted after 26 months.

7. Cookies and Tracking Technologies

Our website uses cookies to improve your browsing experience and analyze website traffic.

7.1 What are Cookies?

Cookies are small text files placed on your device when you visit a website. They help websites remember your preferences and understand how you use the site.

7.2 Cookies We Use

Google Analytics: We use Google Analytics to understand how visitors interact with our website. This service uses cookies to collect anonymous information such as the number of visitors, pages viewed, and traffic sources. This data is aggregated and anonymized, meaning it cannot be used to identify individual users.

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored and delete them individually
• Block third-party cookies
• Block all cookies from specific websites
• Block all cookies from being set
• Delete all cookies when you close your browser

Please note that if you disable cookies, some features of our website may not function properly.

For more information about Google Analytics cookies, visit: https://policies.google.com/technologies/cookies

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you
• Right to rectification: You can ask us to correct inaccurate or incomplete data
• Right to erasure: You can request that we delete your personal data in certain circumstances
• Right to restrict processing: You can ask us to limit how we use your data
• Right to data portability: You can request a copy of your data in a commonly used format
• Right to object: You can object to our processing of your data in certain situations
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at hello@tiptreechristmasfestival.co.uk

9. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Secure storage of electronic data with access controls
• Encryption of sensitive information during transmission
• Regular review of our security practices
• Limited access to personal data on a need-to-know basis

10. Special Category Data

We do not collect or process any special category personal data (such as information about health, race, religion, or political opinions).

11. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

12. Social Media

We maintain a presence on social media platforms, including Facebook. When you interact with us on social media:

• We may communicate with you via Facebook Messenger to answer questions or provide information
• We do not collect or store your social media profile information
• Any information you share publicly on our social media pages is subject to the privacy policies of those platforms
• We do not use your social media interactions for marketing purposes

13. Photography and Videography

We do not take photographs or videos at our festival events. If you have any concerns about images taken by attendees, please contact us.

14. International Data Transfers

Your personal data is processed within the United Kingdom. Google Analytics may process data outside the UK/EEA, but Google provides appropriate safeguards as required by UK GDPR.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

16. How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

17. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection: