Privacy Policy

The GAP Festival
Last updated: March 2026

1. Who We Are

GORING AND STREATLEY FESTIVAL is a registered charity in England and Wales (charity number 1161360) and a company limited by guarantee registered in England and Wales (company number 08924999).

The charity operates under the name The GAP Festival, which is also the name of the community festival it organises and delivers, usually every two years.

For the purposes of data protection law, GORING AND STREATLEY FESTIVAL is the legal entity and data controller responsible for your personal data.

References in this policy to “The GAP Festival”, “we”, “us” or “our” mean GORING AND STREATLEY FESTIVAL.

2. What This Privacy Notice Covers

We are committed to protecting your personal data and respecting your privacy.

This privacy notice explains how we collect, use, store and protect your personal information when you:

visit our website
purchase tickets or make donations
sign up for festival updates or other festival communications
volunteer with the festival
contact us directly

This policy is provided in accordance with:

the UK General Data Protection Regulation (UK GDPR)
the Data Protection Act 2018

The festival operates in the United Kingdom and is primarily intended for UK residents. We do not specifically target or market to individuals outside the UK.

3. Data Protection

For the purposes of data protection law, GORING AND STREATLEY FESTIVAL is the data controller.

Responsibility for data protection matters sits with the festival committee.

If you have any questions about this privacy notice or your data protection rights, please contact:

Email: [email protected]
Website contact form: https://www.thegapfestival.org

4. Personal Data We Collect

We may collect and process the following types of personal data:

a) Website users

IP address
browser type
pages visited
usage data collected via Google Analytics, where analytics cookies have been accepted

b) Ticket purchasers (via TicketSource)

name
email address
ticket purchase details
transaction reference numbers

We do not receive or store full payment card details.

c) Mailing list information for festival communications

name (if provided)
email address

d) Volunteers

name
email address
telephone number
volunteering role preferences
emergency contact details for event safety purposes (if provided)
Image and/or voice (through photography and videography)

We do not currently collect DBS information, or safeguarding data for volunteers.

e) Donors and sponsors

name
organisation or business name
contact details
donation records

We do not collect unnecessary personal information and only collect data that is relevant for festival administration.

f) Festival attendees

image and voice (through photography and videography)

g) Competition or prize draw entrants

name
email address
telephone number (if provided)
age (if required for processing)

5. How We Use Your Information

We use personal data to:

administer and organise the festival
sell and manage tickets
communicate festival updates and event information
promote the festival and future festival events
manage volunteers
process donations and sponsorships
respond to enquiries
process competitions or prize draw entries
improve our website and services
to deliver festival events:
- limited attendee information may be shared with event managers or event leaders supporting specific activities on our behalf
- information shared is limited to what is necessary (for example, attendee names and, where required, email addresses for event-related communications only)
- event leaders are instructed to use this information only for the relevant event and to delete it once it is no longer required

6. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

Consent

festival update emails
event information and announcements
volunteer opportunities and requests for support
surveys and requests for feedback

You may withdraw consent at any time by contacting us.

Contract

ticket purchases
event administration
competition and prize administration

Legitimate Interests

running and promoting the festival
managing volunteers
responding to enquiries
photography and videography at festival events
maintaining basic records

Legal Obligation

accounting and financial record-keeping
charity governance requirements

7. Communications and Marketing

We send marketing and promotional emails only where:

you have actively opted in, or
you have expressed a preference to receive festival updates

All marketing emails include an unsubscribe option.

We also send non-marketing, operational emails where necessary for festival administration, event delivery, volunteering, or responding to enquiries. These emails do not include an unsubscribe option.

We do not sell or share mailing lists.

8. Data Retention

We retain personal data only for as long as necessary.

Unless a shorter period applies, data is retained for up to 7 years, in line with financial and charity record-keeping obligations.

Typical retention periods include:

ticket sales and donation records: 7 years
volunteer contact details: 7 years or until no longer required
festival communication mailing lists: until consent is withdrawn
website analytics data: up to 26 months
competition/prize draws: 7 years or until no longer required
photos/video: 7 years or until no longer required

Data is securely deleted or anonymised when no longer required.

9. Third-Party Data Processors

We use a limited number of trusted third-party services:

TicketSource

Used for ticket sales and event registration.
TicketSource acts as an independent data controller for ticket transactions.

Google Analytics

Used to understand how visitors use our website.
Analytics data is collected only where users have consented to analytics cookies and is used for statistical purposes only.

Mailchimp

Used to store contact details provided by individuals who have opted to receive festival updates and communications.
Used to send festival news, event information, and related communications on our behalf.
Mailchimp acts as a data processor and processes personal data in accordance with its own privacy policy.
Mailchimp may process personal data outside the United Kingdom. Appropriate safeguards are in place in accordance with UK data protection law.

We do not knowingly share personal data with any other third parties.

If additional providers are introduced in future, this privacy notice will be updated accordingly.

10. Cookies

Our website uses cookies to:

ensure the site functions correctly
analyse website usage through Google Analytics, where analytics cookies are accepted

Cookies may include:

strictly necessary cookies, including a cookie used to record cookie preferences
analytics/performance cookies, which are used only with user consent

When you first visit the website, you will be asked whether you wish to accept analytics cookies. You can manage or disable cookies through your browser settings.

11. Data Security

We take appropriate technical and organisational measures to protect personal data, including:

secure website hosting
password-protected systems
limited access to personal information
use of reputable third-party platforms

12. Your Data Protection Rights

Under UK GDPR, you have the right to:

access your personal data
request correction of inaccurate data
request erasure of your data
restrict processing
object to processing
withdraw consent at any time
lodge a complaint with the Information Commissioner’s Office (ICO)

You can contact us at any time to exercise these rights. We will normally respond to requests within one month.

13. Complaints

If you are unhappy with how your data has been handled, you may contact:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

We encourage you to contact us first so we can resolve any concerns.

14. Changes to This Policy

We may update this privacy policy from time to time.

The most recent version will always be published on our website with the updated date shown at the top.