Privacy notice

The information we collect

Depending on how you use the service, we may collect:

• identity and contact details, such as your name and email address
• booking details, including your ticket type, amount paid, order references, payment status, refunds and complimentary or test access
• account and access details, such as your verified email address, viewing entitlement, sign-in events and active viewing sessions
• service communications, including ticket emails, sign-in emails, delivery status and essential event updates
• support information, including messages you send, the nature of your request and any information needed to resolve it
• technical and security information, such as browser or device details, approximate location derived from an IP address, timestamps, request identifiers and privacy-preserving security fingerprints
• livestream activity needed to authorise playback, prevent access-code misuse and manage concurrent viewing

Payment card details are entered into Stripe's secure payment service. This website receives payment status and transaction references, but does not store your full card number or card security code.

Please do not include sensitive personal information in a support message unless it is necessary for us to help you.

How we receive information

We receive information directly from you when you buy a ticket, redeem an access code, sign in or ask for help. We also receive transaction, identity, email-delivery and playback updates from the providers that operate those parts of the service. Some technical information is collected automatically when your browser connects to the website.

Why we use it and our lawful bases

We only use personal information when data protection law allows us to. Our main purposes and lawful bases are:

• Contract: to take payment, confirm a booking, provide secure access, deliver the broadcast, provide support and deal with refunds or disputes
• Legal obligation: to keep records and comply with accounting, tax, charity, consumer-protection and other legal requirements
• Legitimate interests: to operate and improve the service, keep it secure, prevent fraud and access sharing, investigate faults, protect the Carnival and its viewers, and keep an appropriate audit trail
• Consent: where we specifically ask for permission for an optional use; consent can be withdrawn at any time

When we rely on legitimate interests, we consider whether the use is necessary and balance it against your privacy rights. We do not currently use ticket or account information from this service to send marketing emails.

Information needed to provide the service

We need a valid email address and the information required by Stripe to complete a paid booking. We also need to process sign-in and access information to protect the livestream. If this information is not provided, we may be unable to complete the purchase, deliver access or respond to a request.

Who we share information with

We use carefully selected providers to run the service. They receive only the information reasonably needed for their role:

• Stripe for secure checkout, payment processing, refunds and fraud prevention
• Clerk for password-free identity verification and sign-in
• Supabase for the event database, booking records, viewing entitlements and operational records
• Resend for ticket, access and service emails
• Mux for secure video streaming and playback delivery
• Vercel for website hosting, delivery, security and technical logs
• Chatbase for the event support assistant; technical information may be received when the assistant loads, and the content of a conversation is processed if you use it

We may also share information with professional advisers, insurers, payment partners, law-enforcement bodies, regulators or public authorities where this is reasonably necessary or required by law. We do not sell personal information.

International processing

Some service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we require an appropriate lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses, as applicable. Contact us if you would like more information about the safeguard used for a particular provider.

How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected. The period depends on the type of record and may extend beyond the event.

When deciding how long to keep a record, we consider legal and charity-accounting duties, payment and tax requirements, refund and chargeback periods, the time needed to answer complaints or legal claims, security needs, and whether an account or viewing entitlement remains active. Short-lived access, rate-limit and viewing-session records expire sooner. Information is deleted or anonymised when it is no longer required, subject to secure backup cycles.

Cookies and local storage

The website uses cookies and similar browser storage that are needed to provide secure review access, sign-in, checkout, access-code redemption, rate limiting and protected viewing. The colour-theme preference is stored on your device. Our identity, checkout and support providers may also use technical storage needed to provide their services.

We do not use this website for targeted advertising. If optional analytics, marketing cookies or another materially different use is introduced, this notice and the site's consent controls will be updated before that use begins.

Keeping information secure

We use role-based administration, verified sign-in, restricted provider access, encrypted connections, signed playback links, rate limiting, audit records and other proportionate safeguards. No online service can promise absolute security, but we review access and take reasonable steps to prevent loss, misuse or unauthorised disclosure.

Your data protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• ask for a copy of your personal information
• ask us to correct inaccurate or incomplete information
• ask us to delete information
• ask us to restrict how information is used
• receive information you provided in a portable format
• withdraw consent where processing relies on consent
• complain about how we have handled your information

These rights are not absolute. For example, we may need to keep transaction records to meet legal duties or establish and defend legal claims. We may ask for information to confirm your identity before acting on a request.

Your right to object

You have the right to object when we use personal information on the basis of legitimate interests. Tell us what you object to and why. We will stop that use unless we have compelling legitimate grounds to continue or need the information for legal claims. You have an absolute right to object to direct marketing; this service does not currently send direct marketing.

Automated decisions

We use automated checks to protect checkout, sign-in and livestream access. We do not use personal information to make solely automated decisions that have a legal or similarly significant effect on you.

Contact and complaints

To exercise a right, ask a privacy question or make a complaint, please describe what you need and include enough information for us to identify the relevant booking or account.

Email support@bridgwatercarnival.live

If you are unhappy with our response, you can complain to the Information Commissioner's Office or call 0303 123 1113. We would appreciate the chance to address your concern first.

Make a complaint to the Information Commissioner's Office

Changes to this notice

We may update this notice when the service, its providers or the law changes. The latest version will be published on this page with a new update date. We will draw attention to a significant change where it is reasonable to do so.