Privacy Policy

1. Data Controller Information

The data controller responsible for your personal information is:

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us when you:

• Contact Us: Your name, email address, phone number (if provided), and the content of your message when you submit enquiries through our contact form or email us directly.
• Subscribe to Communications: Your email address when you sign up for our newsletter or festival updates.
• Participate in Surveys or Promotions: Information you provide when participating in surveys, competitions, or promotional activities.
• Provide Feedback: Any reviews, comments, or feedback you submit about the festival.

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and usage, including:

• Device Information: Your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and language preferences.
• Usage Data: Pages visited, time and date of your visit, time spent on each page, click patterns, referring website addresses, and exit pages.
• Location Data: Approximate geographic location based on your IP address (country and city level only).
• Cookie Data: Information collected through cookies and similar tracking technologies (see our Cookie Policy for details).

2.3 Information We Do Not Collect

We want to be clear about what we do NOT collect:

• We do not collect sensitive personal data (racial or ethnic origin, political opinions, religious beliefs, health data, etc.)
• We do not collect payment or financial information (the festival is free to attend)
• We do not collect age verification data (as there are no age-restricted activities at our alcohol-free event)
• We do not collect biometric data

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Improve Our Services

• Respond to your enquiries and provide customer support
• Send you festival-related information and updates (with your consent)
• Improve our website functionality and user experience
• Analyse website traffic and usage patterns
• Ensure the security and integrity of our website

3.2 To Communicate With You

• Send administrative emails (e.g., changes to our policies)
• Send marketing communications about the festival (only with your explicit consent)
• Respond to your comments, questions, and requests

3.3 Legal Bases for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., marketing communications).
• Legitimate Interests: Where processing is necessary for our legitimate interests (e.g., improving our services, website analytics) and these are not overridden by your rights.
• Legal Obligation: Where we need to comply with a legal obligation.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

4.1 Service Providers

We may share your information with trusted third-party service providers who assist us in operating our website, conducting our business, or servicing you, including:

• Web hosting providers
• Email service providers
• Analytics providers (e.g., Google Analytics)

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction.

5. International Data Transfers

As we operate from the United Kingdom and promote events in Australia, your information may be transferred to and processed in countries outside your country of residence. When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Adequacy decisions where available
• Other legally approved transfer mechanisms

6. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including:

• Contact Enquiries: 2 years from the date of last communication
• Newsletter Subscriptions: Until you unsubscribe, plus 30 days
• Website Analytics Data: 26 months (Google Analytics default)
• Legal Compliance: As required by applicable laws

7. Your Rights

Under UK GDPR and other applicable data protection laws, you have the following rights:

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure: Request deletion of your personal information in certain circumstances.
• Right to Restrict Processing: Request limitation of processing of your personal information.
• Right to Data Portability: Request transfer of your personal information to another organisation.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at hello@bbqchristmasfest.com. We will respond to your request within one month.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data in transit
• Secure hosting infrastructure
• Regular security assessments
• Access controls and authentication
• Staff training on data protection

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

9. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information from our systems.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date at the top of this policy
• Sending an email notification (for significant changes, if you have subscribed to our communications)

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

11. Complaints

If you have concerns about how we handle your personal information, you have the right to lodge a complaint with:

• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Australia: Office of the Australian Information Commissioner (OAIC) - oaic.gov.au

We would appreciate the opportunity to address your concerns before you approach a supervisory authority, so please contact us first.

12. Contact Us