Skip to content
🎪 Carnival Day · Saturday 26 June 2027 📱 Get updates by text
Bewdley Carnival

Privacy Policy

How Bewdley Carnival collects, uses and protects your information, and your rights under UK GDPR.

Last updated 10 October 2026.

Bewdley Carnival is run entirely by volunteers. We take looking after your information seriously, and we only collect what we need to run the carnival. This policy explains what we collect, why, how long we keep it, who we share it with, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Bewdley Carnival (“we”, “us”) is the data controller for personal information collected through www.bewdleycarnival.co.uk and our carnival activities. For anything about your data — including using your rights below — email website@bewdleycarnival.co.uk or use our contact form.

What we collect, why, and our lawful basis

UK law requires a “lawful basis” for each use of your information. Ours are shown in brackets.

  • Contact form — your name, email, phone (optional) and message, so we can reply. (Legitimate interests: answering your enquiry.)
  • Email and text updates — your name (optional), email address and/or mobile number, and a record of when and how you agreed. We only send updates if you tick the box for each one; email and texts are separate choices. (Consent.)
  • Volunteering — if you tell us you’d like to help, the teams you ticked and your email, so a team lead can get in touch. (Consent.)
  • Marshals and on-the-day volunteers — name, contact details, availability, relevant experience and an emergency contact. (Legitimate interests: organising a safe event; the emergency contact is used only if you are hurt or unwell — vital interests.)
  • Procession entries — your group’s details, a contact name, email and phone, and the answers on the entry form. (Contract: taking part in the procession; legitimate interests: safety planning.)
  • Traders and stallholders — business and contact details, what you sell, pitch requirements, documents we ask for (such as insurance and food hygiene certificates) and payment records. (Contract; legal obligation for financial records; legitimate interests for safety and compliance checks.)
  • Sponsors and advertisers — business and contact details, logo, website, the package chosen, invoices and payments. With your agreement your business name and logo appear on our website and materials. (Contract; legal obligation for financial records.)
  • Raffle tickets — your name, email, phone (optional), tickets bought, payment reference and confirmation that you are 16 or over. We use these to issue tickets, run a fair draw, contact winners and keep the records lottery rules require. (Contract; legal obligation.)
  • Event tickets — your name, email, phone (optional), tickets bought and payment reference, to issue and check tickets. (Contract.)
  • Donations — the amount and payment confirmation. Card details are handled by our payment provider, never stored by us. (Contract; legal obligation for financial records.)
  • Applications and competitions (Carnival Royalty, Best-Dressed Window, Local Cause Ballot) — contact details and the answers on the form, to run the selection. Local causes that are selected are named on our website. (Legitimate interests; consent where we publish details.)
  • Photos — photos you upload, with your name and email, to show in our gallery. When uploading you confirm you have permission from anyone recognisable. We also take photos at the carnival, which may be published. (Consent for uploads; legitimate interests for event photography — ask us and we will remove a photo of you.)
  • Feedback and surveys — your answers, and your name and email only if you choose to give them. (Legitimate interests: improving the carnival.)
  • Committee and volunteer accounts — for people who log in to help run the carnival: name, email, role and sign-in security records (including two-factor authentication). (Legitimate interests: keeping our systems secure.)
  • Website security — like all websites, our server records technical information such as IP address and browser type to keep the site secure and stop abuse. (Legitimate interests.)

Children and young people

We do not knowingly collect information directly from children under 13. Carnival Royalty applications are made by a parent or guardian, who gives the young person’s details and agrees to them being used for the selection. Raffle tickets are only sold to people aged 16 or over. Photos of children taken at the carnival are only published with the agreement of a parent or guardian where the child is the main subject.

Email and text messages

We only send marketing emails or texts if you have opted in, and email and texts are separate choices. Every message includes a way to unsubscribe, or you can manage your preferences at any time. When you unsubscribe we keep your email or number on a “do not contact” list so we never message you again by mistake. Messages about something you have booked or applied for (such as tickets, entries or invoices) are sent whether or not you have opted in to updates.

Payments

Card payments are taken by our payment providers (Stripe, and for some raffle payments PayPal; card readers on the day use SumUp). We never see or store your full card details — we receive confirmation of the payment, its amount and a reference.

Who we share your information with

We never sell your information. We only share it with organisations that help us run the website and the carnival, under agreements that require them to protect it and only use it on our instructions:

  • Website hosting — ChrisXCreative, on UK-based servers.
  • Cloudflare — delivers and protects the website.
  • Google reCAPTCHA — checks forms are filled in by people, not spam bots.
  • Stripe, PayPal and SumUp — payment processing.
  • Seven67 — sends our text messages.
  • OpenStreetMap — map images on our maps (your browser loads them directly).
  • Committee members and team leads — only the information they need for their role (for example, the marshalling lead sees marshal sign-ups).
  • Authorities — only where the law requires it, such as the police, local council or emergency services.

Some of these providers may process information outside the UK (for example in the USA or EU). Where they do, it is protected by UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement.

How long we keep it

  • Email and text sign-ups — until you unsubscribe (then just your address or number on our “do not contact” list).
  • Contact form messages — up to 2 years.
  • Applications, entries and volunteer sign-ups — for the carnival they relate to and the following year, so we can invite you back; emergency contacts are deleted after the carnival.
  • Payments, invoices, raffle and financial records — 6 years, as required for accounts and lottery records.
  • Photos — until you ask us to remove them.
  • Website security logs — up to 12 months.

Cookies

We use a small number of cookies that are needed for the website to work (for example, keeping committee members signed in and remembering your cookie choice). We only use any other cookies, such as analytics, if you agree to them in our cookie banner. You can change your mind at any time using “Manage cookie preferences” at the bottom of every page.

Keeping your information safe

Our website uses encrypted connections (HTTPS) and is hosted on UK servers. Only committee members and volunteers who need it can see your information, each with their own account protected by two-factor authentication, and access is limited to the parts they need for their role.

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the information we hold about you;
  • ask us to correct anything that is wrong or incomplete;
  • ask us to delete your information;
  • ask us to restrict or stop using your information, or object to how we use it;
  • ask for your information in a format you can take elsewhere;
  • withdraw your consent at any time, where we rely on consent (this doesn’t affect anything we did before).

To use any of these rights, email website@bewdleycarnival.co.uk. It’s free, and we will reply within one month. We may ask you to confirm your identity first.

Complaints

If you are unhappy with how we have handled your information, please tell us first at website@bewdleycarnival.co.uk and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

We review this policy each year and whenever we change how we use information. The date at the top shows when it was last updated.