Skip to content
🎪 Carnival Day · Saturday 26 June 2027 📱 Get updates by text
Bewdley Carnival

Privacy Policy

How Bewdley Carnival collects, uses and protects your information, and your rights under UK GDPR.


Privacy Policy

Bewdley Carnival
Effective date: 21 October 2026

Bewdley Carnival (“we”, “us”, “our”) operates www.bewdleycarnival.co.uk. This Privacy Policy explains what personal data we collect, why and how we use it, who we may share it with, how long we retain it, and the rights you have over your information.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA), and the Privacy and Electronic Communications Regulations (PECR), as applicable.

1. Who We Are

Bewdley Carnival is a community carnival organisation. This policy applies to personal data processed in connection with our website, enquiries, volunteering, fundraising, sponsorship, events, raffle activities and related operations, where applicable.

Data Protection Officer: Chris Edwards
Email: website@bewdleycarnival.co.uk
Website: www.bewdleycarnival.co.uk

For questions about this policy, your personal data or a data protection complaint, please contact us using the email address above.

2. What Personal Data We Collect

The personal data we collect depends on how you interact with Bewdley Carnival. This may include:

  • Enquiries and contact forms: your name, email address, telephone number and the information you include in your message.
  • Volunteers and committee members: contact details, availability, assigned roles, relevant training information and communications needed to organise and support volunteering activities.
  • Fundraising and sponsorship: names, contact details, organisation details, correspondence, sponsorship commitments, donation information and records of fundraising support.
  • Raffle and ticket purchases: information needed to administer ticket sales, payments, entries, prize draws and prize delivery, which may include contact details and transaction records.
  • Payments and financial records: transaction amounts, dates, payment status and relevant accounting information. Payment providers may separately collect and process payment card or bank details.
  • Event participation: information supplied when registering for, volunteering at or participating in our events.
  • Photographs and video: images or recordings taken at carnival events or related activities, which may incidentally identify attendees, volunteers or other individuals.
  • Website and technical information: IP address, browser and device information, security logs and website usage information, where collected.
  • Cookies and similar technologies: information collected through cookies, analytics or embedded content, subject to our Cookie Policy and applicable consent requirements.
  • Correspondence: emails, messages and other communications sent to us or received by us in connection with our activities.

Please do not submit sensitive personal information unless it is genuinely necessary for the matter you are contacting us about.

3. Why We Use Personal Data and Our Lawful Bases

We use personal data only where we have an appropriate lawful basis under data protection law. Depending on the circumstances, these purposes and lawful bases may include:

  • Responding to enquiries and managing communications: our legitimate interests in operating the carnival and responding to people who contact us, or taking steps at your request where relevant.
  • Organising the carnival and related events: our legitimate interests in planning, coordinating and delivering community events and managing relationships with participants, volunteers and suppliers.
  • Managing volunteers and committee activities: our legitimate interests in coordinating volunteers, allocating responsibilities, communicating arrangements and ensuring activities are appropriately organised.
  • Managing sponsorship and fundraising: our legitimate interests in securing financial and other support, maintaining sponsor relationships and recording commitments and contributions.
  • Administering ticket sales and raffles: taking steps to fulfil arrangements with participants, complying with applicable legal obligations and pursuing our legitimate interests in administering fundraising activities.
  • Accounting and financial administration: complying with legal obligations and maintaining appropriate financial records.
  • Website security and administration: our legitimate interests in protecting our website, preventing abuse and maintaining the availability and security of our services.
  • Photographs and event publicity: our legitimate interests in documenting, promoting and reporting on carnival activities, where appropriate and balanced against individuals’ rights and reasonable expectations. Where consent is required or is the appropriate basis, we will seek it.
  • Marketing and updates: consent where required by PECR, or another lawful basis where permitted by law. You can opt out of marketing communications at any time.
  • Non-essential cookies and analytics: your consent where required by PECR and, where applicable, the UK GDPR.

Where we rely on legitimate interests, we consider the impact on individuals and their rights and freedoms. You may have the right to object to processing based on legitimate interests, as explained in section 9.

4. Who We Share Personal Data With

We may share personal data with trusted third parties where necessary for our activities, where you would reasonably expect us to do so, or where we are legally required to do so.

Depending on the services and activities involved, these recipients may include:

  • Website and hosting providers: to operate and maintain our website and related systems.
  • Email and communications providers: to send, receive and manage messages and notifications.
  • Payment processors and ticketing providers: to process payments, administer ticket purchases and support fundraising activities.
  • Raffle and prize providers: where necessary to administer a prize draw or arrange delivery or collection of a prize.
  • Event suppliers and service providers: where sharing information is necessary to organise or deliver an activity.
  • Professional advisers and insurers: where necessary for advice, insurance, risk management or claims handling.
  • Regulators, law enforcement and public authorities: where required or permitted by law.

We aim to share only the information necessary for the relevant purpose. Where a third party processes personal data on our behalf, we will use appropriate contractual and security arrangements where required.

We do not sell personal data.

5. International Transfers

Some service providers may store or process personal data outside the United Kingdom. Where a restricted international transfer applies, we will ensure that an appropriate transfer mechanism is in place, such as a UK adequacy regulation, an approved safeguard including the UK International Data Transfer Agreement (IDTA) or UK Addendum, or another lawful mechanism permitted under UK data protection law.

The arrangements depend on the provider and service involved. Further information about a particular transfer may be available from us on request, subject to applicable legal restrictions.

6. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including any applicable legal, accounting, reporting or record-keeping requirements.

Our approach includes the following:

  • General enquiries: retained for as long as necessary to respond and deal with the matter, with a reasonable period afterwards where needed for follow-up or record-keeping.
  • Volunteer and committee records: retained for the duration of the relevant role and for a reasonable period afterwards where needed for administration, safeguarding, safety or accountability.
  • Sponsorship and fundraising records: retained as needed to administer commitments, maintain relationships and account for funds received or pledged.
  • Ticketing, raffle and financial records: retained for the period required by applicable legal, accounting and regulatory obligations.
  • Website and security logs: retained for the period reasonably necessary for security, troubleshooting and website administration.
  • Cookie consent records: retained in accordance with the settings of our consent-management system and our documented retention requirements.
  • Photographs and publicity materials: retained for as long as reasonably necessary for event reporting, historical records and publicity, subject to the circumstances and any applicable rights.

Retention periods may be extended where necessary to establish, exercise or defend legal claims, investigate an incident or comply with a legal obligation. When information is no longer needed, we will take reasonable steps to delete it or securely dispose of it.

7. How We Protect Personal Data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.

These measures may include access controls, secure passwords, software updates, appropriate hosting security, restricted access to records and the careful handling of information shared with committee members, volunteers and service providers.

No website, electronic system or method of transmission is completely secure. If a personal data breach occurs, we will assess it and take appropriate action, including notifying the Information Commissioner’s Office and affected individuals where required by law.

8. Sharing Information About Children and Vulnerable Individuals

Some carnival activities may involve children or individuals who require additional consideration when handling their personal data. Where this applies, we will take particular care to ensure that information is collected and used appropriately, access is restricted where necessary, and any photographs, contact details or other information are handled in accordance with applicable law and relevant event arrangements.

Where consent is relied upon, we will consider who is legally able to provide it and whether any additional safeguards are appropriate. We will not knowingly collect more personal information than is reasonably necessary for the relevant activity.

9. Your Data Protection Rights

Under UK data protection law, you may have the right to:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: ask us to correct inaccurate or incomplete information.
  • Erasure: ask us to delete your personal data where the legal requirements are met.
  • Restriction: ask us to restrict how we use your personal data in certain circumstances.
  • Data portability: receive certain personal data in a structured, commonly used and machine-readable format, where the legal requirements are met.
  • Withdraw consent: withdraw consent where we rely on it as our lawful basis. This does not affect the lawfulness of processing carried out before withdrawal.

Right to object

You have the right to object to processing of your personal data where we rely on legitimate interests as our lawful basis. We will consider your objection in accordance with applicable law.

You have an absolute right to object to the use of your personal data for direct marketing. If you object to direct marketing, we will stop processing your personal data for that purpose.

To exercise your rights, contact our Data Protection Officer, Chris Edwards, at website@bewdleycarnival.co.uk.

We may need to verify your identity before responding. We normally respond to valid rights requests within one month. Where the law permits an extension, for example because a request is complex or multiple requests have been made, we will explain this to you within the applicable timeframe.

10. Cookies

Our website may use cookies and similar technologies to provide essential website functionality, remember preferences, measure website usage or display embedded content.

Where consent is required, non-essential cookies and similar technologies will only be used after the required consent has been obtained. You can manage your choices using the controls available on our website.

For further information about the cookies we use and how to control them, please see our Cookie Policy.

11. Data Protection Complaints

If you are unhappy or concerned about how Bewdley Carnival has handled your personal data, you can make a data protection complaint by emailing website@bewdleycarnival.co.uk, addressed to Chris Edwards, our designated Data Protection Officer.

We will acknowledge your complaint within 30 days of receiving it. We will investigate the complaint without undue delay, take appropriate steps to address the issues raised, keep you informed of progress where appropriate, and communicate the outcome without undue delay.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).

You can contact the ICO through ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our activities, website, technology or legal requirements.

The effective date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically to remain informed about how we handle personal data.

13. Contact Us

If you have any questions about this Privacy Policy, how we use your personal data, or your data protection rights, please contact:

Bewdley Carnival
For the attention of: Chris Edwards, Data Protection Officer
Email: website@bewdleycarnival.co.uk
Website: www.bewdleycarnival.co.uk