Data Protection & Privacy policy

1. Our commitment

We respect the privacy of the people whose personal information we hold and use.

We are committed to handling personal information lawfully, fairly, securely and transparently, in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what personal information we may collect, why we collect it, how we use and protect it, and the rights people have in relation to their information.

We aim to collect only information that we genuinely need and to keep it only for as long as necessary.

2. Who is responsible for your information?

We are responsible for deciding how and why personal information is collected and used.
The person responsible for data protection within the organisation is: Diane Moore

If you have a question about how your information is handled, please contact us using the contact details provided on our website.
 
3. What information may we collect?

Depending on how someone interacts with us, we may collect information such as:

- Name
- Postal address
- Email address
- Telephone number
- Payment and booking information
- Information provided when registering for an event or activity
- Information needed to organise travel, accommodation or other services.
- Correspondence and enquiries
- Photographs or other material where appropriate permission has been obtained
- Information provided by writers, contributors, volunteers or participants
- Information necessary to deal with an emergency or specific accessibility or welfare requirement

We do not routinely collect information that we do not need.

Where particularly sensitive information is required for a legitimate reason, we will handle it with additional care and only where an appropriate legal basis and condition for processing apply.

4. Why do we use personal information?

We may use personal information to:

- Respond to enquiries
- Manage memberships, registrations and bookings
- Provide events, activities and services
- Organise Crone Fest and related travel or accommodation arrangements

- Communicate with customers, participants, suppliers and contributors
- Process payments and maintain financial records
- Meet legal, accounting, insurance or regulatory requirements
- Manage health, safety and emergencies where necessary
- Send newsletters or marketing communications where permitted
- Improve our services and understand how people use them
- Protect the organisation, its participants and other people from fraud, misuse or other risks

We will not use personal information for purposes that are incompatible with the reason it was originally collected without considering whether further information or permission is required.

5. Our lawful basis for using information

Depending on the circumstances, we may rely on one or more of the lawful bases permitted under UK GDPR, including:
- Contract – where information is necessary to provide a service or fulfil an agreement.
- Legal obligation – where we are required by law to keep or provide information.
- Legitimate interests – where using information is necessary for a genuine business or organisational purpose and does not unfairly override an individual's rights.
- Consent – where we ask for permission to use information for a particular purpose.

Different information may therefore be processed under different lawful bases.

6. Who might we share information with?

We do not sell personal information.

Where necessary to provide our services or operate the organisation, we may share relevant information with trusted third parties such as:
- Accommodation providers
- Transport providers
- Event or activity suppliers
- Payment providers
- Booking or event-management platforms
- Website, email or technology providers
- Professional advisers, insurers or legal representatives
- Emergency services or other authorities where necessary or legally required

We only share information that is reasonably necessary for the particular purpose.

Where appropriate, suppliers and service providers will be expected to handle personal information securely and in accordance with their own legal obligations.

7. Keeping information secure

We take reasonable steps to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

This includes appropriate use of:
- Password protection
- Secure digital storage
- Physical filing systems
- Access controls
- Secure disposal of information when it is no longer required
- Care when sending personal information by email or other electronic means

Paper records containing personal information are stored securely and are not left accessible to people who have no legitimate reason to see them.

8. How long do we keep information?

We do not keep personal information indefinitely.

Information will be retained for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, insurance, contractual and organisational requirements.

Different types of information may therefore be kept for different periods.

We periodically review information held and securely delete, destroy or dispose of information that is no longer required.

9. Your rights

Depending on the circumstances, individuals have rights under data protection law, including the right to:

- Ask what personal information we hold about them
- Request a copy of their information
- Ask us to correct inaccurate information
- Ask us to delete information where there is no lawful reason for us to continue holding it
- Ask us to restrict certain processing
- Object to certain uses of their information
- Withdraw consent where consent is the lawful basis for processing
- Complain to the Information Commissioner's Office (ICO)

Some rights are subject to legal exceptions or conditions.

Requests relating to personal information should be made to the organisation using the contact details published on our website.

10. Photographs and publicity

Photographs or other images of participants may sometimes be taken at events or activities.

Where an image is intended for publicity, promotional material or publication and specific permission is required, we will seek that permission appropriately.

We will not assume that permission to attend an event automatically gives us unrestricted permission to use someone's image for publicity.
 
11. Marketing and communications

We may contact people about activities, events, services or news where we have a lawful basis to do so.

Where consent is required for marketing communications, we will obtain it appropriately.

People can unsubscribe from marketing communications at any time.

12. Personal data breaches

A personal data breach could include information being accidentally sent to the wrong person, a device being lost or stolen, information being accessed without permission, or records being accidentally destroyed.

If we become aware of a suspected breach, we will:

- Take immediate steps to contain and secure the information.
- Establish what happened and what information may be affected.
- Assess the potential risk to the people concerned.
- Record the incident and the action taken.
- Report the breach to the ICO where legally required.
- Inform affected individuals where legally required or where doing so is appropriate to protect them.
- Take reasonable steps to prevent a similar incident happening again.

Where a breach is reportable to the ICO, the relevant time limit is generally 72 hours from becoming aware of it.

13. Responsibility and records

Crone Fest Ltd recognises that data protection is an ongoing responsibility.

We will maintain appropriate records and procedures to demonstrate how personal information is handled and protected.

Our records may include:
- Information about the types of personal information we hold
- Where information is stored
- Why it is collected and used
- Relevant suppliers or processors
- Retention arrangements
- Data protection incidents
- Requests made by individuals concerning their information

14. Review of this policy

This policy will be reviewed at least annually and whenever there is a significant change to the way we collect, use or store personal information.

Plain-English commitment
We will collect only the information we reasonably need, use it for legitimate and clearly explained purposes, keep it secure, and dispose of it when it is no longer needed.

We will treat people's personal information with the same care and respect that we would expect for our own.

End of Policy
 
Effective date: October 2026
Review date: October 2027