And Gather CIC

Privacy and Data Protection Policy

Last updated: 27 August 2026

About this policy

This Privacy Policy explains how And Gather CIC collects, uses, stores and protects your personal information when you:

  • visit our website;

  • join one of our mailing lists;

  • contact us;

  • book or attend an event, workshop or other activity;

  • complete a survey or feedback form; or

  • otherwise interact with us.

And Gather CIC is the data controller responsible for the personal information described in this policy.

And Gather CIC
Registered address: 15 St. Michaels Street, Folkestone, England, CT20 1LL
Email: andgathercic@gmail.com

We may update this policy from time to time. Any changes will be published on this page, together with a revised “last updated” date.

Information we may collect

Depending on how you interact with us, we may collect:

  • your name;

  • your email address, telephone number and postal address;

  • your town, city or postcode;

  • information about your interests and communication preferences;

  • booking, ticketing, payment and transaction information;

  • correspondence and enquiries you send to us;

  • feedback, survey responses and evaluation information;

  • information about events or activities you have attended;

  • accessibility, dietary or other support requirements you choose to provide;

  • photographs, video or audio recordings from our events, where appropriate;

  • technical information about how you use our website, such as your IP address, browser type, device information and pages visited; and

  • any other information you choose to provide.

Some information, including health, disability, ethnicity, religion or sexual orientation, is classed as special category data and receives additional protection under data-protection law. We will only collect or use this information where there is a clear reason to do so and where we have an appropriate legal basis and additional condition for processing it.

How we collect your information

We may collect information directly from you when you:

  • subscribe to a mailing list;

  • complete a website, booking or contact form;

  • buy or reserve a ticket;

  • contact us by email, telephone or social media;

  • attend or participate in an event;

  • complete a survey or provide feedback; or

  • give us permission to photograph, film or record you.

We may also receive information from organisations that provide services on our behalf, such as ticketing, payment, mailing-list, survey or event-registration platforms.

If an event is delivered in partnership with another organisation, we will explain where relevant whether information will be shared and which organisation is responsible for it.

How and why we use your information

We may use your personal information to:

  • respond to enquiries and communicate with you;

  • process bookings, registrations and payments;

  • deliver events, workshops and other activities;

  • provide appropriate access, dietary or participant support;

  • manage our relationships with audiences, artists, partners, suppliers and participants;

  • administer mailing lists and send information about our programme;

  • improve our events, services, communications and website;

  • undertake audience research, evaluation and reporting;

  • maintain financial, administrative and safeguarding records;

  • promote and document our activities through photography, film or audio;

  • prevent fraud, protect our systems and keep people safe; and

  • comply with legal, regulatory, contractual or funding requirements.

Our lawful bases

Under UK data-protection law, we must have a lawful basis for using personal information. Depending on the circumstances, we may rely on:

  • Consent: where you have actively agreed to something, such as receiving our email newsletter or participating in certain photography or research. You may withdraw your consent at any time.

  • Contract: where using your information is necessary to provide something you have booked or purchased, or to take steps at your request before entering into an agreement.

  • Legal obligation: where we need to retain or use information to comply with the law, including financial, tax, employment, safeguarding or regulatory obligations.

  • Legitimate interests: where using the information is reasonably necessary for the operation, administration, evaluation or promotion of And Gather CIC and does not override your rights and interests.

  • Vital interests: in exceptional circumstances where using information is necessary to protect someone’s life.

Where we process special category data, we will also identify an appropriate condition under Article 9 of the UK GDPR. This may include your explicit consent or another condition permitted by law.

Email marketing

We will normally send marketing emails to individuals only where they have actively agreed to receive them or where another lawful exception applies.

Our marketing emails may include information about And Gather CIC’s events, projects, opportunities and related activities. Every marketing email will provide a straightforward way to unsubscribe.

You can withdraw your consent or change your preferences at any time by:

  • using the unsubscribe or preference link in one of our emails; or

  • contacting andgathercic@gmail.com

Withdrawing consent will not affect the lawfulness of anything we did before you withdrew it.

We may retain a minimal suppression record after you unsubscribe so that we can respect your preference and avoid contacting you again inadvertently.

Our email service provider may use tracking technologies to record information such as whether a message was delivered or opened and whether links were clicked. We use this information to understand the effectiveness of our communications. Where required, these technologies will only be used with the appropriate consent.

Cookies and website analytics

Cookies and similar technologies are small files or identifiers stored on or accessed through your device. They can help a website function, remember preferences and provide information about how the website is used.

We may use:

  • strictly necessary cookies, which are essential for the website to operate;

  • functional cookies, which remember choices or preferences;

  • analytics cookies, which help us understand how people use our website; and

  • marketing or embedded-content cookies, which may be set by third-party services.

We will not place or access non-essential cookies unless you have given the required permission. You can accept, reject or manage non-essential cookies through our cookie controls. You can also change your browser settings, although blocking some cookies may affect how the website functions.

Further details about the cookies used on our website, their providers and how long they remain active should be available through our cookie settings.

Photography, filming and audio recording

We may photograph, film or record some events for documentation, evaluation, archive or promotional purposes.

Where images or recordings focus on identifiable individuals, we will identify an appropriate lawful basis and provide relevant information at the event. Where consent is required, you may decline or withdraw that consent.

At larger public events, we may rely on our legitimate interests to capture general or crowd imagery. We will provide notices where reasonably practicable and offer a way for attendees to raise concerns.

Additional consent will normally be sought before using identifiable images of children or young people.

Sharing your information

We may share relevant personal information with trusted organisations that help us operate, including:

  • website hosting and IT providers;

  • mailing-list and communications platforms;

  • ticketing, booking and payment providers;

  • survey and evaluation platforms;

  • venues, delivery partners and event contractors;

  • accountants, insurers and professional advisers;

  • funders or public bodies, usually in aggregated or anonymised form; and

  • regulators, law-enforcement bodies or other authorities where disclosure is required by law.

Service providers processing personal information on our behalf are required to protect it and use it only for the agreed purpose.

We will not sell your personal information. We will not share it with another organisation for that organisation’s own marketing unless you have given permission or another lawful basis clearly applies.

International transfers

Some of our service providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that it receives a level of protection consistent with UK data-protection law. These measures may include relying on UK adequacy regulations or approved contractual safeguards.

How long we keep information

We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, including any legal, accounting, insurance, safeguarding, contractual or funding requirements.

As a general guide:

  • mailing-list information is retained until you unsubscribe or the list is discontinued;

  • suppression records may be retained for as long as necessary to honour an opt-out;

  • routine enquiries and correspondence are normally retained for up to two years after the matter is concluded;

  • booking, contractual and financial records may normally be retained for up to seven years;

  • event participation, evaluation and access information is retained only for as long as necessary for delivery, reporting or safeguarding purposes; and

  • cookie and analytics information is retained according to the periods shown in our cookie settings or the relevant provider’s controls.

We may retain some material for longer where it has legitimate archival, historical or evidential value. Where possible, information retained for research, reporting or evaluation will be anonymised or aggregated.

Security

We take reasonable physical, electronic and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

Access to personal information is limited to people and service providers who need it for an authorised purpose. However, no system for transmitting or storing information can be guaranteed to be completely secure.

Links to other websites

Our website may contain links to websites operated by other organisations. Once you follow one of these links, the other organisation’s privacy policy will apply.

We are not responsible for the content, security or privacy practices of external websites. You should review their privacy information before providing personal information.

Children and young people

Where we collect information about children or young people, we will take account of their age and understanding and provide privacy information in an appropriate form.

Where required, we will obtain consent or authorisation from a parent, guardian, school or responsible organisation. We will not knowingly use children’s personal information for direct marketing without the appropriate legal basis and safeguards.

Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • be informed about how your personal information is used;

  • request access to the personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to erase your information;

  • ask us to restrict how your information is used;

  • object to certain uses of your information;

  • receive certain information in a portable format;

  • withdraw your consent at any time; and

  • challenge a decision made solely by automated means, where applicable.

These rights are not absolute and may not apply in every situation.

You have an absolute right to object to the use of your personal information for direct marketing. If you object, we will stop using it for that purpose.

To exercise any of your rights, contact:

Email: andgathercic@gmail.com

We may need to ask for information to confirm your identity. We will normally respond within one month, although the law allows additional time in certain circumstances.

Complaints

If you have concerns about how we use your personal information, please contact us first so that we can try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk