Privacy Policy

1. About This Policy

The Hidden Beach Organisation CIC ("Hidden Beach", "we", "us" or "our") respects your privacy and is committed to protecting personal information.

This Privacy Policy explains how we collect, use, store and share personal information when people interact with Hidden Beach, including through our website, events, markets, activities, applications, bookings, mailing lists and commercial relationships.

2. Who We Are

The organisation responsible for personal information covered by this policy is:

The Hidden Beach Organisation CIC

Privacy enquiries and requests can be sent to:

hello@hiddenbeach.uk

3. Who This Policy Applies To

We may process information about website visitors, event attendees, ticket purchasers, mailing-list subscribers, traders and stallholders, artists and performers, volunteers, contractors and suppliers, advertisers and sponsors, partner organisations, community groups, participants in activities, parents and carers, children participating in appropriate activities or bookings, and people who contact or correspond with us.

4. Information We May Collect

Depending on your relationship with Hidden Beach, we may collect information including:

• name;
• address;
• email address;
• telephone number;
• organisation or business name;
• job or organisational role;
• booking information;
• event attendance information;
• trader applications and trading requirements;
• products or services offered;
• volunteer applications and availability;
• artist and performer information;
• advertising and sponsorship enquiries;
• correspondence;
• invoices and payment records;
• transaction references;
• insurance and compliance documentation;
• photographs and video;
• marketing preferences;
• website and cookie information;
• information submitted through forms;
• records of complaints or enquiries;
• accessibility requirements where provided; and
• other information reasonably necessary to administer our activities.

We aim only to collect information that is relevant to the purpose for which it is required.

5. How We Collect Information

We may receive personal information directly from you, through our website, online forms, event and ticket bookings, trader applications, volunteer applications, advertising or sponsorship enquiries, mailing-list subscriptions, email or telephone correspondence, payment and ticketing providers, partner organisations where appropriate, our events and activities, and legitimate business and administrative processes.

6. Our In-House CRM

Hidden Beach operates an in-house customer and relationship management system ("CRM").

We may use our CRM to manage information relating to contacts, traders, bookings, enquiries, relationships, advertisers, sponsors, performers, volunteers, communications, opportunities, marketing activity and other legitimate organisational activities.

Keeping appropriate information together within our CRM helps us administer projects, communicate effectively and maintain accurate organisational records.

Access to CRM information should be limited to people who reasonably require it for their role.

7. Mailing Lists and Marketing

We use our in-house CRM to manage mailing lists and email campaigns.

We may send information about events, markets, cultural programmes, opportunities, trader opportunities, community activities, publications, fundraising or sponsorship where appropriate, and other Hidden Beach news.

We will use an appropriate lawful basis for electronic marketing and obtain consent where required.

Marketing communications should provide an appropriate way to unsubscribe.

If you unsubscribe, we may retain limited information necessary to record your preference and ensure that marketing is not restarted accidentally.

8. Event Tickets and Bookings

When you book an event or activity, we may process information required to administer the booking, issue tickets, take payment, communicate important event information, provide customer support, administer refunds, manage attendance and comply with legal, accounting or safety requirements.

Ticketing may be provided through third-party services such as Eventbrite.

Where you use a third-party ticketing service, that provider may also process your information under its own privacy arrangements.

9. Payments

Payments may be processed through services including:

• Stripe;
• PayPal;
• Eventbrite; and
• other payment or banking services where appropriate.

Payment providers may process personal and financial information independently under their own privacy policies.

Hidden Beach does not necessarily receive or retain complete payment-card details when payments are handled by a payment provider.

10. Accounting and Xero

Hidden Beach uses Xero for accounting and financial administration.

Relevant information about customers, traders, advertisers, sponsors, contractors and suppliers may be entered into Xero where necessary for invoices, payments, credit notes, financial records, reconciliation, accounting, tax and regulatory requirements.

Financial records may need to be retained for longer periods because of legal, tax and accounting obligations.

11. Traders

We may collect and process trader information including contact information, business details, products or services, requested trading dates, bookings, payments, insurance information, compliance documentation, food or safety information where relevant, correspondence and trading history.

We use this information to assess applications, administer markets, manage capacity, communicate with traders, administer payments and help operate events safely.

12. Volunteers

We may collect information from people interested in volunteering, including contact details, availability, interests, experience and information relevant to the role.

Where a volunteer role requires additional checks or information for safeguarding or safety reasons, we will only seek information that is reasonably appropriate to that role.

13. Artists and Performers

We may process information about artists and performers for purposes including enquiries, programming, contracting, event administration, publicity, payment, scheduling and future professional contact where appropriate.

14. Advertising and Sponsorship

We may retain contact, booking, correspondence, invoice and campaign information relating to advertisers and sponsors.

This information may be used to manage current arrangements and, where appropriate and lawful, relevant future commercial relationships.

15. Online Forms

Hidden Beach uses online forms for some applications, registrations, bookings and enquiries.

These may include third-party form services such as Tally.

Information submitted through a third-party service may also be processed by that provider according to its applicable privacy arrangements.

Information may subsequently be transferred into Hidden Beach's systems, including our in-house CRM, where appropriate.

16. Photographs and Video

Photography and filming may take place at Hidden Beach events and activities.

Images may be used for legitimate purposes including documenting events, our website, social media, publicity, reports, publications, funding applications, promotion of future events and organisational archives.

Where photography focuses on an identifiable individual rather than general event coverage, or where circumstances require additional consent, we will seek appropriate permission where required.

We will take particular care when using identifiable images of children and young people.

People with concerns about photography at an event should speak to a member of the event team or contact hello@hiddenbeach.uk.

17. Children

Some Hidden Beach activities may involve children, including family activities and experiences such as Santa's Grotto.

Where necessary, we may collect limited information about a child to administer an activity or booking.

Where appropriate, information should be provided by or with the involvement of a parent or carer.

We aim not to collect more information about children than reasonably necessary.

Children's information will be treated with particular care.

Safeguarding information will be handled in accordance with our Safeguarding Policy and applicable safeguarding responsibilities.

18. Special Category and Sensitive Information

Occasionally we may need information that is more sensitive, for example information relating to accessibility, health requirements or safeguarding.

We will only process such information where there is an appropriate reason and lawful basis for doing so.

Access should be restricted appropriately.

19. Why We Use Personal Information

We may process personal information to provide services, administer bookings, organise events, manage traders, manage volunteers, engage performers, communicate with people, process payments and refunds, issue invoices, manage advertising and sponsorship, respond to enquiries and complaints, promote our activities, manage mailing lists, maintain records, improve our services, protect people and property, meet safeguarding responsibilities, meet legal and regulatory requirements and operate Hidden Beach effectively.

20. Lawful Bases

UK data protection law requires an appropriate lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract – where processing is necessary to provide something you have booked, purchased or agreed with us.

Consent – where you have freely agreed to a particular use of your information and consent is the appropriate basis.

Legitimate interests – where processing is reasonably necessary for Hidden Beach's legitimate organisational interests or those of another person, provided those interests are not overridden by your rights and interests.

Legal obligation – where information must be processed to comply with law.

Vital interests – in limited circumstances where processing is necessary to protect someone's life.

Where special category information is processed, an additional lawful condition will be identified where required.

21. Sharing Personal Information

We do not sell personal information.

We may share information where reasonably necessary with organisations such as payment providers, ticketing providers, accounting providers, website and technology providers, form providers, email and communications infrastructure providers, event venues, contractors, professional advisers, insurers, funding or delivery partners where appropriate, local authorities, emergency services, safeguarding authorities, regulators or other bodies where legally required.

Only information reasonably necessary for the relevant purpose should be shared.

22. Safeguarding and Safety

Where information indicates that a child, young person, adult at risk or another person may be at risk of serious harm, information may be shared with appropriate people or authorities.

Protecting someone from harm may take priority over normal expectations of confidentiality.

Our Safeguarding Policy provides further information about our safeguarding arrangements.

23. How Long We Keep Information

We do not intend to keep personal information indefinitely without a reason.

Retention periods depend on the type of information and why it is held.

Financial and Accounting Records

Invoices, payments and other records required for accounting or taxation will normally be retained for the period required by applicable legal, accounting and tax obligations.

Customer and Booking Records

Routine booking and customer records will normally be retained only for as long as reasonably necessary for administration, accounting, dispute resolution and legitimate organisational purposes.

Trader Records

Trader booking and relationship information may be retained while a trader has an active or reasonably continuing relationship with Hidden Beach and for an appropriate period afterwards.

Financial records may be retained for longer where required.

Unsuccessful or Inactive Applications

Information from applications that do not lead to an ongoing relationship should normally be deleted or minimised after a reasonable period unless there is a legitimate reason to retain it.

Marketing Information

Marketing contact information may be retained while we have an appropriate lawful basis to communicate with the person.

Where somebody opts out, limited suppression information may be retained so that their preference can continue to be respected.

Volunteer Information

Volunteer records will normally be retained for the duration of the volunteering relationship and for a reasonable period afterwards where necessary for administration, references, insurance, safeguarding or dispute purposes.

Safeguarding and Serious Incident Records

Safeguarding and serious incident information may require different and sometimes substantially longer retention periods.

Retention will be determined according to the nature of the information, safeguarding requirements, applicable guidance, legal obligations and the interests of the people concerned.

Complaints

Complaint information will be retained for a reasonable period according to the seriousness and nature of the complaint and any continuing legal, safeguarding or organisational need.

We will periodically review information and delete, anonymise or minimise information that is no longer reasonably required.

24. Data Security

We take reasonable organisational and technical measures to protect personal information.

Measures may include access controls, secure accounts, authentication, appropriate permissions, secure technology providers, backups, staff awareness and limiting access according to operational need.

No internet or electronic storage system can be guaranteed to be completely secure, but we take reasonable steps appropriate to the information we hold.

25. International Data Transfers

Some technology providers may process information outside the United Kingdom.

Where Hidden Beach is responsible for an international transfer of personal information, appropriate safeguards will be used where required by data protection law.

26. Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you rights including:

• the right to be informed about how your information is used;
• the right to request access to your personal information;
• the right to request correction of inaccurate information;
• the right to request deletion in certain circumstances;
• the right to request restriction of processing in certain circumstances;
• the right to object to certain processing;
• the right to data portability in certain circumstances; and
• rights relating to certain automated decision-making.

These rights are not absolute and different rules may apply depending on the lawful basis and circumstances.

27. Making a Privacy Request

To make a request concerning your personal information, contact:

hello@hiddenbeach.uk

Please provide enough information for us to identify you and understand your request.

We may need to verify identity before providing personal information or making significant changes to a record.

We will respond within the period required by applicable data protection law.

28. Correcting Your Information

If you believe information we hold about you is incorrect or incomplete, please contact us so that we can investigate and, where appropriate, correct it.

29. Deleting Your Information

You may ask us to delete personal information.

The right to deletion is not absolute.

We may need to retain some information because of legal, accounting, contractual, safeguarding, insurance, dispute or other legitimate requirements.

Where information cannot be deleted, we will consider whether its use should instead be restricted.

30. Marketing Preferences

You can unsubscribe from marketing communications using the unsubscribe option provided in an email where available or by contacting:

hello@hiddenbeach.uk

Stopping marketing does not necessarily require us to delete information needed for bookings, transactions, accounting, safeguarding or other legitimate purposes.

31. Cookies and Website Information

Our website uses cookies and similar technologies.

More information about these technologies and how visitors can manage their preferences is available in our Cookie Policy.

32. Complaints About Data Protection

If you have concerns about how Hidden Beach has handled your personal information, please contact us first at:

hello@hiddenbeach.uk

We will aim to investigate and resolve legitimate concerns.

You also have the right to raise concerns with the UK's data protection regulator, the Information Commissioner's Office (ICO).

33. Changes to This Policy

We may update this Privacy Policy as our activities, technology, service providers or legal obligations change.

The current version will be made available through the Hidden Beach website.

34. Related Policies

This policy should be read alongside relevant Hidden Beach policies including:

• Cookie Policy;
• Safeguarding Policy;
• Equality, Diversity & Inclusion Policy;
• Complaints Policy;
• Refund & Cancellation Policy; and
• Health & Safety Policy.

35. Responsibility and Review

The Directors of The Hidden Beach Organisation CIC have overall responsibility for appropriate data protection governance within the organisation.

This policy will be reviewed periodically and updated where necessary.

Organisation: The Hidden Beach Organisation CIC Policy: Privacy Policy Privacy contact: hello@hiddenbeach.uk Effective: September 2026 Next review: September 2027