Privacy Policy
This Privacy Policy explains how we collect, use and store your personal data. Personal data is any information that could be used to identify you.
Who we are
ExFest is a small community collective overseen by Pete Whittard, who is the Data Controller for the purposes of the Data Protection Act 2018 and the UK General Data Protection Regulation (UKGDPR). We collect and use personal data relating to individuals as part of our activities. This includes data from individuals who take part in our events, volunteer, receive our circulars and those who work with us.
For further information on our privacy practices please contact us via our website www.exfest.uk.
What personal data or information do we collect?
Personal data that we collect could include but is not limited to name, email address, postal address, telephone number, payment details (if making a purchase or donation) and any information you provide in any communication between us.
We do not actively collect Special Category data. However, any sensitive personal data that is collected will be treated with extra care and confidentiality in accordance with this Privacy Policy.
We video our events and members of the press may be present at our events, so we may collect photographs or video footage for the purposes of promoting our events. Our event has clearly labelled posters warning you when this takes place. With your consent, we may also collect photographs and the names of individual performers for the purposes of promotion.
What are the lawful basis we rely on?
In some cases, we will only use your personal data where we have your consent or because we need to use it to fulfil a contract with you. For example, if you are a vendor.
We process your personal data for lawful reasons including legitimate interest. This means that the processing is in the legitimate interest of ExFest. Wherever we process your personal data under the legitimate interest basis we consider your rights and interests and will not process your data if we feel there has been an imbalance.
We may use legitimate interest to process your data for data analytics, conducting research to better understand our supporters, improving our services or for compliance with guidance.
Marketing
We will contact you about ExFest events to ensure you have the correct information to enjoy the event.
You can update your choices or stop us sending you these communications at any time by contacting us through the Contact Us section of our website at www.exfest.uk.
Who is your personal data or information shared with?
ExFest may share your information with our trusted partners, advisors and suppliers who work with us or on our behalf to deliver our services. This information is always processed under our instruction and stored securely. It is deleted when no longer needed and used for any other purpose. Examples of where we may share your information include our fulfilment partners who help create and send information to you and partners who manage our social media accounts.
We enter contracts with these service providers that require them to comply with Data Protection Laws and ensure appropriate controls are in place to secure your information.
We may disclose your information if required by law (for example, to comply with applicable laws, regulations and codes of practice or in response to a valid request from a competent authority) or to enforce our contract conditions and other agreements.
We do not sell or transfer your personal data or information for monetary compensation.
International transfers of personal data
ExFest does not process personal data outside the UK or EEA. If our trusted partners or third-party service providers transfer personal data outside the UK/EEA to a country that does not benefit from an adequacy decision by the EU, the third party is responsible for implementing appropriate safeguards to protect personal data.
The retention period for your personal data or information is limited to the reasonable and necessary duration for the relevant activity, which may include fulfilling statutory obligations.
We take the protection of your information very seriously. We have implemented appropriate physical, technical and organisational measures to safeguard the personal information we control both online and offline from unauthorised access, use, alteration, destruction and loss.
Our website may contain links to other sites. While we endeavour to link only to sites that share our high standards and respect for privacy, we are not responsible for the content or the privacy practices of other sites. Please be aware that websites that have links on our site may collect personally identifiable information about you. This privacy statement does not cover the information practices of those websites or advertisers.
Your Rights as a Data Subject
Depending on your location or the location of your personal data, you may have some or all of the following rights or choices regarding your personal data:
a) The right to be clearly informed about the processing of your personal data.
b) The right to access.
c) The right to rectification.
d) The right to erasure.
e) The right to restrict processing.
f) The right to object to processing.
g) The right to data portability.
h) The right to complain to a supervisory authority or regulatory agency of competent jurisdiction.
i) The right to withdraw consent.
j) The right to object to automated decision-making.
If we have collected and processed your personal data with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing conducted prior to your withdrawal nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.
We respond to all requests from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. If you wish to exercise the rights described above and are entitled to do so, we may request you to verify your identity. We will not charge to reply to your request but may charge a reasonable fee or refuse your request if it is excessive or where additional copies are requested.
We will verify your identity in connection with any of the above requests and take steps to ensure that only you or your authorised representative can exercise your rights with respect to your information. There may be situations where we are unable to grant or completely fulfil your request. If we are unable to grant your request, we will provide a written explanation to explain the rationale for our decision and action.
Although the right of access always applies in specific jurisdictions, there are some exemptions which may mean you do not always receive all the information we process.
If you wish to complain about how we have handled your personal data or information, your applicable law may require you to resolve the issue with the person you have been dealing with. If you are still not satisfied, contact us using the details set out in the ‘Contact us’ section at the bottom of this page. We will use the information detailed in your complaint to investigate and resolve the issue and to provide feedback to our staff or business areas. Your personal data may be stored and used to assist us to improve our services.
If we do not resolve your complaint to your satisfaction, you have the right to complain to the Information Commissioner (ICO) about our collection and use of your personal data or information. For more information, please contact the ICO. In the table below we have listed the contact details of the data protection authorities where we have branches:
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel.: 0303 123 1113
E-Mail: DPO@ico.org.uk
Website: https://ico.org.uk
The ExFest Privacy Policy may change, so please remember to check back from time to time. This version was created on May 27th 2026.