Privacy policy

1. Who we are

Fitness Fest South West is run by Fitness Fest South West Ltd, a private limited company registered in England and Wales (company number 17374968), whose registered office is 45 Sycamore Avenue, Tavistock, England, PL19 9NL. In this policy, "we", "us" and "our" mean that company.

We are the controller of the personal data described here. That means we decide what is collected and why, and we are responsible for looking after it.

If you have a question about this policy or about your data, email us at hello@fitnessfestsw.co.uk, or write to us at our registered office.

2. What this policy covers

This policy covers personal data we collect through this website, through our email list, and when you contact us.

• Buying a ticket. Tickets are sold through TryBooking, not on this website. TryBooking takes your payment and handles your booking details for us. Before tickets go on sale, we will add to this policy how we use booking details. TryBooking also has its own privacy policy for data it uses for its own purposes.
• Other websites and social media. This policy does not cover other websites we link to, or our pages on social networks. Their own privacy policies apply.

3. What we collect, why, and our lawful basis

Joining our email list

When you sign up, we collect your first name, your email address, whether you ticked the box asking for extra news, the date and time you signed up, and which sign-up form you used.

We use this to email you when tickets go on sale. If you ticked the box, we also send you news about the festival, such as instructors, bands and traders. If you did not tick it, we will only email you about tickets going on sale.

Our lawful basis is your consent, which you give by submitting the form and, for the extra news, by ticking the box. The box is never ticked for you. We keep a record of when you signed up and what the form said, so we can show you agreed.

You don't have to give us your details, but we need your email address to email you. We ask for your first name so we can address you personally.

Our email service provider tells us whether the links in our emails are clicked, so we can remove people who no longer want them. We do not track whether you open our emails.

Contacting us

If you email or write to us, we use your name, contact details and whatever you tell us to reply and to deal with your enquiry. Our lawful basis is our legitimate interest in answering people who get in touch.

Using this website

• Hosting and security. Our hosting provider processes technical information, such as your IP address and browser type, to deliver the website to you and protect it from misuse. Lawful basis: our legitimate interest in running a secure website.
• Error monitoring. If a page or form fails, an error-monitoring service records technical details, such as the page address, your browser and device type and what went wrong, so we can fix it. It is set up not to collect your IP address or what you type into forms. Lawful basis: our legitimate interest in a website that works and is secure.
• Page-view and speed statistics. We use cookie-free tools that count page views and measure how quickly pages load. They record the page, the site you came from, your approximate location (country, region or city), your device, browser and operating system type, and your connection type (for example 4G). They do not keep your IP address or follow you across other websites. Lawful basis: our legitimate interest in understanding how the site is used so we can improve it. You can switch these statistics off at any time in "Cookie settings" at the bottom of every page. Choosing Reject on our cookie banner also switches them off.
• Session recordings and heatmaps (only if you choose Accept). We use Microsoft Clarity, which sets cookies and records how you use the site, such as clicks, scrolling and the pages you visit, so we can see where it is hard to use. Anything you type into our forms is hidden from these recordings. Microsoft receives this data as a separate controller and, under its own terms, may also use it for its own purposes, which can include improving its products and advertising. See the Microsoft Privacy Statement at privacy.microsoft.com. Lawful basis: your consent. If you choose Reject, Clarity does not run. If you accept and later change your mind in "Cookie settings", Clarity stops recording and deletes its cookies.

We do not sell your personal data, and we do not use it to advertise to you. We do not make decisions about you by automated means.

4. Cookies and similar technologies

• Your cookie choice. Stored in your browser as "ffsw-consent" until you clear it. It remembers whether you chose Accept or Reject so we do not ask on every page. It is never sent to us and needs no consent.
• Microsoft Clarity. The cookies "_clck" (up to 1 year) and "_clsk" (1 day), set only after you choose Accept. Microsoft also sets its own cookies on Microsoft domains, such as MUID and CLID, which it uses to recognise your browser across sites that use Microsoft services, including for advertising. Choosing Reject later stops Clarity and deletes our Clarity cookies. You can clear Microsoft's own cookies in your browser settings.
• Page-view and speed statistics and error monitoring. These use scripts, not cookies, as described in section 3.

5. Who we share your data with

We use service providers to run the website and our email list. They handle personal data for us, only on our instructions, and must keep it secure. The exception is Microsoft, described in section 3.

• a web developer, who builds and maintains this website for us;
• a website hosting provider, which delivers the site and keeps security logs;
• an email service provider, which stores our email list and sends our emails;
• an error-monitoring provider, which records technical details when something on the site goes wrong;
• a website statistics provider, which counts page views and measures page speed without cookies;
• TryBooking, our ticketing provider (see section 2);
• Microsoft, only if you accept analytics cookies (see section 3). Microsoft decides for itself how it uses this data.

When we stop using a service provider, we will make sure it deletes or returns the data it holds for us. We may also share personal data if the law requires it, or to protect our rights or the safety of others.

To find out which providers we currently use, email us.

6. International transfers

Some of our service providers, and Microsoft, store or process data outside the UK, including in the European Economic Area and the United States. This only happens where UK law allows it: the country is approved under UK data protection regulations (the EEA is), the US company is certified under the UK Extension to the EU-US Data Privacy Framework, or the provider has signed the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us to find out which safeguard applies to a provider, or to get a copy of it.

7. How long we keep it

• Tickets-only sign-ups (box not ticked). Until we have sent the email telling you tickets are on sale. We then delete your details within 30 days, apart from the record of your consent below.
• News sign-ups (box ticked). Until you unsubscribe. We check every three months and remove anyone who has not clicked a link in any of our emails for 24 months.
• Do-not-contact list. If you unsubscribe, we keep only your email address and the date, so we don't email you by mistake. Lawful basis: our legitimate interest in respecting your choice.
• Record of your consent. Your email address, when you signed up and what the form said. Kept while we email you, and for 2 years after the last email we send you.
• Enquiries. Up to 2 years after we last hear from you about it, unless we need it longer to deal with a legal claim.
• Page-view and speed statistics. These records are not linked to you or your IP address. We can view them for no more than 13 months.
• Session recordings and heatmaps. Recordings are deleted after 30 days; heatmaps and a sample of recordings are kept for up to 9 months. Data that Microsoft uses for its own purposes (see section 3) is kept under Microsoft's privacy statement, not this policy.
• Error reports. Deleted automatically after no more than 90 days.
• Hosting security logs. Deleted automatically after no more than 30 days.

8. Your rights

You can tell us to stop sending you marketing emails at any time, including the tickets email. Use the unsubscribe link in any email or email us, and we will stop.

Under UK data protection law you also have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, in some circumstances;
• ask us to restrict how we use your data, in some circumstances;
• object to our use of your data where we rely on legitimate interests, including the website statistics in section 3;
• ask for data you gave us, in a format you can take elsewhere, in some circumstances;
• withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

To use any of these rights, email hello@fitnessfestsw.co.uk. We may need to confirm who you are first. We will reply within one month of receiving your request, or of confirming who you are if we need to. If your request is complex, or you have made several, we can take up to two more months and will tell you why within the first month. There is normally no charge.

9. Complaints

You have the right to complain to us about how we use your data. Email hello@fitnessfestsw.co.uk. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk/make-a-complaint, or 0303 123 1113.

10. Keeping your data secure

We limit access to personal data to the people who need it, and we use providers that protect it with appropriate security. No website or email system is completely secure. If something goes wrong, we will act quickly and tell you and the ICO where the law requires it.

11. Under-18s

Fitness Fest South West is for adults only. This website is not intended for anyone under 18, and we do not knowingly collect data about children. If we learn that someone who signed up is under 18, we will delete their details.

12. Changes to this policy

We will update this page when what we do with personal data changes. If a change significantly affects data you have already given us and we have your email address, we will email you before it takes effect. If a change needs your consent, we will ask for it.