Privacy Policy
FAX Gallery — Privacy Policy (draft)
Who we are
FAX Gallery (“we”, “us”) runs this website and is the data controller for the personal information described here.
- Legal name: [registered company name]
- Address: [registered address]
- Company number: [Companies House number, if registered]
- Email: contact@galleryfax.com
- ICO registration: [registration number, or remove this line if not registered]
Most organisations that process personal data for business purposes must register with the Information Commissioner’s Office and pay a data protection fee. If the gallery is not yet registered, check whether it needs to be.
What we collect
When you book a ticket. Your name and email address, the event and ticket type, the quantity and amount paid, and the name of each person attending. If you book for several people, we collect a name for each of them — if you give us someone else’s details, please make sure they are happy for you to do so.
When you pay. Your card details go directly to Stripe, our payment provider. They are entered in a form hosted by Stripe and never reach our website or our servers. We receive only the outcome of the payment, the amount, and a reference.
When you visit the site. Our hosting provider records technical information automatically: your IP address, browser type, the pages you visit and the time of your visit. We also store a short-lived record of your IP address, in a form that cannot be read back, to limit how many bookings can be made from one connection — this is how we keep automated booking abuse out.
[If there is a newsletter] Your email address, and the date you subscribed.
We do not collect special category data — health, beliefs, and so on — and we ask you not to send it to us.
Why we use it, and on what basis
| What we do | Data used | Lawful basis |
|---|---|---|
| Issue your ticket and confirm your booking | Name, email, attendee names, order details | Performance of a contract |
| Take payment and handle refunds | Payment outcome and reference (Stripe holds the card details) | Performance of a contract |
| Email you your ticket and payment confirmation | Name, email, order details | Performance of a contract |
| Contact you if an event is cancelled or changed | Name, email | Performance of a contract |
| Keep financial records | Order details | Legal obligation |
| Limit automated or abusive booking | IP address, held briefly and not readable back | Legitimate interests — keeping tickets available to real visitors |
| Keep the site running and secure | Technical log data | Legitimate interests — running a working, secure website |
| [If there is a newsletter] Send you news about exhibitions and events | Email address | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we think it is not. You can object — see Your rights below.
Who else sees it
We do not sell your personal information, and we do not share it for anyone else’s marketing.
We use these services to run the website and the booking system. Each of them handles your data on our instructions, except Stripe, which is also a controller in its own right for payment and fraud purposes.
| Service | What it does | Where |
|---|---|---|
| Stripe | Takes card payments, handles refunds and fraud checks | UK, EU and US |
| Kinsta | Hosts the website and keeps backups |
[data centre region]
[Email provider]
Sends your ticket and payment confirmation
[region]
[Analytics, if any]
[what it measures]
[region]
Some of these providers are outside the UK. Where that happens, the transfer is covered by the UK’s addendum to the EU standard contractual clauses, or by the UK’s adequacy rules for that country.
We may also share information where the law requires it, or to establish or defend a legal claim.
How long we keep it
| What | How long | Why |
|---|---|---|
| Booking and attendee records | 7 years from the end of the financial year | HMRC requires records to be kept for six years, and we round up to the end of the year |
| Abandoned bookings that were never paid for | Deleted [after 30 days] | They serve no purpose once the event has passed |
| Technical log data | [30 days], then deleted | Enough to investigate a problem, no longer |
| Booking abuse records | 15 minutes to 1 hour | They expire on their own |
| [If there is a newsletter]Subscriber email | Until you unsubscribe, then [12 months] to show we honoured it |
Stripe keeps payment records on its own schedule, which you can read in its privacy policy.
Cookies
We use only what the booking system needs to work. These are strictly necessary, so we do not ask for consent before setting them:
- A short-lived cookie that remembers which tickets you were holding while you complete a booking.
- Cookies set by Stripe inside its payment form, which it uses to process the payment and detect fraud.
- Your browser also stores your booking details on your own device while you are checking out. This never leaves your browser, and it is cleared when the booking finishes.
[If analytics or any marketing tool is added] these are not strictly necessary, and UK law requires us to ask for your consent before setting them. A consent banner would then be needed. As things stand, there is none, because there is nothing to consent to.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we no longer need it;
- restrict what we do with it while a question is being settled;
- send your data to you or another organisation in a portable form;
- stop processing based on legitimate interests, where you object;
- stop sending you marketing, at any time and without giving a reason.
Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.
To exercise any of these, email contact@galleryfax.com. We will reply within one month. There is no charge, unless a request is clearly unfounded or excessive. We may ask you to confirm who you are before we release anything.
Some rights have limits. We cannot delete booking records we are required to keep for tax purposes until that period has passed.
Security
The site runs over an encrypted connection. Card details are entered in a form hosted by Stripe and never pass through our systems, so we could not expose them even if our site were breached. Access to booking records is limited to gallery staff who need it, and our host keeps backups.
No system is perfectly secure. If a breach affects your rights, we will tell you and the ICO as the law requires.
One thing to be aware of: the email containing your ticket includes a link that lets anyone holding it download the ticket and change the attendee’s name. Please treat that email as you would the ticket itself.
Children
The booking system is meant for adults. We do not knowingly collect data from children under 13. If a child’s name is given as an attendee, we hold only that name, and only for the event. If you believe we hold a child’s data that we should not, email us and we will delete it.
Complaints
If something concerns you, please tell us first — contact@galleryfax.com — and we will try to put it right.
You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk, on 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to come to us first.
Changes
We update this policy when what we do with your data changes. The date at the top is when it was last changed. If a change matters to you, we will say so on the site or by email.