Privacy & Data Protection Policy

1. Introduction

This privacy policy applies to the following websites www.blenheimpalacefoodfestival.co.uk and www.epsilonfestivals.co.uk (the “websites”) owned by Epsilon Festivals Ltd (together, “we”, “us”, “our”).

When you interact with us through our websites (or otherwise) you may provide, or we may collect, certain information from which you are personally identifiable (which is referred to as personal data). For the purposes of the General Data Protection Regulation (EU) 2016/679 or “GDPR” (and all other laws relating to the use your personal data, including as such laws are amended, superseded or replaced from time to time), each of Epsilon Festivals Ltd are a “data controller” and is separately responsible for complying with the provisions of the GDPR and other data protection regulations. As data controllers, we are each responsible for deciding how your personal data is used and more importantly, for keeping your data safe and only using it for legitimate reasons.

We are committed to protecting your privacy and will take all steps necessary to comply with our legal obligations when using your personal data. This privacy policy explains how we fulfil this commitment, so please read this carefully.

By providing us with personal information you consent to the collection and use of this information in accordance with this privacy policy.

2. Who we are?

Epsilon Festivals Ltd is a UK based Festival Company. Epsilon Festivals Ltd is registered as a company in England & Wales (registered number 12430110). The office address Stone Dean House Jordans Lane, Jordans, Beaconsfield, England, HP9 2UX.

3. How do we collect information from you?

Information you provide us

We obtain personal information from you when, for example, you complete an online or physical form, register with us for the newsletter or buy a ticket for an event.

When you purchase a ticket for our events you will be taken to our bespoke page on a third party platform, such as Eventbrite or DigiTickets or Festival Pro for ticket sales and newsletter sign ups. These platforms will collect certain personal data from you on our behalf as data processors. We are the data controllers of this data and receive this data from them. If you have any concerns about these third party platforms, please check the privacy policy on their websites when you provide your information to understand how they will process your data. Data obtained in this manner will be covered by this privacy policy.

Consent to receive communications from us

We collect your personal data when you opt in to receive communications or newsletters from us. You will have to actively opt in to receive communications from us, the boxes are not pre-ticked. A separate newsletter/communications sign up is incorporated in the ticketing system. The event specific T&C’s tick box is separate to newsletter/communications. You can unsubscribe at any time, by clicking unsubscribe or by contacting us via phone or email.

Information we get from your use of our website and services

We may collect information about the services you use and how you use them, like when you watch a video on YouTube, Facebook, visit our websites or view and interact with our ads and content.

Information in the public domain

We may obtain some information from publicly available sources such as Companies House, newspaper articles or open postings on social media such as Facebook and LinkedIn.

4. What type of information is collected from you?

The type of personal information that we collect may include:

• Identity - your title, name, gender and date of birth
• Contact - your contact details (address, email, phone number.
• Emergency details - family and spouse/partner details, and emergency contact details
• Medical information - medical conditions
• Profile - contact preferences, media articles about you (connected to us)
• Financial - if you purchase a ticket or other product from us, your card information is not held by us, it is collected by our third party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions, as explained below
• Other - any other information provided by yourself at the request of us

We may also collect the following types of personal data from you when you use our website or products. Please read our Cookie Policy on our individual websites carefully for more information.

• Technical – this may include device IDs, browser type, IP address, hardware type, network and software identifiers, location data, operating system and system configuration
• Usage – visitor information e.g. time spent on page, click-throughs, download errors, browsing patterns

You don’t have to give us any of this data but if you don’t, you may not be able to use certain functions and may not receive the optimal user experience.

Where appropriate we may also ask you further demographic questions, but we will never make these questions mandatory, and only want to know the answer if you are comfortable providing us with that information.

In some limited circumstances, the personal information that we collect may include information that is considered “sensitive data”. This may include personal information regarding medical conditions and your health.

Different information is required from different stakeholders, as set out in the table below:

17 or Under

We are concerned about protecting the privacy of children aged 17 or under. If you are aged 17 or under‚ please get your parent/guardian's permission beforehand whenever you provide us with personal information or when sending sensitive information to anyone online.

5. How is your information used?

The table below sets out how we use your personal data and our lawful basis for doing so.

Tools may be used to improve the effectiveness of our communications with you, including tracking whether you open the emails we send you and which links you click within a message.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us.

6. Who might we share your information with

We will not share your information with any third parties for marketing purposes, with the exception of Laithwaites wine part of Direct Wines Ltd, in the case that you purchase a wine tasting ticket separately to a Blenheim Palace Food Festival Ticket and agree to receive marketing correspondence directly from them.

We are committed to protecting your data and therefore it will never be disclosed or sold to external organisations other than those acting as agents and data processors carrying out work on our behalf with the one exception stated in the above paragraph.

Where we enter into a relationship with an external party, any such arrangements will be subject to a formal agreement between us and that organisation to protect the security of your data. They only act under our instructions and we maintain full responsibility for your data, with the one exception stated in the 1st paragraph of this section.

If you are working with us as a sponsor/exhibitor your details will be shared, with your permission, in the event programme at the relevant event and on-site at the relevant event.

We share your personal data with third parties to help us deliver our products and services to you in the most effective way possible. These include the following third parties:

• Data processors (for example Microsoft 365, DigiTickets, Mailchimp, Wufoo, Eventbrite, Racenation and other third party platforms) which are compliant with GDPR.
• When you are using our secure online payment pages, your payment is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us.
• Suppliers, outside caterers (for dietary requirements) venues etc.
• Our delivery partners, to enable is to run our events safely and effectively.
• Other aspects of our service delivery, such as hosting our website and detecting fraud or criminal activity.

If we share personal data with third parties, we will ensure that access is limited on a strictly need to know basis and is subject to suitable obligations relating to confidentiality and security, with the one exception stated in the 1st paragraph of this section.

Please note that certain of these third party service providers use cookies or other tracking technologies, which are explained more fully in our Cookies Policy on our individual websites. In addition to the above, we may also be required to share your personal data with third parties if required by law or regulation. In such circumstances, we will make sure that the disclosure is only to the extent required by law or regulation.

7. How you can access and update your information

We continuously review records of supporters to ensure your data is as accurate as possible and always appreciate it if you let us know if your contact details change. If you change email address, or any of the other information we hold is inaccurate or out of date please email us using the contact details below.

In certain situations, you are entitled to: (i) access to your personal data; (ii) update your personal data; (iii) erase your personal data; (iv) object to processing of your personal data where we are relying on a legitimate interest; (v) restrict the processing of your personal data; (vi) request the transfer of your personal data to a third party; or (vii) where you have provided your consent to certain of our processing activities, you may withdraw your consent at any time (but please note that we may continue to process such personal data if we have legitimate legal grounds for doing so).

Please contact us (using the details below) if you would like to exercise your rights.

Please note that you also have a right to complain to the Information Commissioner’s Office if you are concerned about the way we are handling your personal data.

8. How will we store your information and keep it safe?

We have put in place suitable physical, technical and administrative controls to protect your information, which include:

• Storing personal details on a database system which can only be accessed by our staff. The system is password protected. If tickets are bought personal information will also be stored with our ticketing platform.
• Storing personal details in password protected Excel files on Microsoft 365, accessible by relevant staff only. Password protected Excel files are only saved on the desktop of a password protected device with up to data anti –virus protection for the duration that they are needed (around our events, etc.). Data is only printed if absolutely necessary and shredded immediately after use.
• The information provided will be securely stored within our database and our third party email communication tool. Your data will only be accessed by authorised personnel and authorised parties who are responsible for the maintenance and security of our digital systems. Within our offices all of our staff receive training on handling data securely. In the event of our staff leaving us, their user accounts will be removed and passwords changed.
• An up to date anti-virus software is installed on all devices with access to personal information.
• Passwords are changed every 6 months.
• In case of a data breach we will notify both users and the Information Commissioner’s Office within 72 hours.

Despite our precautions no data transmission over the internet can be guaranteed to be 100% secure. So, whilst we will always strive to protect your personal information, we cannot fully guarantee the security of any information which you disclose to us and so wish to draw your attention that you do so at your own risk.

9. How long will we store your data?

We will retain your personal data only for as long as is strictly necessary for the purposes for which such data was originally collected (as referred to above), and thereafter for such longer period as may be required by law.

You have a choice about whether or not you wish to receive information from us. We will store full details that are event relevant on our database until 1 year after the event or in individual cases longer if necessary. We will store your basic personal information (full name and email address and event attendance) on our systems for 2 years or until you request to be removed from the database.

If you do not want to receive direct marketing communications from us then you can opt out by emailing us by using the contact details below or by ticking the relevant boxes to opt out box situated on the form on which we collect your information. If you request to opt out of communications your account will be made ‘dormant’ and the data will still be visible for reference for up to 2 years, but you will no longer be contacted. If you request for your data to be deleted implications will be explained (if you have bought a ticket for an event that has not yet taken place) and your data will be deleted from all systems.

If you request that we stop sending you emails we will usually keep a record of your contact details to enable us to comply with your request not to be contacted by us, we won’t keep any information that we don’t need.

10. Transfer of data outside the EEA

The European Economic Area or “EEA” is seen to have good data protection standards. As such, we limit the occasions when we may need to send your data outside of the EEA. Where we do, for example, where our service providers are based outside of the EEA, we make sure that your data is still treated fairly and lawfully in all respects (including making sure we have a legal ground for sending your data outside the EEA and putting in place all necessary safeguards for such arrangement). Where relevant, you will have the right to see a copy of any safeguards we put in place for international transfers of your data. Just get in touch with us if you would like to find out more.

11. Links to other websites

Our website contains links to other websites run by other organisations. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access those using links from our website.

In addition, if you linked to our website from a third party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third party site.

12. Review of this Policy

We keep this policy under regular review. This policy may be amended from time to time. Any such changes will be posted on this page. We will notify you of any significant or material changes by placing a prominent notice on our website or emailing you (if appropriate).

13. Contact us

If you would like to discuss anything in this policy or if you want to exercise your rights, please get in touch:

Stone Dean House Jordans Lane, Jordans, Beaconsfield, England, HP9 2UX

This Policy was last updated: 07 February 2021