Privacy Policy

Last updated: 8 July 2026

Craft Festival respects your privacy and is committed to protecting your personal information.

This privacy policy explains how we collect, use, store and protect your personal information when you:

  • visit our website;

  • subscribe to our newsletter;

  • contact us;

  • purchase tickets or attend one of our events;

  • apply to exhibit, volunteer or work with us;

  • enter a competition or prize draw;

  • interact with us as an exhibitor, supplier, customer or business contact; or

  • otherwise provide personal information to us.

This policy also explains your rights under UK data protection law.

1. Who we are

Craft Festival is operated by:

THE BOVEY TRACEY ARTS AND CRAFTS FESTIVAL LIMITED
Trading as: Craft Festival
Office address: Unit E, Kach Business Park, Bovey Tracey, Devon, TQ13 9TZ
Email: hello@craftfestival.co.uk

For the purposes of UK data protection law, THE BOVEY TRACEY ARTS AND CRAFTS FESTIVAL LIMITED is the data controller responsible for the personal information described in this policy.

2. Personal information we collect

The personal information we collect depends on how you interact with us.

It may include:

  • your name;

  • your email address;

  • your telephone number;

  • your postal or billing address;

  • your organisation or company name;

  • your job title or business role;

  • your areas of interest, such as visiting, exhibiting or volunteering;

  • information included in enquiries, applications, feedback or correspondence;

  • booking, ticket and transaction information;

  • exhibitor, maker, supplier or volunteer application information;

  • marketing and communication preferences;

  • records of when, where and how you subscribed to our communications;

  • information about whether you have opened, clicked or interacted with our emails;

  • records of email delivery, bounces, complaints and unsubscribes;

  • competition and prize-draw entries;

  • photographs, video or other event media where appropriate;

  • technical information such as your IP address, browser type, device type, operating system and website activity;

  • cookie identifiers and analytics information; and

  • any other information you choose to provide to us.

We ask newsletter subscribers to confirm that they are aged 18 or over. Our services and marketing lists are not intended for children.

Please do not provide sensitive personal information through our general website contact forms unless it is necessary for your enquiry.

3. How we collect your information

We may collect personal information directly from you when you:

  • complete a form on our website;

  • subscribe to our newsletter;

  • contact us by email, telephone, social media or post;

  • purchase a ticket;

  • submit an exhibitor, maker or volunteer application;

  • attend or participate in one of our events;

  • enter a competition or prize draw;

  • respond to a survey;

  • provide services to us; or

  • otherwise interact with Craft Festival.

We may also receive personal information from organisations that help us operate our events and services, including:

  • ticketing providers;

  • event venues and partners;

  • application and form providers;

  • payment providers;

  • competition or promotional partners; and

  • website and email service providers.

Where another organisation provides your information to us, we expect it to have an appropriate lawful basis for doing so.

We also collect some technical information automatically through cookies and similar technologies when you use our website.

4. How we use your information

We may use your personal information to:

  • respond to enquiries and messages;

  • process ticket purchases, bookings and event registrations;

  • administer exhibitor, maker and volunteer applications;

  • manage our relationships with exhibitors, suppliers, contractors and event partners;

  • provide information about applications, bookings, attendance or event arrangements;

  • operate and improve our website;

  • administer competitions and prize draws;

  • provide customer service and resolve complaints;

  • protect our website, systems, staff and visitors against fraud, misuse or security threats;

  • comply with legal, regulatory, accounting and insurance requirements;

  • maintain records of consent, objections, unsubscribes, bounces and complaints;

  • understand how people use our website and engage with our communications;

  • improve our events, services and communications; and

  • send newsletters, event announcements and promotional communications where we are permitted to do so.

We will not sell or rent your personal information to third parties.

5. Our lawful bases

UK data protection law requires us to have a lawful basis for using personal information.

Depending on the circumstances, we rely on the following lawful bases.

Consent

We rely on consent when you have actively agreed to receive email marketing or where consent is otherwise required.

You can withdraw your consent at any time by:

Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

Contract

We may process personal information where it is necessary to enter into or perform a contract with you. This may include processing a booking, ticket purchase, exhibitor arrangement or supplier agreement.

Legitimate interests

We may process personal information where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights.

These interests may include:

  • responding to enquiries;

  • managing our relationship with customers, exhibitors, makers, volunteers and suppliers;

  • administering and improving our events;

  • maintaining website and information security;

  • understanding the effectiveness of our services and communications;

  • maintaining accurate suppression and unsubscribe records;

  • preventing fraud or misuse; and

  • promoting Craft Festival to appropriate business contacts where permitted.

Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of the individual and the potential effect of the processing.

Legal obligation

We may process information where this is necessary to comply with legal, regulatory, tax, accounting, insurance or law-enforcement requirements.

Vital interests

In exceptional circumstances, we may use personal information where necessary to protect someone’s life or physical safety.

6. Email marketing

We use email to share information about Craft Festival events, applications, tickets, makers, exhibitors, news and related activities.

We only send electronic marketing where we have an appropriate legal basis and where applicable privacy and electronic communications laws permit us to do so.

For individual subscribers, this will normally mean that:

  • you have actively subscribed to receive our emails; or

  • you are an existing customer and the limited soft opt-in rules apply.

Where we rely on the soft opt-in, marketing will relate to our own similar events or services, and you will have been given an opportunity to opt out when your details were collected and in every subsequent marketing email.

Submitting a general enquiry or contact form will not automatically subscribe you to marketing communications.

Business contacts may receive relevant business-to-business communications where permitted by law. They can object to these communications at any time.

Every marketing email will include a clear unsubscribe facility. Once you unsubscribe, we will stop sending marketing emails to that address, although we may retain limited information on a suppression list to ensure that your preference continues to be respected.

Service messages relating to an active booking, application, purchase, event arrangement or other transaction are not marketing messages. You may continue to receive those communications where they are necessary to provide the service you requested.

7. Website forms and CRM systems

Our website forms are currently provided through Elementor and may store submissions securely within our WordPress website or deliver them to authorised Craft Festival email accounts.

We intend to use FluentCRM, operating within our WordPress website, to manage newsletter subscriptions, subscriber preferences and email campaigns. We may use Amazon Simple Email Service, also known as Amazon SES, to deliver transactional and marketing emails.

During a transition period, we may also use Mailchimp to maintain existing subscriber records or deliver communications.

These systems may process information including:

  • your name and email address;

  • information submitted through website forms;

  • your subscription status and preferences;

  • the date and source of your subscription;

  • communications sent to you;

  • email delivery and engagement information;

  • unsubscribe requests;

  • hard-bounce records; and

  • spam or abuse complaints.

Submitting a general contact or application form will not automatically subscribe you to marketing unless you make a separate and clear choice to receive marketing communications.

8. Email delivery and suppression

We use customer relationship management and email delivery services to manage our contacts and send transactional and marketing emails.

These services may process information including:

  • your name and email address;

  • your subscription status;

  • your areas of interest;

  • the source and date of your subscription;

  • emails sent to you;

  • delivery and engagement information;

  • unsubscribe requests;

  • hard-bounce information; and

  • spam or abuse complaints.

We use this information to deliver requested messages, maintain accurate records, prevent unwanted email and protect our sender reputation.

Hard-bouncing addresses and addresses associated with spam complaints may be automatically placed on a suppression list. They will not be used for future marketing unless there is a lawful and verified reason to remove the suppression.

9. Email tracking

Our marketing emails may contain tracking technologies that tell us whether an email was delivered, opened or whether a link was selected.

We may use this information to:

  • measure the effectiveness of our communications;

  • understand what content is useful to subscribers;

  • identify delivery problems;

  • manage inactive or disengaged contacts; and

  • improve the relevance and frequency of our messages.

Some email applications automatically block or preload tracking images, so this information may not always be accurate.

You can object to the use of your personal information for direct marketing at any time by unsubscribing or contacting us.

10. Contact forms

When you submit a contact form, we use the information you provide to review and respond to your enquiry.

We may retain correspondence where necessary to:

  • provide ongoing assistance;

  • maintain a record of our relationship with you;

  • resolve disputes;

  • protect our legal rights; or

  • meet legal or operational requirements.

The email address entered into a contact form may be used as a reply-to address. We will not use a contact-form submission to subscribe you to marketing unless you make a separate, clear marketing choice.

We use security controls, validation and anti-spam measures to protect our forms against automated or abusive submissions.

11. Analytics

We intend to use Google Analytics to understand how visitors use our website, such as which pages are visited, how visitors arrive at the website and how the website performs.

Google Analytics may process information including:

  • truncated or otherwise processed IP address information;

  • device and browser information;

  • approximate location;

  • pages viewed;

  • referral source;

  • interaction and session information; and

  • cookie or device identifiers.

Google Analytics will only be activated after you have provided the required consent through our cookie-management tool.

You can reject analytics cookies or change your preference at any time through our cookie settings.

Further information about the cookies and similar technologies used on our website is available in our Cookie Policy.

12. Ticket purchases and payments

Ticket sales may be processed by an external ticketing or payment provider.

The provider may collect information such as:

  • your name;

  • contact details;

  • ticket selection;

  • payment information; and

  • transaction details.

Payment-card details are normally processed directly by the relevant payment provider and are not stored by Craft Festival.

The ticketing or payment provider may act as an independent controller or as our processor, depending on the service. You should review the provider’s privacy information when making a purchase.

We may receive information needed to administer your booking, communicate event arrangements, provide customer support and meet accounting requirements.

13. Exhibitors, applicants, volunteers and suppliers

Where you apply to exhibit, volunteer or work with us, or provide goods or services to Craft Festival, we may process information needed to:

  • assess and administer your application;

  • communicate decisions and arrangements;

  • manage contracts, fees, payments and invoices;

  • promote confirmed participants or exhibitors;

  • organise event access, health and safety and operational requirements;

  • maintain insurance and compliance records; and

  • manage our ongoing professional relationship.

Unsuccessful applications will normally be deleted within six months of the relevant decision, unless the applicant expressly asks us to retain the information for consideration for a future opportunity.

Where photographs, descriptions or professional profiles are supplied for promotional purposes, we may publish them on our website, social-media channels, printed materials or event programmes in accordance with our agreement with you.

14. Competitions and prize draws

If you enter a competition or prize draw, we use your information to:

  • administer the promotion;

  • contact winners;

  • deliver prizes;

  • prevent duplicate or fraudulent entries; and

  • meet any legal or regulatory requirements.

Entering a competition will not automatically subscribe you to marketing. Where marketing consent is requested, it will be presented as a separate choice.

Competition information will normally be retained for up to six months after prizes have been awarded, unless a longer period is required for legal, tax or dispute purposes.

15. Photography and filming at our events

Photography and filming may take place at Craft Festival events for editorial, documentary and promotional purposes.

This may include:

  • general photographs and video of the event;

  • crowd and venue scenes;

  • images of exhibitions, demonstrations and activities;

  • coverage of exhibitors, speakers, performers and participants;

  • social-media content;

  • press and public-relations materials;

  • printed programmes and promotional publications; and

  • promotion of current and future Craft Festival events.

For general event coverage, we normally rely on our legitimate interests in documenting and promoting Craft Festival and its activities. We consider the reasonable expectations and privacy rights of those attending our events.

Notices will be displayed where official photography or filming is taking place. Where reasonably possible, official photographers will be identifiable.

If you do not wish to be photographed or filmed, please speak to a member of the Craft Festival team or the official photographer. We will take reasonable steps to respect your request.

We will normally seek specific permission before using:

  • a posed or prominent individual portrait;

  • an identifiable testimonial;

  • an image focused on a child;

  • an image taken in circumstances where publication would not reasonably be expected; or

  • an image for a particularly prominent advertising campaign.

If you have concerns about an image that has been published, contact hello@craftfestival.co.uk and provide enough information for us to locate it. We will consider requests to remove or stop using an image, taking account of your rights, our lawful basis and any applicable legal or editorial considerations.

16. Cookies

Our website may use cookies and similar technologies to:

  • make the website function correctly;

  • remember preferences;

  • maintain security;

  • understand website usage;

  • measure website and campaign performance; and

  • support embedded services or content.

Cookies that are not strictly necessary will only be used after the required consent has been provided.

You can manage your preferences through our cookie banner or cookie settings.

Further information is available in our Cookie Policy.

17. Who we share information with

We may share personal information with trusted organisations that help us provide our services, including:

  • website hosting and support providers;

  • WordPress and website-plugin providers;

  • CRM and email delivery providers;

  • Amazon Web Services;

  • Mailchimp during any transition period;

  • Google, where Google Analytics is used with your consent;

  • ticketing and payment providers;

  • application and online-form providers;

  • event venues and operational partners;

  • professional advisers, including accountants, insurers and legal advisers;

  • IT, cybersecurity and data-backup providers;

  • marketing, analytics and communications providers;

  • contractors and suppliers supporting our events; and

  • regulators, courts, law-enforcement bodies or other authorities where required.

We only provide service providers with the information reasonably necessary to perform their services.

Where an organisation processes personal information on our behalf, we require it to protect the information and process it only in accordance with our instructions and applicable data protection law.

Some third parties, such as ticketing platforms, payment providers, Google or social-media services, may act as separate data controllers. Their own privacy policies will apply to their use of your information.

We may also disclose information:

  • where required by law;

  • to protect our rights, property, staff, visitors or users;

  • in connection with legal proceedings;

  • to investigate fraud, abuse or security incidents; or

  • as part of a sale, restructuring or transfer of all or part of our organisation or assets.

We do not sell personal information or provide our mailing list to third parties for their own unrelated marketing.

18. International data transfers

Some of our service providers may store or process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take steps designed to ensure that it receives an appropriate level of protection.

Depending on the destination and provider, these measures may include:

  • a UK adequacy regulation;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to the European Commission’s Standard Contractual Clauses;

  • contractual, organisational and technical safeguards; or

  • another transfer mechanism permitted by UK data protection law.

Further information about the safeguards used for a particular service is available on request.

19. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, operational and reporting requirements.

Our usual retention periods are:

  • Active newsletter subscribers: for as long as you remain subscribed. We periodically review our mailing list and may remove addresses that are invalid or have remained inactive for an extended period.

  • Unsubscribes, objections, complaints and suppressed addresses: we retain a minimal record for as long as necessary to ensure that your preference continues to be respected and that your address is not accidentally re-added to our marketing list.

  • General enquiries and correspondence: normally for up to two years after the enquiry has been resolved.

  • Ticket, payment and accounting records: normally for up to six years after the end of the relevant financial year.

  • Successful exhibitor, supplier and contractual records: for the duration of the relationship and normally for up to six years afterwards.

  • Unsuccessful exhibitor or other applications: normally deleted within six months of the relevant decision, unless the applicant expressly asks us to retain the information for a future opportunity.

  • Unsuccessful volunteer applications: normally deleted within six months of the relevant decision.

  • Competition and prize-draw entries: normally deleted within six months after the prizes have been awarded, except where a longer period is necessary to deal with a complaint, tax requirement or legal matter.

  • Website security and access logs: normally retained for between six and twelve months, unless a longer period is required to investigate a security incident.

  • Consent records: retained while we rely on the consent and for an appropriate period afterwards so that we can demonstrate when and how consent was obtained.

  • Event photographs and video: retained while they remain relevant to our historical, editorial or promotional activities, subject to periodic review and any valid objection or erasure request.

We may retain information for longer where:

  • a legal or regulatory obligation requires it;

  • it is relevant to a complaint, dispute or legal claim;

  • there is a risk of fraud or misuse;

  • it is needed to protect the safety of individuals; or

  • a limited record is required to respect an unsubscribe or other preference.

When personal information is no longer required, it will be securely deleted or anonymised.

20. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against:

  • unauthorised access;

  • accidental loss;

  • misuse;

  • disclosure;

  • alteration; and

  • destruction.

These measures may include:

  • access controls;

  • secure passwords and authentication;

  • encryption in transit;

  • software and security updates;

  • backups;

  • anti-spam and website security controls;

  • restricted administrator access;

  • supplier due diligence; and

  • monitoring of email bounces, complaints and unusual activity.

No internet transmission or storage system can be guaranteed to be completely secure. You should take care when sending information online and avoid including unnecessary sensitive information in general enquiry forms.

21. Your data protection rights

Depending on the circumstances, you may have the right to:

  • Access: request a copy of the personal information we hold about you.

  • Rectification: ask us to correct inaccurate or incomplete information.

  • Erasure: ask us to delete your information in certain circumstances.

  • Restriction: ask us to restrict how we use your information in certain circumstances.

  • Objection: object to processing based on legitimate interests.

  • Object to direct marketing: require us to stop using your information for direct marketing at any time.

  • Data portability: receive certain information in a structured, commonly used and machine-readable format.

  • Withdraw consent: withdraw consent at any time where we rely on consent.

  • Complain: raise a concern with us or with the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal conditions or exemptions.

We may need to confirm your identity before responding to a request. We will normally respond within one month, although the law allows additional time in certain complex cases.

You will not normally have to pay a fee. We may charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive, as permitted by law.

22. How to exercise your rights

To exercise your rights or ask a question about this policy, contact:

Craft Festival
Unit E, Kach Business Park
Bovey Tracey
Devon
TQ13 9TZ

Email: hello@craftfestival.co.uk

Please describe your request clearly and provide enough information for us to identify the relevant records.

23. Complaints

We would appreciate the opportunity to address your concerns first. Please contact us at hello@craftfestival.co.uk.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Further information is available through the Information Commissioner’s Office website.

24. Links to other websites

Our website contains links to websites operated by other organisations, including ticketing providers, social networks, event partners and other services.

We are not responsible for the privacy practices of third-party websites. You should review the relevant privacy policy before providing personal information to another organisation.

25. Changes to this policy

We may update this privacy policy to reflect changes to:

  • our services;

  • the systems and suppliers we use;

  • our data-handling practices; or

  • legal and regulatory requirements.

The most recent version will be published on this page, with the date of the latest update shown at the top.

Where a change is significant, we may provide an additional notice through our website or another appropriate communication.