Shepperton Village Fair Privacy Policy

How we collect, keep, use and dispose of your information

Last reviewed: October 2026

The Shepperton Village Fair is a community event run by a Committee of local residentsneighbours, and we treat your information the way we would want ours treated. This policy explains what we collect, why we need it, who sees it and what your rights are. Personal privacy and security matter to the Committee, our sponsors, suppliers, stallholders, volunteers and everyone who visits the Fair, our website or our social media pages.

The short version:

We collect only what we need to run the Fair, and we tell you why. Where the law says we need your permission, we ask for it properly. Where it does not, we explain the other reasons we rely on, such as carrying out an agreement with you or keeping everyone safe on the day.
We keep your information private and secure, and we never sell it.
You can ask to see what we hold, have mistakes corrected, and in many cases have your information deleted. We will confirm what we have done.
If you are unhappy with how we have handled your information, tell us first and we will put it right where we can. You can also complain to the Information Commission’s Office (the ICO) at any time. Details are in the section on complaints below.
You can contact us at any time using the details in the next section.

Who we are

When we say “we”, we mean Shepperton Village Fair Ltd, a non-profit making company limited by guarantee, registered in England and Wales under company number 14681463. Our registered office is 1 Bruce Avenue, Shepperton TW17 9DP. We are the “controller” of the information described in this policy, which simply means we decide how and why it is used.

The Committee numbers around ten people, all unpaid volunteer residents of Shepperton whose sole aim is to organise the annual Shepperton Village Fair. It includes a Chair, Vice-Chair, Secretary, Treasurer and other members who look after the Fair’s different areas, such as sponsorship, arena, field and marquee planning, the procession, social media and publicity. Our Constitution and our current membership register are available on request.

For anything to do with your information, including the requests and complaints described below, please email dataprotection@shepperton-fair.org. This mailbox goes to both the Chair and the Vice-Chair, and emails will be responded to as promptly as possibleso nothing waits on one person’s holiday. You can also write to us at the registered office above.

The information we collect

We collect information about you from a few different places:

directly from you, whether in conversation, in writing, by phone, through our online forms or by any other means
indirectly when you visit our website, where we may see the name of the domain you connect from, the date and time of your visit and your IP address. Our website may also use cookies, which are small files stored on your device (see the section on cookies below)
from publicly available sources
from other organisations or contacts, such as a school, charity or business that puts your name forward
when we create it ourselves, for example by recording that you have paid or that a document has been received.

Depending on how you take part, the information can include:

your name, address, email address and phone number
stallholder and sponsor details, and supporting documents such as insurance certificates and food hygiene ratings
entry details for the raft race, including crew names and signed waivers
competition entries, which may include photographs of people, and, for younger entrants, an age group and (if you choose to share it) a school
payment details passed to us by PayPal, such as who paid, how much and what for. We do not receive your card details
volunteer offers, and your marketing and communication preferences.

We will not obtain any other personally identifying information when you visit our website or social media pages unless you choose to give it to us. If you send us an email, form or other personal information, you do so voluntarily. We collect information only in line with the law and only where it is relevant to athe Fair function.

Where you give us information directly, please make sure it is accurate and up to date. If you give us information about someone else, such as the members of a raft crew, please tell them where to find this policy and make sure they are happy for us to use their details in this way.

Children. Several parts of the Fair involve people under 18: the photographic competition (age groups 7 to 11 and 12 to 17), the raft race and the school procession. We collect only what is needed to run these activities. A parent or guardian always completes entry forms for entrants under 16 and agrees to how we use their child’s details. If you share a school name for a young entrant, we may tell the school about the entry and any achievement. We take particular care with children’s information, and a parent or guardian can ask us at any time to see, correct or delete it.

Why we use your information, and our legal basis

We use your information only to provide the services you have asked for, to carry out an agreement with you and for other purposes that are part of running the Fair. The law requires us to have a “legal basis” for each use, and the table sets out ours. “Consent” is only one of them, and where we rely on it you can withdraw it at any time.

What we do	Our legal basis
Process stall, sponsorship and raft race applications; take payments; confirm bookings and keep you informed about your place	Carrying out an agreement with you, or taking steps you ask for before making an agreementone
Check insurance, food hygiene and similar documents; collect signed waivers; keep the Fair safe and legal	Our legitimate interest in running a safe event (and, where the law requires it, a legal obligation)
Run the photographic competition, judge entries and return prints	Carrying out the competition you entered
Use competition photographs to promote the Fair and our sponsors, always crediting you	Your consent, which you give when you enter and can limit by emailing competitions@shepperton-fair.org
Work with schools and nurseries on the procession	Our legitimate interest in organising the procession with the people involved
Send news, updates and offers about the Fair by email, text or post	Your consent (see the section on marketing)
Take and publish photographs and film at the Fair to record and promote the event	Our legitimate interest in celebrating the Fair, with the right for you to object
Understand how people use our website so we can improve it	Your consent, through our cookie banner (see the section on cookies)
Keep accounts, report to authorities and respond to complaints and legal claims	Legal obligation, or our legitimate interest in protecting our rights
Help with fundraising and evaluate and improve the event	Our legitimate interest, balanced against your rights

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see the section on your rights). We may also disclose information when the law requires it, for example because of a court order or an investigation by a government agency.

We will put up notices at the entrances to the Fair to let visitors know that photographs and film are taken. If you would rather not appear in them, please tell a Committee member on the day or email us afterwards, and we will remove you where we can.

Who we share your information with, and where it is held

We share your information only with people and organisations who need it to help us run a safe, legal and successful Fair, in line with our Constitution (available on request). That can include sponsors, stallholders, subcontractors, agents and service providers who work with us or for us, and Spelthorne Borough Council where it asks to see stallholder documents. Competition entrants’ contact details are shared with our sponsors only for competition-related purposes. We will not share your information for any other purpose, and we will not sell it to anyone.

To keep things running, the Committee uses a small set of online services:

JotForm for online forms, and PayPal for payments
ClickUp, a web-based system where authorised Committee members keep contact and project records
Brevo, which we use to send bulk emails
email and cloud storage services
Names.co.uk, which hosts our website
Facebook and Instagram for our social media pages.

Except for Facebook and Instagram, these providers handle information for us under the terms we have agreed with them. Facebook and Instagram run their own services and have their own privacy policies, so please read those too.

Where a provider lets us choose to hold our information in the UK or the EU, we do. Not every provider offers that choice, so some information is handled in other countries, including the United States. When that happens we rely on the safeguards each provider puts in place for international transfers.

Within the Fair, authorised Committee members, and the volunteers or family helpers they designate, can reach your information through password-protected accounts on personal computers, mobile devices and cloud services. We may also hold paper copies, which stay with authorised people or in locked cabinets at their homes.

Cookies and similar technologies

Like most websites, ours uses cookies, which are small files stored on your device that help a site work and remember your choices. The same rules apply to similar technologies, such as tracking pixels and the scripts behind embedded content.

Essential cookies keep the website working, for example by remembering the choices you make about cookies. These do not need your consent.
Optional cookies, such as those used for website statistics, are used only with your permission. When you first visit, a banner provided by a tool called Complianz gives you a clear choice to accept or decline, and declining will not stop you using the site.
Content from other services, such as embedded videos or social media feeds, may set their own cookies. We will ask for your permission before loading anything that does.

We will not assume you agree because you carry on browsing. You can change your mind at any time using the cookie settings link or button on the site, and you can also manage cookies in your browser settings.

Marketing and keeping in touch

We like to tell people about the Fair, and we only do it by email, text, phone or post if you have said you are happy to hear from us. When you give us your details through one of our forms, we ask separately whether you are happy to be contacted by each of those routes, and we record your answers. Saying no never affects your place at the Fair, your entry or your stall. We send bulk emails using a service called Brevo.

Every marketing message tells you how to stop receiving it, and you can also email dataprotection@shepperton-fair.org at any time. We act on opt-outs promptly, and we will never pass your details to another organisation for its own marketing.

We do not send marketing to people who simply took part in the past and never told us they wanted to hear from us. We will still write to you about things you have signed up for, such as a stall booking or a raft race entry, because that is part of the service you asked for rather than marketing.

Keeping your information safe, and how long we keep it

We keep digital information in password-protected systems that only authorised Committee members and their designated helpers can open. Paper copies are kept close at hand by authorised people or in locked cabinets, and we destroy them by shredding when they are no longer needed. If we ever have a security problem that puts your information at risk, we will tell you and the regulator where the law requires it.

We keep your information for as long as you have a relationship with us, which means until the fourthsecond anniversary of the last Fair you were involved in. After that we keep only the minimum we need. The table sets out what that means in practice.

Information	How long we keep it
Applications, bookings, entries and contact details	Until two years after the last Fair you took part in
Raft race waivers	Five years from the event or, for anyone under 18 at the time, until they reach 21 if that is later
Accounts and payment records	Seven years, as the law requires
Marketing permissions and opt-outs	For as long as needed to respect your choices, so that we do not contact you again
Complaints about data protection and our replies	Six years
The historical record of the Fair (such as winners, stall lists and photographs used with permission)	Kept as part of the Fair’s history, with the minimum of personal detail

Your rights

You have a number of rights over your information. You can:

ask to see what we hold about you
ask us to correct anything that is wrong or incomplete
ask us to delete your information. We will do so unless we have a good reason, or a legal duty, to keep it, and we will tell you what we have done and why
ask us to restrict how we use it, or to object to a particular use, including anything we do on the basis of legitimate interests or for marketing
ask us to give you your information in a form you can pass to someone else, where that right applies
withdraw your consent whenever we are relying on it. This will not affect anything we did before you withdrew
complain (see the next section).

We do not make decisions about people using automated systems.

To use any of these rights, email dataprotection@shepperton-fair.org or write to our registered office. We will usually reply within one month. If we need to check who you are, or ask what you are looking for so that we can search properly, we may pause that month until we hear back from you, and we will tell you if so. If a request is particularly complex, the law lets us extend the time, and we will explain why. We do not charge for requests unless one is clearly unreasonable or repeated.

If you are unhappy: how to complain

If you think we have handled your information badly, or have not respected your rights, please tell us. We would much rather hear about it and put it right.

Email dataprotection@shepperton-fair.org, or write to us at our registered office.
You do not need any special wording. You can also tell a Committee member in person or send us a message on Facebook or Instagram, and we will pass it to the right people.
We will acknowledge your complaint within 30 days, and usually much sooner. We will then look into it, keep you informed and tell you the outcome without unnecessary delay.

Our short complaints procedure is at the end of this policy.

You also have the right to complain to the UK’s data protection regulator, the Information Commission’s Office (the ICO), at any time and whether or not you have complained to us first. You can find out how at ico.org.uk.

Changes to this policy

We review this policy at least once a year, ahead of each Fair, and whenever the law or the way we work changes. The date at the top shows when it was last reviewed. If we make a significant change to how we use your information, we will say so clearly on the website and tell the people affected directly. Visiting our website or getting in touch does not mean you have agreed to this policy, so there is nothing you need to do to accept it.

Data protection complaints procedure

This procedure explains how the Fair handles complaints about its use of personal information. It is for the Committee and volunteers, and it is published on the website alongside the privacy policy.

What counts as a complaint. Any expression of dissatisfaction about how we have collected, used, shared or looked after someone’s personal information, or how we have responded to a request about it. People do not need to use the word “complaint” or quote the law. A request to see or delete information is handled under “Your rights” in the policy, and a complaint about the Fair day itself goes to the Chair. If one message contains both, we deal with the data protection part under this procedure.

Who is responsible. The Chair is the Complaints Lead. If the complaint concerns the Chair, or the Chair is unavailable, the Vice-Chair takes the lead. Wherever possible, someone who was not involved in the matter looks into it.

Step	What happens	Timing
1. Receive	A complaint can arrive by email, post, phone, social media or in person. Whoever receives it passes it to dataprotection@shepperton-fair.org with information about who it is from, how it arrived and what it says.	The same day
2. Log	The Complaints Lead records the date, the complainant, a short summary and who is handling it in the complaints log.	Within 2 days
3. Acknowledge	We write to the complainant, say who is dealing with it and explain what happens next.	At most 30 days from receipt, aiming for 7 days
4. Look into it	We check our records, speak to the people involved and, if a provider such as JotForm or ClickUp is part of the issue, ask them to help. If it will take longer than a month, we tell the complainant why and update them regularly.	Without undue delay
5. Reply	We explain what we found, what we have done to put things right and why. We remind them they can complain to the ICO.	Aiming for within one month of receipt
6. Learn	The Committee reviews complaints at its next meeting and changes how we work where that would prevent a repeat.	Next Committee meeting

If it involves a data breach. If a complaint shows that personal information has been lost, shared by mistake or accessed by someone who should not have seen it, the Complaints Lead decides straight away whether it must be reported to the ICO. Where it must, this has to happen within 72 hours of us becoming aware of it.

At the Fair itself. If someone raises a concern in person, a volunteer willlisten, thank them, take their name and contact details and say that the Complaints Lead will be in touch. They willnot try to settle a complaint on the spot or promise an outcome. The volunteer will pass the message on that day.

Records. We keep the complaints log and our replies for six years, and the Committee reviews this procedure each year alongside the privacy policy.