Privacy Policy

Last updated: 11 September 2026

1. Who is responsible for your information

V Fest Ltd, The Community Farm, Denny Lane, Chew Magna, Bristol BS40 8SZ, is the data controller for personal information collected through valleyfest.co.uk and at Valley Fest. Contact us about anything in this policy at info@valleyfest.co.uk. This policy is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.

2. What we collect and where it comes from

• When you buy or reserve: your name, email address, the items you chose, the amount, your order reference and delivery address for merchandise. Card details are entered directly with our payment provider, Revolut; we receive only a confirmation, the card type and, for reservations and quarterly memberships, a payment token that lets us take the agreed payment later. We never see your full card number.
• When you contact us or fill in a form: whatever you send — for example an enquiry, a corporate or host package request, a talent application (including links, audio and files), a press accreditation or a job or steward application (including a CV).
• When you use the site: technical information such as IP address, browser and device, pages viewed and, with your consent, advertising cookies (see the Cookie Policy). Questions typed into Ask Val are processed to generate an answer and are not linked to your account.
• At the festival: ticket scans at the gate (which code was admitted, when and by which steward), and photography or filming in public areas of the site.
• From other people: if someone transfers a ticket to you, we receive your name and email from them.

3. Why we use it and our legal basis

• To fulfil your order or reservation — issuing tickets, taking the agreed payment, delivering merchandise, sending receipts and essential booking information. Legal basis: performance of a contract.
• To run a safe, lawful festival — gate scanning, capacity, safeguarding, responding to incidents and complying with our licence. Legal basis: legitimate interests and legal obligation.
• To answer you when you contact us or apply for something. Legal basis: legitimate interests, or steps before entering a contract.
• To send you marketing about Valley Fest only where you have ticked a box agreeing to it. Legal basis: consent, which you can withdraw at any time using the unsubscribe link or by emailing us.
• To measure and improve our advertising using the Meta Pixel and Conversions API, only where you have accepted advertising cookies. Legal basis: consent.
• To keep records for accounting, tax, insurance and legal claims. Legal basis: legal obligation and legitimate interests.

4. Who we share it with

We share personal information only with organisations that help us run the festival and the site, each acting under contract and only for the purpose described:

• Revolut — payment processing, card verification and saved payment tokens.
• Supabase — secure hosting of our order, ticket, reservation and enquiry database (data held in the EU/UK region).
• Netlify — website hosting and form handling.
• Resend — sending tickets, receipts and reservation emails.
• Printful — printing and posting merchandise; they receive your name, delivery address, email and the items ordered.
• Anthropic — the AI service behind Ask Val processes the text of your question to produce an answer.
• Meta Platforms — advertising measurement, only with your consent, and with email addresses hashed before they leave our systems.
• Professional advisers, insurers, the emergency services, the licensing authority or the police where necessary to deal with an incident, a claim or a legal obligation.

Some of these providers process data outside the UK, principally in the United States. Where they do, transfers are protected by the UK International Data Transfer Agreement or Addendum, or by the provider’s inclusion in the UK Extension to the EU–US Data Privacy Framework. We never sell your personal information.

5. How long we keep it

• Order, ticket and payment records: six years after the festival, to meet accounting and legal requirements.
• Reservations that never became an order, and email sign-ups: until you unsubscribe or 24 months after your last interaction with us, whichever is sooner.
• Enquiries and applications: 12 months after we last correspond, unless you are engaged or booked, in which case for the duration of the relationship and six years after.
• Gate scan and incident records: until the end of the following year’s festival, or longer where required for a claim or investigation.
• Ask Val questions: not retained by us beyond the session; our AI provider retains them only as needed to provide the service.

6. Your rights

You have the right to ask for a copy of the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to move it to another provider, and to withdraw consent at any time where we rely on consent. To exercise any of these rights email info@valleyfest.co.uk; we respond within one month and never charge for a reasonable request.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

7. Children

Tickets must be bought by adults. We do not knowingly collect personal information from anyone under 16 through the site; if you believe a child has provided us with information, contact us and we will delete it. Safeguarding information collected at the festival is handled under our safeguarding policy and shared only with those who need it.

8. Security

Personal information is stored on access-controlled systems, transmitted over encrypted connections and available only to staff who need it. Payment card data never touches our systems. No method of storage or transmission is completely secure, so we cannot guarantee absolute security, but we take reasonable technical and organisational steps to protect your data and will notify you and the ICO of any breach where the law requires.

9. Changes to this policy

We review this policy each year and whenever we introduce a new service that affects your information. The date at the top shows the current version.