Who we are

Niels Bonnet, organising events as Cornwall TCG & Collectibles, is responsible for how we use your personal information. Business correspondence address: The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, England. For privacy questions or requests, email info@cornwalltcgcollectibles.co.uk.

Tickets and admission

When tickets go on sale, Stripe will process your payment. We’ll receive booking details such as your name, email, purchase time, ticket quantities and payment status. We use these to issue your QR tickets and entry codes, send your confirmation email and check you in at the event. Signed-in door staff can look up a booking using its email, or its name with an email or booking reference, and see the booking name, ticket types and check-in status.

We use booking information to take steps you request before entering a contract and to fulfil it. We rely on our legitimate interests in preventing duplicate admission and understanding demand when we use check-in and sales records for those purposes. We use records to meet legal obligations where applicable.

You can skip the town or city question. If you answer it, we use it under our legitimate interest in understanding where attendees come from. It is attached to the Stripe booking and used to show ticket counts by town in the organiser dashboard.

Show updates

We use your email address and subscription preferences to send show updates you sign up for, based on your consent. You can withdraw consent at any time through the unsubscribe link or by contacting us. We keep your signup while you are subscribed and remove it from our active website list when you unsubscribe. We keep signup time and the version of the signup wording as evidence of consent. When you unsubscribe, you are removed from the active mailing list; we retain a minimal suppression record (email, opt-out time and preference/consent evidence) to honour your objection and prevent accidental marketing. This is used to meet our legal obligations, not to send marketing. We keep it while operating the mailing list and review its necessity if that purpose ends. If you sign up again after opting out, we send a confirmation link valid for 24 hours. You remain unsubscribed until you open that link and confirm. We record the confirmation time and wording version as evidence of your renewed consent. Resend also retains contact preferences and delivery records under its own retention arrangements.

Vendor applications and sponsorship enquiries

We use your contact and business details, uploaded vendor logo, public liability insurance status/cover, staffing and setup needs, optional vendor recommendations, sponsorship interests, proposed promotion and messages you submit to assess your application or enquiry, reply to you and arrange bookings or sponsorships. We rely on steps you request before entering a contract and on fulfilling any agreement where you are the contracting person. For business contacts and general enquiries, we rely on our legitimate interest in organising shows and responding to enquiries. The Vendor Privacy Notice on the application form has more detail about vendor information and publicity.

The vendor correspondence address is optional. With your separate, unticked permission, we use it to post free event flyers, relying on your consent. You can withdraw permission by contacting us. It is not required to apply and is not a newsletter signup. The address and permission record follow the six-month vendor application retention period.

Optional vendor recommendations should contain business names or public links, not private contact details. We use them under our legitimate interests in finding suitable traders and planning shows, and retain them with the application. A recommendation is not permission to add another person to a mailing list.

Setup and accessibility requests

Please provide only the practical support needed, not diagnoses or medical documents. The vendor form asks for separate explicit consent where a request could reveal health or disability information, in addition to our contract or legitimate-interests basis for arranging the booking. These requests are restricted to those arranging support, not used for publicity, and excluded from new organiser alert emails. You can withdraw consent by contacting us; we will stop that consent-based use and remove the information unless another lawful ground requires retention. This does not withdraw the rest of your application, although we may need another way to arrange support.

Who handles your information

ChatGPT Sites hosts the website, forms and organiser dashboard. Cloudflare hosts the ticketing and check-in service. Stripe processes checkout payments and related booking information. Resend sends ticket confirmations, form replies and organiser alerts, and manages show updates. Vendor application details and logos can be included in organiser alerts, except new setup/accessibility request text. IONOS and your chosen mailbox providers handle delivered correspondence; those copies are separate from website records. Authorised staff access booking information as needed for admission. We may also disclose information when legally required.

Our providers may process information outside the UK, including in the United States. Resend states that it stores customer data in the US, even when email is sent from an EU region. Its DPA incorporates standard contractual clauses with the UK Addendum; it also describes the UK Extension to the Data Privacy Framework. OpenAI’s ChatGPT Sites DPA and Cloudflare’s customer DPA provide UK Addendum safeguards for relevant restricted transfers; Stripe’s DPA and Data Transfers Addendum describe its applicable transfer mechanisms. You can read the ChatGPT Sites DPA, Cloudflare DPA, Resend DPA and Stripe DPA, or contact us for a copy or explanation of the safeguards relevant to your data.

Cookies and external links

Remembering your ticket basket. When you select tickets, we use local storage on your browser to remember the ticket types and quantities for 15 minutes after your last quantity change. This lets you read our policies, return to checkout or refresh without losing your selections. This storage contains only ticket quantities and an expiry time, not your name, email, payment details or agreement to the booking terms. It is used only to provide the basket feature you requested, not for advertising or analytics. It works on the same browser with storage enabled and does not reserve tickets. After 15 minutes the saved basket is no longer restored; expired data is cleared while the ticket page is open or when you next return to it. You can also remove it through your browser’s site-data settings. We treat this basket storage as strictly necessary and do not request separate cookie consent for it.

Site hosting and staff sign-in can use essential cookies or similar technology for access, security and keeping you signed in. The Trustpilot review button opens Trustpilot. Its logo is served with this site, and Trustpilot applies its own privacy and cookie terms when you follow the link. Other external sites apply their own notices when you visit them.

How long we keep information

Vendor applications: application records and uploaded logo files expire six calendar months after submission, including archived records. The website deletes expired records during site visits and the daily maintenance check. Separate confirmed booking, payment and published directory records have their own purposes and are not deleted with the application.

Sponsorship enquiries: dashboard enquiry records expire twelve calendar months after submission and are deleted by the same cleanup. Where a sponsorship proceeds, necessary agreement, payment and fulfilment records are kept separately for the contract, accounting and dispute purposes below.

Tickets, check-in and contracts: QR/entry codes, attendance status and optional town information are needed through the event and any outstanding admission, refund, fraud or dispute investigation. We review these after each show and remove or anonymise operational details once those matters are concluded. Keep only the booking/contract evidence needed for remaining claims or legal obligations, rather than the full operational record. Necessary business accounting records are kept for the applicable tax-record period; for a sole trader this is normally at least five years after the 31 January filing deadline for the relevant tax year. Records needed for a specific unresolved claim are reviewed when it is resolved.

Emails, downloads and backups: delivered organiser application/enquiry alerts and attachments need a separate retention review, at six months for vendor applications and twelve months for sponsorship enquiries, unless particular information is needed in a separate contract record or unresolved claim. Deleting a website record does not erase mailbox copies. Resend states that sent email and log data is retained for 30 days on Free, Pro and Scale plans; Enterprise terms can differ. Its contact preferences are separate from sent-email logs. Hosting/mailbox backups follow the provider’s expiry cycle and may not disappear immediately; if restored, expired records must be removed again before normal use.

Event photographs and giveaway winners

We publish event photographs and giveaway winner photographs on our website and social media to celebrate our shows and share them with the community. We use the permission given by the adults pictured, or by a parent or guardian for children, as our consent basis. Where we publish a winner’s name, we seek permission for that too. Permission is voluntary and you can withdraw it by emailing info@cornwalltcgcollectibles.co.uk, identifying the photograph or post.

We keep photographs while they remain relevant to our event history and promotion, review their continued use annually, and remove them from our website and social media accounts when consent is withdrawn. We retain only the permission evidence needed to demonstrate lawful use or deal with an outstanding complaint. Public posts can be viewed internationally and copied or shared by others; we cannot guarantee removal of copies outside our control. Social media platforms also process information under their own privacy notices.

Data protection complaints

If you are unhappy with how we have used your personal information, please contact Niels Bonnet at info@cornwalltcgcollectibles.co.uk or write to our business correspondence address above. Tell us what happened and how we can contact you. You do not need to use a special form or legal wording.

We acknowledge data protection complaints within 30 days of receiving them. We investigate without undue delay, keep you informed of progress and explain the outcome and any action taken. We keep a restricted record of the complaint and our response while needed to resolve it and demonstrate how it was handled, reviewing retention when the matter is closed. You can also complain to the Information Commissioner’s Office.

Your rights

You can object at any time to direct marketing. For other processing based on legitimate interests, you can object on grounds relating to your particular situation. Contact us using the email above.

Depending on the circumstances, you can ask to access, correct, erase, restrict or receive a portable copy of your information. You can object where we rely on legitimate interests and withdraw consent where we rely on it. Contact us at the email above. You can also complain to the Information Commissioner’s Office.