Privacy

Published version 1. Updated 01/10/2026.

Who is responsible Desi Divas is responsible for personal information used to organise this event. Desi Divas is an unregistered charity. Contact privacy@desidivas.org.uk for privacy questions, rights requests or complaints. Address for legal notices: 120 Dugdale Hill Lane, Potters Bar, EN6 2DJ, United Kingdom. Alternative contact: write to Desi Divas at the organisation correspondence address shown in the Privacy notice, marking your envelope General enquiries, Accessibility, Privacy or Safeguarding as appropriate. Include a safe way for the responsible organiser to reply. Postal correspondence is not suitable for urgent concerns. This notice applies to the 2026 event, booking service and contact inbox.

What we use and why We use purchaser contact details, named guest admissions, age bands, booking references, payments, refunds and attendance records to provide and support bookings. We rely on the booking contract for purchaser information, and our legitimate interests in delivering safe named admission for guest and attendance information, taking particular care with children's information. The minimum purchaser contact information, guest names and age bands are required to complete a named booking; without them we cannot issue the booking. If someone books for you, they provide your admission details and should share this notice with you. An optional waiting-list entry is used to respond to your request for availability, not to subscribe you to marketing. Financial records are retained where required by applicable legal obligations. Restricted staff identities and audit records support secure administration, fraud prevention and accountability on the basis of our legitimate interests. We do not request card numbers or security codes: card details are entered on Stripe's hosted payment page.

Contact enquiries When Contact Us is open, we collect your name, reply email, topic and message to handle general, ticket, volunteering or partnership enquiries. We rely on our legitimate interests in answering enquiries and providing support. Only authorised owners and event managers can read the private inbox. General enquiries are kept for up to 90 days from submission and then deleted; changing a message's status does not extend this period. We do not use an enquiry to subscribe you to marketing. Do not include medical information, safeguarding concerns, payment-card details or private ticket links. Use the separate privacy or safeguarding route for confidential requests.

Organisation mailboxes Emails sent to our published organisation addresses are received and answered through the protected website inbox. We keep the sender and recipient addresses, subject, plain-text message, receipt time, staff replies and delivery status so we can handle the correspondence. General, ticket and accessibility correspondence is available only to authorised owners and event managers; privacy correspondence requires the privacy role and safeguarding correspondence requires the safeguarding role. General administrator access alone does not grant either restricted role. Privacy rights requests are handled to meet our data-protection duties. Safeguarding correspondence is assessed by the responsible organiser using the lawful basis and any additional sensitive-data condition appropriate to the particular concern; we request only information needed to respond safely. Do not send attachments or payment-card details. The inbox accepts plain-text email up to 256 KiB; unsupported messages are rejected with instructions to resend. This is not an emergency service.

Optional requirements Dietary/allergy and accessibility details are optional and use separate, explicit consent for their respective purposes, including health or other sensitive information they may reveal. Each attendee can supply their own requirements through a private link. The form requires parent or guardian authority when submitting for someone under 18. You can withdraw a consent through that link or contact privacy@desidivas.org.uk; withdrawal does not make earlier lawful processing unlawful. Catering staff see only the requirements needed for meal planning; accessibility information has its own restricted role. Submitting a request does not confirm that it can be met.

Recipients and protection Cloudflare provides hosting, storage, security and transactional email infrastructure; Stripe processes payments. Authorised organisers, finance, catering and door staff receive only the information their roles require. Necessary meal information is shared with the catering team to review your request. Private links must be kept secure. Safeguarding reports are handled separately and must not be put in booking comments or general support forms.

Cloudflare and Stripe operate internationally, so processing may take place outside the UK, including in the United States and other countries described in their published policies. Cloudflare's data-processing terms describe its transfer safeguards, including the UK extension to the Data Privacy Framework where applicable and contractual safeguards for restricted transfers: https://www.cloudflare.com/cloudflare-customer-dpa/. Stripe's UK privacy notice explains its international processing, adequacy arrangements and standard contractual clauses with the UK addendum: https://stripe.com/gb/privacy. Those provider notices explain their own processing and how to obtain further information about safeguards. You can also contact our privacy route for information about the arrangements for this event. We do not promise that every part of hosting, security, support or payment processing stays in the UK or EU.

Retention General website enquiries and general email correspondence stop being available in the inbox after 90 days from receipt and are removed by scheduled maintenance. Privacy and safeguarding inbox correspondence is kept for up to 365 days from receipt, restricted to the respective responsible role. Replies and status changes do not extend those periods. These inboxes are correspondence channels, not permanent case files: before expiry, any continuing legal or safeguarding need requires a separate restricted case record and a documented retention decision. Expired, failed or cancelled unpaid checkout names and contact details become eligible for removal after 24 hours; stale unpaid checkouts without an active reservation are cleared after 30 days.

Dietary/allergy and accessibility requirements and waiting-list records are deleted through scheduled maintenance from 30 days after the event. Valid withdrawal requests remove the relevant requirements earlier. From 90 days after the event, purchaser and attendee names, purchaser email addresses and private ticket-management links are removed from the ticket ledger, and detailed check-in records are deleted after totals are recorded. Restricted transaction and refund references can still identify a payment through the payment provider; we do not describe those remaining records as anonymous.

Financial transaction and refund evidence is flagged for owner and finance review six years after the event. It is not automatically erased at that point: those roles decide the applicable accounting or legal requirement, record any continuing need and arrange controlled disposal when that need ends. Staff access and audit records, delivery records and email-suppression identifiers are reviewed annually and when access or delivery arrangements change. They are kept only while needed for current access, transaction accountability, preventing failed or unwanted email, or a documented investigation.

The owner is responsible for checking scheduled deletion and arranging manual reviews with the privacy and finance roles. Records needed for a specific complaint, safeguarding concern or legal claim are handled separately with restricted access and a documented retention decision. Recovery copies may remain until their normal backup period expires; a recovery must reapply the relevant deletion decisions before returning data to ordinary use.

Your choices and rights Depending on the purpose and legal basis, you may request access, correction, deletion, restriction or portability of your data. You have the right to object to processing based on our legitimate interests, including handling enquiries, staff administration and security. Contact privacy@desidivas.org.uk; you may also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We will explain any legal reason that prevents us fulfilling a request.

Essential browser storage and security The booking return uses browser session storage to retain the private recovery token for that booking. Cloudflare Turnstile protects public submissions and Cloudflare Access protects staff sign-in. Hosting, fraud prevention and payment services process technical information such as request, browser and security-event data to operate and protect the service. Stripe explains its payment-page technologies in its own notice. Blocking JavaScript or necessary storage can prevent online booking, recovery or form submission; use the assistance route above if that affects you. There is no advertising or analytics tracking in this release, and we do not sell personal information. Essential technologies are not used for marketing. No decision with a legal or similarly significant effect is made solely by automated profiling.