Privacy policy

1Who we are

EP-Activations Limited ("EP Activations", "we", "us") is a company registered in England and Wales, company number 17397206. Our registered office is Kings Works, Kings Road, Teddington, Middlesex, TW11 0QB.

We are the controller of the personal data described in this policy. That means we decide how and why it is used, and we are responsible for it. We are registered with the Information Commissioner’s Office (ICO), registration number [ICO REGISTRATION NUMBER].

Contact us about your data at [email protected], through our Your data page, or by post to the address above, marked "Data protection". Our data protection lead is [NAME]. The law does not require an organisation like ours to appoint a Data Protection Officer, so [NAME] is responsible for how we handle personal data.

2Who this policy covers

This policy applies to you if you:

• register for, enter a ballot for, claim a ticket for or attend one of our activations
• appear in photos or video we take at an activation
• use technology at an activation, such as a screen, booth or QR code
• visit this website or contact us
• work with us, for example as part of an artist’s team, a brand, a venue, a supplier or a freelancer

Activations with partners

Many activations are presented with partners, such as an artist, a media partner or a brand sponsor. We remain the controller of your registration. A partner only becomes responsible for your details if you choose to share them with that partner (see section 6).

Sign-ups we run for another organisation

Sometimes a brand or venue asks us to run a sign-up in its own name. In that case it is the controller, and we act on its instructions as its processor. The sign-up page will name that organisation and link to its privacy notice, and its notice applies instead of this one.

3What we collect

When you register or enter a ballot

Your first and last name, email address, mobile number, postcode and date of birth. Any access code a community group or invitation gave you. Your answers to any optional questions on the form. Your marketing choices, with the date, time, page and wording you saw. Technical details of the submission, such as your IP address and device type, which our form provider records to stop fraud and to prove what you agreed to.

About your ticket

Your ticket number and type (public ballot, community allocation or VIP), your ballot result, whether and when you claimed your ticket, and when it was scanned at entry. If you add your ticket to Apple Wallet or Google Wallet, the pass is held by Apple or Google on your device and account. We can see that a pass was issued and can update it, for example if a time changes. We cannot see your Apple or Google account.

At the activation

Staff check photo ID by eye at the entrance. We do not photograph, scan or keep your ID. If a venue’s licence requires ID scanning, we will say so on the sign-up page and at the entrance, and the venue’s privacy notice will explain how that data is handled. If you are involved in an incident, need first aid, or are refused entry or asked to leave, we record what happened, which may include your name, a description and your contact details. If you tell us about a disability or access need so we can help, we use that information only to arrange the help.

CCTV

Venues and public spaces may have CCTV run by the venue owner or local authority. They control that footage, and their own notices apply.

Photos, video and activation technology

See section 9 and section 10.

When you visit this website

Our host automatically logs technical information, such as your IP address, browser type and the pages requested, to run and secure the site. This website does not use cookies, analytics or advertising tags. See our cookie policy.

When you contact us

Your name, contact details and anything you tell us, whether by email, form, phone or social media. If you send us a project brief, we also collect your company, role, budget range, timing and location.

If you work with us

Your name, role, organisation and work contact details, and the contract, payment and invoice details we need to work together.

From other people

An artist’s team, brand partner or community group may give us your name and email so we can invite you, for example to a VIP or community guest list. When we contact you, we will tell you who passed us your details.

We do not use facial recognition and we do not collect biometric data. The only sensitive information we hold is access needs you choose to tell us about, and details recorded after a first aid or safety incident.

4How we use it and why

Data protection law requires a lawful basis for each use of your data. This table sets out each purpose, the data involved and the basis we rely on.

Where we rely on legitimate interests, we have weighed our interests against yours. You can ask for a copy of that assessment, and you can object at any time (see section 12).

The ballot draw is made at random by software, and it does not use your personal data to choose winners. Automated checks remove duplicate entries. If you think your entry was removed by mistake, tell us and a person will review it.

5Messages we send you

Essential messages

If you register, we will email and text you about that event: your ballot result, your ticket, and anything that changes, such as timings, entry information or a cancellation. These are not marketing. They stop after the event.

Marketing from us

• We only send marketing by email or text if you ticked the box for it. The box is never ticked for you.
• Not ticking it has no effect on your ticket or your chances in a ballot.
• Every marketing email has an unsubscribe link, and every marketing text tells you how to opt out. You can also ask us on our Your data page.
• Our email provider tells us whether a marketing email was opened and which links were clicked. We use this only to see which messages are useful, and to stop emailing people who never open them.
• When you opt out, we keep your email address or mobile number on a do-not-contact list so we never message you again by mistake.

6Sharing with partners

Some sign-up pages let you hear from the artist, media partner or brand behind an activation. This is how that works:

• Each partner has its own box, with its name on it. We never use wording like "selected third parties".
• We share only the details named beside the box, usually your name and email address.
• We share them after the ballot closes or the event ends, and we keep a record of what we shared, with whom and when.
• Once a partner has your details, it is responsible for them and its own privacy notice applies. We link to it from the sign-up page.
• To stop hearing from a partner, use the unsubscribe link in its messages or contact it directly. Tell us too, and we will not share your details with that partner again. If we have not shared them yet, we will not.
• Partners do not get access to our systems or our audience list. Any audience reports we give them contain totals only.

7Service providers

These organisations help us run our activations and this website. They act on our instructions under written contracts and cannot use your data for their own purposes.

If you add your ticket to a wallet, Apple or Google stores the pass under its own terms and privacy policy, as a separate controller.

Venues see the names on guest lists and tickets at entry, and handle their own CCTV and licensing records.

We share information with the police, local authorities or other public bodies only where the law requires it, or where it is needed to prevent harm to someone.

If EP Activations is sold or restructured, personal data may pass to the new owner, who must continue to protect it in line with this policy.

8International transfers

Brevo stores our data in the European Union. UK law recognises the EU as giving an adequate level of protection.

Netlify is based in the United States. Transfers to Netlify rely on the UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Agreement as a backup if that framework stops applying.

You can ask us for a copy of these safeguards.

9Photos and video

• We photograph and film our activations. The footage appears on our website and social media, and on our partners' channels and in their reports.
• Signs at the entrance tell you filming is taking place.
• Crowd shots rely on our legitimate interests. If we want to film you close up or interview you, we ask first, and if you agree we ask you to sign a release.
• If you would rather not be filmed, tell a steward or the camera crew and we will keep you out of close-up shots.
• If you see yourself in something we have published and want it removed, send us the link or a screenshot. We will take it down from our channels and ask our partners to do the same.
• Raw footage we do not use is deleted within 24 months of the event.

10Technology at activations

Some activations use technology such as QR codes, NFC tags, photo or video booths, augmented reality filters, interactive screens, competitions or public Wi-Fi.

• Using any of it is optional. You never need it to attend.
• If a piece of technology collects personal data, a sign or screen beside it will say what it collects, why, who sees it and how long it is kept, and link to this policy.
• People counters count people. They do not identify anyone.
• We do not use facial recognition, emotion detection or any other biometric identification.

11How long we keep it

We keep personal data only as long as we need it, then delete it or anonymise it so it no longer identifies anyone. Anonymised totals, such as the share of attendees who travelled under five miles, may be kept.

12Your rights

You have the right to:

• Access: get a copy of the personal data we hold about you
• Rectification: have anything wrong corrected
• Erasure: have your data deleted
• Restriction: ask us to limit how we use your data
• Objection: object to uses based on legitimate interests, including filming. You can object to direct marketing at any time, for any reason, and we will stop.
• Portability: get data you gave us in a format you can take elsewhere
• Withdraw consent: change your mind about anything you agreed to, at any time
• Human review: not be subject to decisions made only by automated means that significantly affect you

To use any of these rights, use the form on our Your data page, email [email protected], write to us, or tell any member of our team. It is free. We will reply within one month. If your request is complex, we may extend this by up to two further months, and we will tell you why within the first month. We may ask you to confirm your identity, and we will ask for no more than we need.

13Complaints

If you are unhappy with how we have handled your data, please tell us first. You can use the form on our Your data page, email [email protected], write to us, or raise it with us any other way, including on social media.

We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

14Under-18s

Most of our activations are for people aged 18 and over. Our sign-up forms do not accept a date of birth showing you are under 18 for those events. If we find we hold details of someone under 18 for an 18+ event, we delete them and remove them from any list.

Where an activation is open to under-18s, its sign-up page will explain how we handle their details. We do not collect details of children under 13 without a parent or guardian’s consent.

15Security

• Our website and forms use encrypted connections.
• Every account that holds personal data is protected by two-step login.
• Access is limited to the people who need it for an event.
• We do not keep audience lists in spreadsheets on personal devices. Any export is deleted once it has been used.
• Staff and contractors who handle personal data are bound by confidentiality.

If a data breach is likely to put you at high risk, we will tell you without undue delay. Where the law requires it, we will report a breach to the ICO within 72 hours.

16Changes to this policy

The version number and date at the top show when this policy last changed. If we make a significant change, we will email the people whose data we hold and show the change on our sign-up pages.