Privacy Policy

1. Introduction

St Pauls Carnival (Bristol) Community Interest Company (“SPC”, “we”, “us” or “our”) collects and uses personal information about people who engage with our projects, events, programmes, services and activities. We use this information to understand our audiences and supporters, deliver our work, administer services and transactions, meet our legal and funding responsibilities, and communicate with people in ways that are appropriate to their preferences.

Your privacy is important to us. This Privacy Policy explains how we collect, use, store and protect personal information, the circumstances in which we may share it, and your rights under UK data protection law.

This policy should be read alongside any specific privacy information provided when we collect your information, and our Cookie Policy.

2. Who is responsible for your information?

St Pauls Carnival (Bristol) Community Interest Company is the organisation responsible for the personal information covered by this policy.

For privacy enquiries, requests or concerns, please contact:
Email: admin@stpaulscarnival.org.uk
Post: Data Protection, St Pauls Carnival, Malcolm X Community Centre, 141 City Road, BS2 8YH.

If you have concerns about how we use your information, you can also complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

3. Our approach to personal information

SPC uses digital systems and third-party software to collect and manage information, including information provided through sign-up forms, surveys, event registration and other services. SPC also has a Customer Relationship Management (CRM) system, which is not currently in active use.

We aim to be clear about why we collect information and will not use personal information in ways that are incompatible with the purposes explained to you, unless permitted by law. We take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

4. What information do we collect?

The information we collect depends on how you interact with SPC. It may include:

  • Name and contact details, such as email address, telephone number and postal address.

  • Information provided when you buy a ticket, register for an event, take part in a project, join a mailing list, make a donation, purchase a product or contact us.

  • Information about your participation in our projects and activities.

  • Age, ethnicity, gender, disability or other equality information where relevant to our work, monitoring, evaluation or funding requirements. Where such information is optional, we will make this clear when collecting it.

  • Communications and preferences, including how you would like us to contact you.

  • Information contained in feedback, surveys, consultations, case studies and other contributions.

  • Information required to administer donations, transactions, contracts, volunteering, employment or other relationships with SPC.

  • Information you provide through social media or other platforms, where appropriate and permitted by the relevant platform and your privacy settings.

We will only collect information that is relevant and proportionate to the purpose for which it is needed.

5. How do we collect information?

We may collect information directly from you, for example when you:

  • buy a ticket or register for an event;

  • participate in a project or programme;

  • join our mailing list;

  • make a donation;

  • purchase a product;

  • volunteer or work with us;

  • complete a survey or feedback form; or

  • communicate with us.

We may also receive information indirectly from organisations, consultants, independent event organisers or other groups working with SPC. Where another organisation collects information on our behalf, we remain responsible for ensuring that appropriate data protection arrangements are in place.

Where permitted by law, we may also obtain information from publicly available sources or from organisations where you have given permission for your information to be shared.

6. How do we use your personal information?

We may use personal information to:

  • provide services, products, events, projects or information you request;

  • administer donations, ticket purchases and other transactions;

  • manage registrations and participation;

  • maintain records of our relationship with you;

  • understand and manage your communication preferences;

  • improve our services, projects, events and programmes;

  • evaluate the reach and impact of our work;

  • meet funder, regulatory, legal and reporting requirements;

  • manage volunteers, contractors, partners and other working relationships;

  • maintain the security and proper operation of our systems and website;

  • respond to enquiries, complaints and requests; and

  • send marketing or fundraising communications where we have a lawful basis to do so.

We will not use your personal information for purposes that are incompatible with the purposes described to you or otherwise permitted by law.

7. Our lawful bases for processing

Under UK data protection law, we must have a lawful basis for processing personal information. Depending on the circumstances, SPC may rely on:

  • Consent – for example, where you choose to receive certain marketing communications or give explicit consent for a case study or other optional use of information.

  • Contract – where processing is necessary to provide a service, administer an agreement, ticket purchase or other contractual relationship.

  • Legal obligation – where we are required to process information to comply with the law.

  • Legitimate interests – where processing is necessary for our legitimate organisational interests and those interests are not overridden by your rights and interests. We will consider the impact on individuals before relying on this basis.

  • Vital interests – where necessary to protect someone's life or prevent serious harm, where applicable.

  • Public task – only where applicable to a specific activity and where SPC is exercising a relevant public function.

Where we rely on consent, you can withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

8. Direct marketing and communications

SPC operates an opt-in approach to marketing communications. We will only send marketing communications to you where we have a lawful basis to do so and, where consent is required, you have actively consented.

Marketing communications may include information about SPC projects, campaigns, events, fundraising, volunteering and other activities.

Our forms should make marketing preferences clear and our communications should explain how you can opt out. You can withdraw consent or change your communication preferences by contacting admin@stpaulscarnival.org.uk or by using the unsubscribe option provided in an email.

Even if you do not receive marketing communications, we may still need to contact you with important operational, contractual, legal or service-related information.

9. Sharing your information

We do not sell personal information to third parties for their own marketing purposes.

We may share personal information where necessary and lawful with:

  • service providers and data processors that provide systems or services to SPC;

  • event partners or named organisations involved in delivering a joint event or project, where this is necessary and lawful;

  • consultants, contractors and organisations working on our behalf;

  • professional advisers, insurers, auditors or other service providers where appropriate;

  • regulators, law enforcement bodies, courts or public authorities where required or permitted by law; and

  • funders or other organisations where reporting information is required and lawful.

Where another organisation processes personal information on our behalf, we will take appropriate steps to ensure that the organisation provides appropriate safeguards and only processes information in accordance with our instructions and applicable law.

Where you provide information directly to another organisation, you should also review that organisation’s privacy information.

10. Cookies and similar technologies

Our website and some of the services we use may use cookies and similar technologies. These technologies can include cookies, pixels, scripts, tags, local storage and other technologies that store or access information on your device.

Some technologies are strictly necessary for the website or a service to operate. Other technologies, such as analytics or marketing technologies, may require your consent before they are used.

Where consent is required, SPC will seek your consent before placing or accessing non-essential cookies or similar technologies. You should be given a genuine choice to accept or reject non-essential technologies and should be able to change your preferences later.

Our Cookie Policy explains the technologies used on the website, their purposes, the organisations that provide them, their duration where applicable, and how you can manage your choices.

We will not treat continued browsing or use of the website as consent where consent is required.

11. Sensitive and special category information

Some of the information we collect may be special category personal data under UK data protection law, such as information concerning ethnicity, health or disability, where relevant to our work.

We will only collect or use special category data where there is a lawful basis under UK GDPR and an additional condition for processing special category data where required. Where information is optional, we will make this clear and will not require you to provide it unless there is a lawful reason to do so.

We take particular care with this information and limit access and use to what is necessary.

12. Case studies, photography and stories

Some people choose to share their experiences and stories with SPC to help us develop and promote our work. This may include information about personal experiences and, where relevant, special category information.

Where we intend to make a person's story, image or personal information public for promotional, campaigning, fundraising or reporting purposes, we will obtain appropriate consent or rely on another lawful basis where permitted. Where explicit consent is required, we will seek explicit and informed consent.

For people under 18, we will obtain appropriate consent from a parent or guardian where required and will take account of the child’s age, understanding and best interests.

13. Children and young people

SPC delivers activities involving children and young people. We take particular care when collecting and using information about children.

We will collect only information that is necessary for the relevant activity, safeguarding, administration, evaluation or other lawful purpose. Where consent is required, we will use appropriate consent arrangements for the age and circumstances of the child or young person.

Specific information about photography, filming, case studies, communications or other optional uses will be provided when relevant.

14. How long do we keep information?

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, contractual, safeguarding, funding and reporting requirements.

Different categories of information may therefore be kept for different periods. When information is no longer required, we will securely delete it or anonymise it where appropriate.

Where you withdraw consent for marketing, we may retain limited information necessary to record your preference and ensure that we do not send you unwanted marketing communications.

15. Keeping your information secure

We take appropriate technical and organisational measures to protect personal information. These may include access controls, secure systems, password protection, staff guidance, confidentiality requirements, backups and procedures for responding to data incidents.

No method of transmission or storage is completely secure, but we work to reduce the risk of unauthorised access, loss, alteration or disclosure.

16. Your data protection rights

Depending on the circumstances and subject to legal exceptions, you have rights under UK data protection law including:

  • the right to be informed about how your information is used;

  • the right to request access to personal information we hold about you;

  • the right to ask us to correct inaccurate or incomplete information;

  • the right to ask us to delete information in certain circumstances;

  • the right to ask us to restrict processing in certain circumstances;

  • the right to object to certain processing, including direct marketing;

  • the right to withdraw consent where we rely on consent;

  • the right to data portability in certain circumstances; and

  • rights relating to automated decision-making and profiling where applicable.

To exercise your rights, contact admin@stpaulscarnival.org.uk. We may need to verify your identity before responding to a request.

There is normally no charge for exercising your data protection rights. We may charge a reasonable fee or refuse a request where permitted by law, for example where a request is manifestly unfounded or excessive.

We aim to respond to valid requests within the time required by applicable data protection law.

17. International transfers

Some of our service providers may process personal information outside the UK. Where this occurs, SPC will take appropriate steps to ensure that any international transfer is carried out in accordance with UK data protection law and that appropriate safeguards are in place where required.

Further information about relevant providers and transfer safeguards can be requested from SPC where appropriate.

18. Complaints

If you have a concern about how SPC has used your personal information, please contact us first at admin@stpaulscarnival.org.uk so that we can investigate and try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO). The ICO’s website provides information about making a data protection complaint: https://ico.org.uk/make-a-complaint/

19. Keeping your information up to date

Please let us know if your contact details or other information we hold about you changes. You can contact us at admin@stpaulscarnival.org.uk.

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our activities, technology, legal requirements or how we process personal information.

If we make significant changes, we will make the updated policy clear on our website and, where appropriate, notify people directly.

Last updated: August 2026