This policy explains how The Grange Festival (charity number 1165859 and company number 09828929) collects and uses your personal information.

Our details

We are the data controller with conduct of your personal information.

You can contact us by post to: Folly Hill Farm, Itchen Stoke, Alresford, Hampshire, SO24 9TF.

You can also contact us by email to: info@thegrangefestival.co.uk.

How we use your personal information

The following table explains how we use your personal information. Different sections apply depending on your relationship to us. Please read each section carefully as more than one section may apply.

Situation	Types of information	Purpose and lawful basis for processing
Website visitors
We monitor how users interact with our website through the use of cookies.	IP address, approximate location.	We set the cookies and process any personal data captured by them based on your consent.
Audience members and visitors
You or your organisation purchases goods or services (including tickets for events) from us.	Name, contact information, job title, payment details, details of the goods/services purchased.	If the contract is with you, the processing is necessary for us to perform our obligations under the contract. If the contract is with your organisation then we have a legitimate interest in processing your personal information for the purpose of managing the contractual relationship between your organisation and us. We have a legitimate interest in keeping a record of the contract between us (or your organisation and us) for the administration of our charity operations and to address any disputes which may arise between us (or your organisation and us).
You come to one of our education or outreach programmes.	Name, contact information.	We have a legitimate interest in registering participants, managing safeguarding requirements, coordinating delivery, and assessing engagement and impact.
We take photos at our events which may include you.	Appearance, location.	We have a legitimate interest in taking photos to promote the charity’s activities and events.
We send you marketing communications regarding our products and services.	Name, contact information, marketing preferences.	We send you marketing communications based on your consent.
We anonymise data to identify trends and patterns about the people who engage with our programming.	Name, age, address, events attended.	We have a legitimate interest in learning more about our audiences to tailor and improve the events we run. Once the information is anonymised, it is no longer covered by UK GDPR.
Children and those with parental responsibility
You or your child participate in or attend our events.	Child’s name, name and contact information of person with parental responsibility.	Where we ask for the child, or responsible adult’s consent, the information is processed based on that consent. Otherwise, we have a legitimate interest in processing the information in order to run the event and to follow safeguarding rules.
Suppliers (including creative artists)
You or your organisation supplies goods or services to us.	Name, contact information, job title, payment details, details of the goods/services supplied.	If the contract is with you, the processing is necessary for us to perform our obligations under the contract. If the contract is with your organisation then we have a legitimate interest in processing your personal information for the purpose of managing the contractual relationship between your organisation and us. We have a legitimate interest in keeping a record of the contract between us (or your organisation and us) for the administration of our charity operations and to address any disputes which may arise between us.
Members
You are engaged in our membership, philanthropy or fundraising activities.	Name, contact information, payment details.	We have a legitimate interest in managing memberships and benefits, processing donations, stewarding supporters and maintaining Gift Aid records. If you pay to become a member then we process your information in order to perform the contract to provide you with your membership benefits.
Donors and supporters, prospective donors and supporters
We carry out fundraising research and screening on our existing donors and supporters.	Name, email address and other contact information you have provided to us, engagement history (including donation amounts), and where relevant publicly available information about roles, affiliations and charitable interests and giving, and an indication of capacity to give (for example a wealth band).	We have a legitimate interest in ensuring our fundraising is relevant and proportionate, helping us engage appropriately with supporters who may wish to hear about opportunities to support our charitable work.
We carry out fundraising research and screening on prospective donors and supporters based on information we obtain from someone else. This includes public registers and information shared with us by our fundraising consultants. We will contact you to tell you if we have obtained your personal information from someone else for this purpose.	Name, publicly available contact information, information about roles and affiliations, and publicly available information about charitable interests, giving and an indication of capacity to give (for example a wealth band).	We have a legitimate interest in identifying individuals who may wish to make a significant contribution to support our charitable activities. This research is limited and designed to reduce unsolicited or irrelevant fundraising approaches by helping us engage appropriately with individuals who may have an interest in supporting our charitable work You can opt out of us using your information in this way at any time by contacting us.
Attendees and suppliers (including prospective attendees and suppliers)
You send us an enquiry regarding our events.	Name, contact information, details of your enquiry.	We have a legitimate interest in responding to your enquiry. We process your information to carry out pre-contractual steps relating to a potential contract between us. We have a legitimate interest in keeping a record of your request as well as our response. This helps us efficiently operate our charity and prevent fraud.
All of the above categories of people
We maintain records for regulatory compliance.	Name, contact information, payment details.	We have a legitimate interest in keeping records for legal compliance and for the proper administration of our charity.

How long we keep your information for

We only keep your information for so long as is reasonably necessary. Generally speaking, we keep your personal information for the following periods of time:

• Ticketing, customer relationship management and booking history - up to 7 years after last transaction.

• Membership and donation records – retained for 7 years after last donation or membership activity.

• Philanthropic stewardship records – retained for as long as necessary to support continued donor relations, unless you request deletion.

• Fundraising research data (not covered by the above) - 2 years from when we collected your information if we did not use your information to discuss further opportunities to support the charity. Otherwise, 2 years from our most recent interaction with you.

• Education programme data – retained for 7 years after programme delivery.

• Suppliers and staff of suppliers - the duration of the supplier contract plus 7 years.

Who is your information shared with?

We share your personal information with third parties only where we are required to do so to comply with the law, to protect our rights, to perform our contractual obligations or to efficiently operate our charity. In order to achieve these purposes, we share your data with the following people or group of people:

• If you are an employee or representative of a customer or supplier of ours then we may share your information with your employer and colleagues for the purpose of managing the relationship between your organisation and us.

• Our outsourced service providers. These organisations have strict contractual obligations to handle your information in accordance with data protection law and to keep it confidential at all times.

• Our professional advisers (including accountants and lawyers). These people are subject to professional duties of confidentiality.

• In the event of a prospective charity merger, we may give the other charity access to redacted information about our customers, members, suppliers and their staff/representatives. Before we share this information the charity, they would sign a Confidentiality Agreement which protects your personal information.

If the recipient of your information is based outside of the UK and is not based in a country which offers equivalent protections for personal data then your data will be safeguarded by a set of standard contractual clauses.

Your rights

You have the following rights:

• The right to be informed about what we do with your information. This policy provides you with this information.

• If we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by notifying us using the details set out at the start of this policy. Consent to marketing communications can be withdrawn by following the steps outlined in that communication, such as clicking the ‘unsubscribe’ link in the marketing emails we send.

• The right to access a copy of your information which we hold. This is called a ‘data subject access request’. Additional details on how to exercise this right are set out in the ‘Access to Information’ section below.

• The right to prevent us processing your information for direct marketing purposes. This includes where we carry out fundraising research using your data. You can exercise your right to prevent such processing by contacting us using the details set out at the start of this policy or in our messages to you.

• The right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing.

• The right to object to us processing your personal information in certain other situations.

• The right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate.

• The right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law.

• The right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.

You have the general right to complain to us in the first instance if you are not happy with how we are processing your personal information. If you are not satisfied by our response then you can complain to the Information Commission (IC) via www.ico.org.uk.

Access to information

You can exercise your right of access by making a written request to receive copies of some of the information we hold on you. We may need to request proof of your identity, or proof of your authority (if making the request on behalf of someone else), before we can supply the information to you. Requests should be sent to us using the contact details set out at the start of this policy.

You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are entitled to refuse to comply with your request.

In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form.

Changes to our Privacy Policy

This policy was last updated on 5 February 2026. Any changes we may make to our privacy policy will be uploaded to our website and if the change is significant then we will tell you about it by email.

THE GRANGE FESTIVAL PRIVACY POLICY

The Grange Festival is a registered charity (No. 1165859) and this privacy policy explains how we use any personal information that we collect about you. We are strongly committed to protecting your privacy and ensure it is stored in accordance with the with the Data Protection Act (1998), the Privacy and Electronic Communication Regulations (2003) and as of the 25th May 2018, the EU General Data Protection Regulations (GDPR) (EU 2016/679).

Your Consent

When you provide personal information as defined by the General Data Protection Regulations (GDPR) (EU 2016/679) you consent to us using this information for booking processes, service improvement and for marketing and communication purposes.

How we use the information

When you sign-up to our newsletter, create an account or join The Grange Festival as a Founder or Friend, we collect personal information that enables us to process your bookings, manage your account, accept donations and send you information about events and offers we think may be of interest to you. We also use your information to improve our customer service and to advance the charitable aims of The Festival.

We adhere to the General Data Protection Regulations (GDPR) (EU 2016/679) and the Privacy and Electronic Communications Regulations (PECR) in our treatment of your personal data and also in our marketing communications with you. Your information is only used for marketing purposes with your prior consent and you can withdraw this consent at anytime using the contact details at the bottom of this page.

We do not share or sell your information to any third parties for marketing purposes. There are a number of external organisations and contractors who provide services on our behalf and we will only share your information with them as and when it is relevant to the services you require e.g our catering company.

Security

The Grange Festival take all reasonable precautions to ensure the security of your personal information. We are committed to protecting your data from misuse, loss or unauthorised access. There is always a risk associated with any internet use and therefore we cannot guarantee any information transferred by you via the internet. In this regard it is important that you do not share or reveal your account username or password with others.

All online transactions are processed through a secure server which encrypts personal data. Our booking and donation service is supplied by Spektrix Ltd who are PCI Security Standards Council Level 1 compliant.

The Grange Festival does not itself store your credit or debit card account information. Our contracts with third parties that receive your credit or debit account information require them to keep it secure and confidential.

Access to your information

You have the right to request a copy of the information that we hold about you and, in accordance with the General Data Protection Regulations (GDPR) (EU 2016/679), we will provide this information within 40 days of any request. To provide the best service to you it is essential that your information is accurate and up-to-date. You may ask us at any time to correct or remove any personal information that we hold about you.

Other websites

The Grange Festival website contains links which take you to external sites. This privacy policy does not extend to any external sites and we recommend visiting the relevant privacy policy if there are any concerns. We will take every precaution necessary to only link to safe and relevant external websites, however we cannot permanently guarantee the safety of these sites and users click on external links at their own risk.

Changes to the Privacy Policy

The Grange Festival privacy policy is constantly under review and we will update any changes here and on all relevant pages on our website. This Privacy Policy was last updated on 22nd May 2018.

Contact Us

If you wish to make any alterations to your marketing preferences or would like any further information about our privacy policy please write to us at the following address:

The Grange Festival, Folly Hill Farm, Itchen Stoke, Hampshire, SO24 9TF

or call 01962 791020

Cookies