Cookies & Similar Technologies Policy.

This Cookies & Similar Technologies Policy explains how Gatherstone Ltd, operating The Paranormal Festival, uses or may use cookies and other technologies that store information on, or access information from, your device when you use our websites and other relevant online services.

This Policy should be read alongside The Paranormal Festival Privacy Policy.

The Paranormal Festival is an events brand and is not limited to one particular festival, venue, event, date or format. This Policy may therefore apply to websites and online services connected with current and future events, experiences and activities operated under The Paranormal Festival brand.

The UK's Privacy and Electronic Communications Regulations ("PECR"), as amended, apply to cookies and a wider range of storage and access technologies. Where their use also involves personal information, applicable UK data-protection law may also apply.

The Paranormal Festival is operated by Gatherstone Ltd.

Gatherstone Ltd
Company Number: 17465110
Registered in England and Wales
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom

References in this Policy to "The Paranormal Festival", "we", "us" or "our" refer to Gatherstone Ltd when operating The Paranormal Festival.

Cookies are small pieces of information that a website can store on a user's device and access when required.

Cookies can be used for purposes such as:

• • operating websites;
  • maintaining sessions;
  • remembering preferences;
  • supporting security;
  • understanding website usage;
  • providing functionality; and
  • supporting other online services.

Cookies may operate only for the duration of a browser session or may remain on a device for a specified period.

The rules are not limited to traditional browser cookies.

Other storage and access technologies can include:

• • browser local storage;
  • session storage;
  • tracking pixels;
  • scripts and tags;
  • link decoration and navigational tracking;
  • device or browser identifiers;
  • fingerprinting techniques; and
  • other technologies that store information on, or access information from, a user's device.

PECR can apply to these technologies even where the information involved is not itself personal data. Where personal data is processed, UK data-protection requirements may also apply.

For simplicity, references to "cookies and similar technologies" throughout this Policy include relevant storage and access technologies.

The technologies used by The Paranormal Festival may change as our website, events and services develop.

Depending on the configuration of our website and services, technologies may be used for purposes including:

• • essential website operation;
  • website security;
  • forms and registrations;
  • remembering privacy choices;
  • ticketing functionality;
  • Early Bird registration;
  • vendor applications;
  • analytics and website improvement;
  • remembering preferences;
  • embedded content;
  • marketing or advertising, where used; and
  • other website functionality.

We do not intend this Policy to imply that every technology or category described below is necessarily active at all times.

Our implementation should reflect the technologies actually in use.

Not every cookie or similar technology requires consent.

Under current UK rules, there are five exceptions to the general consent requirement for storage and access technologies:

• • communication;
  • strictly necessary;
  • statistical purposes;
  • appearance; and
  • emergency assistance.

Each exception has specific requirements and is based on the purpose for which the technology is being used. If the requirements of an exception are not satisfied, consent must be obtained before the relevant storage or access takes place.

We will not classify a technology as exempt merely because it is useful or convenient to us.

Some technologies may be necessary for the website or an online service requested by you to operate.

These may include technologies genuinely required for purposes such as:

• • maintaining website security;
  • fraud prevention;
  • completing a transaction;
  • maintaining essential sessions;
  • remembering a user's cookie or privacy choices;
  • providing functionality specifically requested by the user; or
  • operating other essential features.

Where the strictly necessary exception applies, consent is not required.

The ICO explains that this exception must be assessed from the user's perspective: the technology must be essential to provide the online service the user requested, rather than merely beneficial to the organisation.

We may use technologies to understand how visitors use our website and to identify ways of improving it.

Following changes to PECR, certain technologies used solely for qualifying statistical purposes may be used without consent where the requirements of the statistical purposes exception are satisfied.

This can potentially cover appropriate aggregate information about matters such as:

• • visitor numbers;
  • pages visited;
  • user journeys;
  • interactions with pages;
  • average time spent on pages;
  • device or browser types;
  • page-loading performance;
  • bounce or exit information; and
  • how visitors reached the service.

However, the exception is not a general exemption for anything labelled "analytics".

It does not cover using analytics to track or profile identifiable individual visitors, advertising measurement or other purposes falling outside the exception.

Where we rely on the statistical purposes exception, we will provide clear and comprehensive information and a simple and free means of objecting.

Where an analytics technology falls outside the exception and requires consent, it will not be activated before the appropriate consent has been obtained.

Certain technologies used to improve or adapt how our website appears or functions in accordance with a visitor's preferences may qualify for the appearance exception.

For example, this may potentially include appropriate technologies used to:

• • remember display preferences;
  • adapt website functionality to a device;
  • recognise certain accessibility or appearance preferences; or
  • provide other qualifying user-interface functionality.

The exception does not extend to adapting content according to inferred interests or browsing behaviour.

Where we rely on this exception, we will provide clear and comprehensive information about the technology and a simple and free means of objecting.

The Paranormal Festival may use marketing or advertising technologies where appropriate.

These could potentially be used to:

• • measure advertising campaigns;
  • understand conversions;
  • attribute visits or ticket sales to advertising;
  • measure the performance of advertisements;
  • support retargeting;
  • deliver advertising; or
  • understand interactions with marketing campaigns.

We will only describe such technologies as being used where they are actually present.

Storage and access technologies used for online advertising require consent; the statistical and appearance exceptions do not provide an exemption for advertising purposes.

Where consent is required, the relevant technology must not operate before valid consent has been obtained.

A particular technology may technically be capable of serving more than one purpose.

PECR exceptions are purpose-specific.

If a technology is being used for both an exempt purpose and another purpose requiring consent, we will not assume that the exempt purpose makes the entire use exempt.

For example, statistical information cannot simply be treated as exempt analytics if the same storage or access is also being used for advertising or individual tracking.

Where one purpose requires consent, we will obtain consent for that non-exempt purpose as required.

Where our website uses technologies requiring consent, visitors will be provided with an appropriate mechanism for making their choices before those technologies operate.

Depending on the technologies actually in use, this may provide options such as:

Accept Optional Cookies / Reject Optional Cookies / Manage Preferences

Optional categories should not be pre-enabled where prior consent is required.

Rejecting optional technologies should not prevent access to essential website functionality.

Where consent is required, it must involve a clear and positive choice.

We will not treat any of the following, by themselves, as consent:

• • simply visiting our website;
  • continuing to browse;
  • scrolling;
  • inactivity;
  • closing a notice; or
  • navigating to another page.

We will not use pre-selected optional consent as a substitute for an affirmative choice.

The ICO requires organisations to provide information about what the relevant technologies do before consent, prevent non-exempt technologies from operating before consent, and make refusing them as easy as accepting them.

Where applicable, our website will provide a way for visitors to manage their cookie and similar-technology preferences.

Depending on the technologies used, preference categories may include:

• • Strictly Necessary;
  • Analytics;
  • Functional or Preferences; and
  • Marketing or Advertising.

Categories should only be displayed where relevant to technologies actually used by the website.

A technology will be categorised according to its real purpose rather than simply according to the provider's description of it.

Where processing relies on consent, you can change or withdraw that consent.

Withdrawing consent should be as easy as providing it.

Where appropriate, our website may provide a persistent Cookie Settings or similar link that allows you to reopen your preferences.

When consent is withdrawn, relevant optional technologies will be prevented from operating subsequently where applicable.

We may also remove relevant optional cookies or identifiers where reasonably possible and appropriate.

Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

Some technologies may qualify for the statistical purposes or appearance exceptions and therefore not require prior consent.

These exceptions nevertheless require users to receive clear and comprehensive information and to have a simple means of objecting, free of charge.

Where The Paranormal Festival relies on either exception, an appropriate objection mechanism will be provided.

If you object, we will respect that preference in accordance with the applicable requirements.

We may use a cookie or similar technology to remember the privacy choices you make.

This prevents the website from repeatedly asking you to make the same selection and helps us respect your preferences on future visits.

We will retain these preferences only for an appropriate period and may ask you to confirm them again where appropriate, including where our use of technologies materially changes.

Our website may use third-party services.

Depending on the services actually implemented, these may include providers involved in:

• • website hosting;
  • security;
  • ticketing;
  • payments;
  • forms;
  • analytics;
  • email communications;
  • embedded media;
  • maps;
  • social media;
  • event functionality; or
  • other online services.

A technology being provided by a third party does not automatically determine whether consent is required.

We assess its actual purpose and how information is stored or accessed.

Where we request consent for a third party's storage or access technology, we will provide appropriate information about the third party and purpose as required.

The Paranormal Festival may use external ticketing or payment providers.

When you follow a link to an independent provider or use a service operated by another organisation, that provider may use its own cookies and similar technologies.

Where the provider operates its own website or service independently, its own cookie and privacy information may apply.

Where third-party technology operates directly through our website, we will assess our responsibilities in relation to that technology.

Our website may contain embedded content such as:

• • videos;
  • audio;
  • maps;
  • social media content;
  • event-related media; or
  • other third-party content.

Loading embedded content can sometimes result in third-party storage or access technologies being used.

Where those technologies require prior consent, we will take appropriate steps to prevent them from loading until the necessary consent has been obtained.

Where practical, this may involve displaying a placeholder until the visitor chooses to enable the relevant content.

Our website may link to The Paranormal Festival's social media accounts.

An ordinary link to an external social network does not necessarily mean that the platform is tracking visitors through our website.

However, embedded social-media features or tracking technologies may operate differently.

Where such technology is present, it will be assessed according to its actual functionality and purpose.

Our Early Bird, mailing-list, vendor or enquiry forms may use technologies necessary to:

• • submit information;
  • prevent abuse;
  • maintain security;
  • process the requested registration; or
  • provide the relevant online functionality.

Any technologies genuinely necessary for the user-requested service may qualify for an applicable exception.

Optional marketing or tracking technology associated with a form will not automatically be treated as necessary merely because the form itself is necessary.

Cookie consent is also separate from consent or another lawful basis for receiving marketing communications.

The Paranormal Festival may operate different types of events over time.

These may involve:

• • different venues;
  • different ticketing providers;
  • different event partners;
  • different website features;
  • temporary event pages;
  • embedded booking functionality; or
  • additional online services.

This Policy is therefore intended to apply broadly across The Paranormal Festival brand rather than only to one event.

However, if a future event introduces materially different storage or access technologies, we will review our disclosures and controls and update them where necessary.

We will seek to maintain accurate information about technologies actually used by our website.

Where appropriate, our cookie information or preference system may identify:

• • Technology/Cookie Name;
  • Provider;
  • Purpose;
  • Category;
  • Duration;
  • Whether Consent Is Required or an Exception Is Relied Upon.

We will not knowingly list fictional or generic cookies merely to populate a cookie table.

The exact inventory should be based on an audit of the live website and its integrations.

Different technologies may remain on a device for different periods.

Some operate only during a browser session.

Others may persist for a defined period.

PECR does not prescribe one universal lifespan for all storage and access technologies; the appropriate duration should be considered in light of the purpose and circumstances.

We will seek to avoid retaining technologies for longer than reasonably appropriate for their stated purpose.

Most browsers and devices provide additional controls for cookies and other stored information.

These may allow you to:

• • view stored cookies;
  • delete cookies;
  • block certain cookies;
  • restrict website storage; or
  • configure other privacy settings.

These controls operate separately from The Paranormal Festival's own preference controls.

Blocking technologies required for essential functionality through browser or device settings may affect how parts of the website operate.

Some information collected through cookies or similar technologies may constitute personal information.

Where this happens, The Paranormal Festival Privacy Policy also applies.

Compliance with UK data-protection law does not remove separate obligations under PECR, and an applicable UK GDPR lawful basis does not by itself remove a PECR consent requirement.

Some third-party technology providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will consider the applicable requirements of UK data-protection law and use appropriate safeguards or transfer mechanisms where required.

Further information about international processing is provided in our Privacy Policy.

We may use appropriate technologies to help:

• • protect our website;
  • detect malicious activity;
  • prevent fraud;
  • maintain service security; and
  • protect visitors and our systems.

Whether a particular security technology qualifies for an exception depends on its actual purpose and implementation.

We will not automatically categorise every security-related third-party technology as strictly necessary without considering how it operates.

Before introducing a materially different cookie or similar technology, we should consider:

• • what information it stores or accesses;
  • why it is required;
  • whether it processes personal information;
  • whether a third party receives information;
  • whether an applicable PECR exception applies;
  • whether users must have a simple means of objecting;
  • whether prior consent is required;
  • how long the technology operates;
  • whether our Privacy Policy needs updating; and
  • whether this Policy or our preference controls need updating.

Where consent is required, the technology should not be enabled before the appropriate consent has been obtained.

We will periodically review the cookies and similar technologies operating through our website.

This may include checking that:

• • technologies listed are actually present;
  • their purposes remain accurate;
  • obsolete technologies have been removed;
  • technologies are correctly categorised;
  • any PECR exceptions relied upon remain appropriate;
  • non-exempt technologies do not operate before consent;
  • consent controls work correctly;
  • objection mechanisms work where required;
  • preferences are respected; and
  • consent can be withdrawn where applicable.

The ICO's current guidance says organisations should consider storage and access technologies as part of the design and implementation of their services and should not pre-enable non-exempt technologies.

We may update this Policy as The Paranormal Festival develops, including where:

• • our website changes;
  • we introduce new events or services;
  • technologies change;
  • providers change;
  • applicable laws or regulatory guidance change; or
  • our use of information changes.

The latest version will be made available through The Paranormal Festival website.

Where a change requires new consent, we will request that consent before carrying out the relevant non-exempt storage or access.

If you have questions about our use of cookies and similar technologies or your privacy choices, please contact:

Gatherstone Ltd
Operator of The Paranormal Festival
Company Number: 17465110
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom

Email: hello@gatherstone.co.uk

Last updated: 17 September 2026