Privacy Policy.

This Privacy Policy explains how Gatherstone Ltd, trading through and operating The Paranormal Festival, collects, uses, stores and protects personal information in connection with The Paranormal Festival.

For the purposes of applicable UK data protection law, Gatherstone Ltd is the data controller of personal information processed in connection with The Paranormal Festival unless another organisation is expressly identified as a separate controller.

This Policy is intentionally broad because The Paranormal Festival is an events brand and is not limited to one particular festival, venue, date or format.

It applies, where relevant, to personal information processed in connection with any event, activity, experience or service organised, promoted or operated under The Paranormal Festival brand, including current and future:

• festivals and conventions;
• exhibitions and expos;
• live entertainment;
• talks, panels and presentations;
• workshops and demonstrations;
• paranormal-themed experiences and activities;
• screenings and performances;
• meet-and-greets;
• social and networking events;
• competitions and promotions;
• vendor and exhibitor activities;
• online or hybrid events;
• ticketed and non-ticketed events;
• related community activities; and
• other events, experiences or activities we may introduce.

It also applies to our website, mailing lists, ticketing activities, applications, enquiries and other interactions connected with The Paranormal Festival.

UK data protection law requires organisations to provide clear information about how and why personal information is used, including purposes, lawful bases, retention and sharing.

The Paranormal Festival is operated by Gatherstone Ltd.

Gatherstone Ltd
Company Number: 17465110
Registered in England and Wales
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom

Gatherstone Ltd operates The Paranormal Festival as one of its brands and projects.

References in this Policy to “The Paranormal Festival”, “we”, “us” or “our” refer to Gatherstone Ltd when operating The Paranormal Festival.

This Policy may apply to:

• website visitors;
• ticket purchasers;
• event attendees;
• people registering for Early Bird access;
• mailing-list and newsletter subscribers;
• competition entrants;
• vendors, traders and exhibitors;
• prospective vendors and exhibitors;
• speakers, guests and performers;
• event partners and collaborators;
• sponsors and prospective sponsors;
• contractors and suppliers;
• volunteers and event staff where applicable;
• photographers, videographers and media representatives;
• people making accessibility requests;
• people contacting us with enquiries, complaints or feedback; and
• other individuals who interact with The Paranormal Festival.

Different sections of this Policy will apply depending on your relationship with us.

Depending on how you interact with us, we may collect information including:

Identity information

Such as:

• name;
• title where provided;
• age or date of birth where genuinely required;
• username or social media identity where relevant.

Contact information

Such as:

• email address;
• telephone number;
• postal or billing address where required;
• business contact information.

Ticket and booking information

Such as:

• tickets purchased;
• booking reference;
• event selected;
• ticket category;
• quantity;
• booking date;
• attendance information;
• relevant transaction information;
• requests connected with a booking.

Payment information

Payments may be processed by third-party payment or ticketing providers.

Depending on the arrangement, we may receive transaction details, payment status, references and limited payment-related information.

We do not claim to receive or store full payment-card details where these are handled directly by a payment provider.

Early Bird and mailing-list information

This may include:

• name;
• email address;
• date of registration;
• interests or preferences where voluntarily provided;
• consent and preference records;
• unsubscribe information.

Vendor and exhibitor information

This may include:

• contact name;
• business or trading name;
• email address;
• telephone number;
• website and social media details;
• products or services offered;
• application responses;
• pitch requirements;
• photographs or examples of products;
• insurance information;
• licences, certificates or other compliance information where relevant;
• payment and booking information.

Speaker, performer and guest information

This may include:

• contact information;
• professional information;
• biographies;
• photographs;
• social media or website details;
• contractual and booking information;
• technical requirements;
• travel or accommodation requirements where applicable;
• payment information where relevant.

Competition and promotional information

Such as:

• name;
• contact details;
• entry information;
• competition responses;
• eligibility information;
• prize-delivery details where necessary.

Communications

We may retain information contained in:

• emails;
• contact forms;
• social media messages;
• support enquiries;
• complaints;
• feedback;
• correspondence relating to bookings, applications or events.

Technical and website information

Depending on the technologies actually used on our website, this may include:

• IP address;
• browser type;
• device information;
• operating system;
• website interactions;
• security information;
• cookie or similar technology identifiers;
• consent and privacy preferences.

Further information is provided in our Cookies & Similar Technologies Policy.

We may collect personal information directly from you when you:

• purchase or reserve a ticket;
• register for Early Bird access;
• subscribe to updates;
• apply to become a vendor or exhibitor;
• apply for or enquire about involvement in an event;
• enter a competition;
• contact us;
• attend an event;
• request accessibility arrangements;
• complete a form;
• communicate with us through social media;
• participate in an event activity;
• provide feedback;
• enter into an agreement with us.

We may also receive information from third parties where appropriate, such as:

• ticketing providers;
• payment processors;
• venues;
• event partners;
• suppliers and contractors;
• competition partners;
• publicly available professional or business sources; or
• someone making a legitimate booking or enquiry on your behalf.

Where we obtain personal information from another source, applicable transparency requirements still apply. The ICO states that privacy information generally needs to be provided within a reasonable period and no later than one month, subject to applicable exceptions.

We may use personal information to:

• operate The Paranormal Festival;
• plan and manage events;
• process ticket purchases and bookings;
• provide booking confirmations and event information;
• verify tickets and manage admission;
• communicate important changes to an event;
• manage Early Bird registrations;
• administer vendor and exhibitor applications;
• allocate pitches and event spaces;
• manage speakers, performers, guests and contributors;
• administer contracts;
• process payments;
• respond to enquiries;
• administer competitions and promotions;
• provide customer support;
• handle complaints and disputes;
• manage accessibility arrangements;
• maintain appropriate event security and safety;
• prevent fraud and misuse;
• protect our legal rights;
• comply with legal and regulatory obligations;
• manage suppliers and contractors;
• maintain appropriate business records;
• understand and improve our events and website;
• administer mailing preferences;
• send marketing where permitted; and
• establish, exercise or defend legal claims where necessary.

We will not use personal information for an incompatible new purpose without considering the applicable legal requirements.

We must have a valid lawful basis for processing personal information. The appropriate basis depends on the particular purpose and circumstances.

Depending on the processing, we may rely on:

Contract

Where processing is necessary to perform a contract with you or take steps at your request before entering into one.

Examples may include:

• processing a ticket purchase;
• administering a vendor booking;
• managing a speaker or performer agreement;
• providing an event service you have purchased.

Legitimate Interests

We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.

This may include appropriate processing for:

• operating and improving our events;
• managing enquiries;
• protecting our organisation and events;
• preventing fraud;
• maintaining security;
• managing business relationships;
• establishing or defending legal claims.

Where required, we consider the necessity and impact of such processing.

Consent

We may rely on consent where appropriate, including for certain forms of marketing or other processing where consent is the appropriate lawful basis.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make processing carried out before withdrawal unlawful.

Legal Obligation

We may process personal information where necessary to comply with a legal obligation.

Other Lawful Bases

In less common circumstances, another lawful basis permitted under applicable data-protection law may apply.

When you purchase or obtain a ticket, we may use your information to:

• process the booking;
• take or confirm payment;
• issue tickets;
• verify admission;
• communicate with you about the event;
• provide essential information;
• administer refunds or changes where applicable;
• prevent fraudulent ticket use;
• resolve booking issues;
• maintain appropriate records.

Communications that are genuinely necessary to administer your booking or provide important event information are service communications rather than marketing merely because they are sent by email.

The ICO distinguishes purely administrative/customer-service messages from direct marketing; adding promotional material can change the character of a message.

Where you register for Early Bird access, we may use the information you provide to administer that registration and send the information described when you sign up, which may include:

• Early Bird access information;
• ticket-release information;
• relevant event announcements; and
• information directly connected with the Early Bird registration.

We will make the nature of the communications reasonably clear when you register.

Registration for Early Bird access will not automatically constitute consent to unrelated marketing from other Gatherstone brands.

We may send marketing communications about The Paranormal Festival where permitted by applicable law.

Where consent is required, it must be freely given, specific, informed and unambiguous and involve a clear positive action. Pre-ticked boxes, silence or inactivity are not valid ways to obtain that consent.

Where applicable, we may also rely on a lawful PECR exception such as the customer “soft opt-in”, but only where its requirements are actually satisfied.

You can unsubscribe from marketing communications at any time using the unsubscribe method provided or by contacting us.

We may retain limited suppression information after an unsubscribe so that we can respect your preference and avoid inadvertently adding you back to marketing communications.

The ICO states that individuals have an absolute right to object to direct marketing.

The Paranormal Festival is operated by Gatherstone Ltd, which may operate other brands, products, projects and services.

Personal information collected through The Paranormal Festival is not automatically treated as permission to market every other Gatherstone brand to you.

Where information needs to be used elsewhere within Gatherstone Ltd for legitimate central business functions, such as accounting, legal compliance, security or administration, it may be processed as appropriate.

Where separate marketing consent is required for another brand or purpose, we will obtain it where necessary.

Where you apply to participate professionally or commercially in one of our events, we may process information necessary to:

• review your application;
• communicate with you;
• assess suitability for the relevant event;
• administer agreements;
• allocate space;
• arrange access;
• process payments;
• coordinate event logistics;
• advertise confirmed participation;
• manage health, safety and compliance requirements;
• maintain appropriate records.

Submitting an application does not necessarily guarantee acceptance.

Where professional information is intended for publication, such as an agreed speaker biography, vendor name, photograph or social media link, we may publish that information for event promotion and administration in accordance with the applicable arrangements.

If you contact us about accessibility requirements, reasonable adjustments, allergies, medical considerations or another health-related matter, the information you provide may reveal special category personal data, particularly information about health.

Special category information receives additional protection under UK data-protection law. Processing it requires both a lawful basis and an applicable special-category condition.

We will only request information that is reasonably necessary for the relevant purpose.

Where appropriate, we may ask for explicit consent or rely on another applicable legal condition.

Accessibility information will not be used for unrelated marketing.

Where possible, please provide only the information reasonably necessary for us to understand and respond to your requirement.

During an event, we may process relevant personal information where reasonably necessary to respond to:

• an accident;
• an emergency;
• a safeguarding concern;
• a security incident;
• lost persons;
• serious misconduct;
• damage;
• another significant health or safety matter.

Depending on the circumstances, information may need to be shared with venues, security personnel, medical professionals, emergency services or other appropriate organisations.

The applicable lawful basis will depend on the circumstances.

Our events may be photographed, filmed or recorded.

Images, video or audio may be used for legitimate purposes including:

• documenting an event;
• reporting on an event;
• promoting The Paranormal Festival;
• websites;
• social media;
• promotional material;
• future event promotion;
• press and media activity.

Where appropriate, we may provide event notices informing attendees that photography or filming is taking place.

We will consider the nature and context of the recording and the reasonable expectations of attendees.

Where a particular activity requires consent or another specific legal basis, we will address this as appropriate.

If you have a particular concern about photography or filming at an event, please speak to a member of the event team.

Different events operated under The Paranormal Festival brand may have different age restrictions depending on:

• the venue;
• content;
• event format;
• licensing requirements;
• activities taking place;
• applicable safety considerations.

We will communicate applicable age restrictions for a particular event where relevant.

Where we knowingly process children’s personal information, we will take account of the additional protections applicable to children and use age-appropriate practices where required.

This Privacy Policy should not be interpreted as stating that every event is either adults-only or suitable for children.

If we run a competition, giveaway or promotion, we may process information to:

• administer entries;
• verify eligibility;
• select or contact winners;
• deliver prizes;
• prevent abuse;
• comply with the relevant terms;
• maintain appropriate records.

Entering a competition will not automatically subscribe someone to unrelated marketing unless an appropriate separate marketing basis exists.

Additional competition-specific terms may apply.

Our website may use cookies and similar technologies.

These can support functions such as:

• security;
• essential website operation;
• remembering choices;
• analytics;
• functionality; and
• other website features.

Whether consent is required depends on the technology, its purpose and whether an applicable exception applies.

Further information is provided in our Cookies & Similar Technologies Policy and through any relevant cookie or privacy controls.

Where reasonably necessary, we may share personal information with appropriate third parties, including:

• ticketing providers;
• payment processors;
• website and hosting providers;
• email and communications providers;
• venues;
• event-production suppliers;
• security providers;
• contractors;
• professional advisers;
• insurers;
• accountants;
• technology providers;
• competition fulfilment providers;
• event partners where appropriate;
• regulators;
• law-enforcement bodies;
• courts; and
• emergency services.

We do not give third parties unrestricted permission to use personal information simply because they provide a service to us.

Where a supplier processes personal information on our behalf as a processor, appropriate data-protection arrangements will be used where required.

Some third parties may instead act as independent controllers for their own processing. Their own privacy information may apply.

We may use third-party providers to facilitate ticketing, bookings and payments.

Those providers may collect information directly from you.

Where they act as an independent controller, their own privacy policy will explain how they use your information.

Where they process personal information on our behalf, we will manage that relationship in accordance with applicable data-protection requirements.

Because The Paranormal Festival may host different types of events at different locations, we may work with a variety of venues and event partners.

In some circumstances, it may be necessary to share limited information with a venue or partner for purposes such as:

• admission;
• accessibility;
• security;
• health and safety;
• event administration;
• guest management.

We will not automatically provide an entire attendee or mailing database to a venue merely because an event is taking place there.

Some service providers may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate lawful transfer mechanism or otherwise ensure that the relevant requirements are satisfied.

The specific arrangements depend on the provider and destination involved.

We do not intend to keep personal information indefinitely simply because we collected it.

Retention periods depend on factors including:

• why the information was collected;
• whether an event or booking remains active;
• contractual requirements;
• accounting and tax obligations;
• legal limitation periods;
• disputes or complaints;
• safety and security requirements;
• whether someone remains subscribed to communications;
• whether information is needed to maintain an opt-out or suppression record.

Different categories of information may therefore have different retention periods.

When information is no longer reasonably required, it will be deleted, anonymised or otherwise appropriately disposed of, subject to applicable legal requirements.

We take reasonable and appropriate organisational and technical measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure;
• destruction.

No website, electronic system or transmission method can be guaranteed to be completely secure.

We therefore do not promise absolute security.

Where a personal-data breach occurs, we will assess the circumstances and take appropriate action.

Where applicable law requires notification to the Information Commissioner’s Office or affected individuals, we will make the required notification.

Depending on the circumstances and applicable law, you may have rights including:

• the right to be informed about how your information is used;
• the right of access to personal information held about you;
• the right to rectification of inaccurate information;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability where applicable;
• the right to object to certain processing;
• rights relating to certain forms of automated decision-making; and
• the right to withdraw consent where processing is based on consent.

These rights are not absolute in every circumstance.

We may need to verify your identity before fulfilling a request.

You have the right to object to the use of your personal information for direct marketing.

If you unsubscribe or otherwise object to direct marketing, we will stop using your information for that purpose as required.

We may retain limited information on a suppression list so that we can continue to respect your request.

We do not intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing unless we have an appropriate lawful basis and comply with applicable legal requirements.

If this changes materially, we will provide appropriate information.

Our website, emails or social media may contain links to websites or services operated by other organisations.

We are not responsible for the privacy practices of independent third parties.

You should review their privacy information where appropriate.

The Paranormal Festival may operate profiles on third-party social-media platforms.

When you interact with us through those platforms, the platform provider may separately process information according to its own privacy terms.

Our presence on a social-media service does not mean that we control all processing carried out by that provider.

If Gatherstone Ltd or The Paranormal Festival undergoes a restructuring, sale, merger, acquisition or transfer of relevant business assets, personal information may form part of that transaction where lawful and appropriate.

Any recipient will be required to handle personal information in accordance with applicable legal requirements.

We may process, preserve or disclose information where reasonably necessary to:

• comply with applicable law;
• respond to a lawful request;
• establish, exercise or defend legal claims;
• enforce contractual rights;
• protect individuals;
• protect Gatherstone Ltd, The Paranormal Festival or our property;
• investigate suspected fraud or unlawful conduct.

Any disclosure will be considered according to the circumstances and applicable law.

The Paranormal Festival is intended to evolve and may operate different events, formats, locations and experiences over time.

We may therefore update this Privacy Policy where:

• our events change;
• new services or activities are introduced;
• our suppliers or technology change;
• our processing activities change;
• applicable legal requirements change.

The latest version will be published on our website with an updated revision date.

Where we intend to use personal information for a materially different purpose, we will provide additional information or obtain consent where required.

The ICO recommends privacy information is regularly reviewed and that new uses are brought to people’s attention before the new processing begins.

If you have concerns about how we use your personal information, please contact us first so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

Information Commissioner’s Office

For privacy enquiries or to exercise your data-protection rights, contact:

Gatherstone Ltd
Operator of The Paranormal Festival
Company Number: 17465110
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom

Email: hello@gatherstone.co.uk

Last updated: 17 September 2026