Privacy policy

Who we are

Bowers Allerton Trust is a Charitable Incorporated Organisation, registered charity number 1196618, at Bowers Allerton Hall, Queen Street, Great Preston, Leeds LS26 8DF.

We are the data controller for the personal information described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.

For anything to do with your personal information, including any of the requests set out below, write to privacy@bowersallertontrust.org.uk. A trustee reads that mailbox.

This policy covers this website and the people who use it: anyone who enquires, books a room, applies for a stall or appears in a photograph. How the Trust handles information about its own trustees, volunteers and staff is a separate matter, governed by the Trust's internal policies rather than this page.

Our position in short

• We collect what we need to answer you, take your booking and run the hall. Nothing else.
• We do not track you. There is no analytics, no advertising, no social media pixel, and no profiling.
• We do not sell, rent or swap your information, and we never will.
• The website and its database run on a server in the United Kingdom.
• You can ask us what we hold, ask us to correct it, and ask us to delete it.

What we collect, and why

When you ask to hire a room, we collect your name, any organisation you are booking for, your email address, telephone number, address and postcode, what you are planning, roughly how many people are coming, whether alcohol will be served or the event is ticketed, and anything else you tell us. We need this to price the booking, decide it, let you in on the day, and invoice you.

When you apply for a stall at one of our events, we collect your name or company name, address, telephone number, email address, a description of what you are selling, how many table spaces you want, whether you are a registered charity and your charity number if so, and your public liability insurance details.

When you send us a general enquiry, we collect your name, email address and your message.

Every time a form on this site is submitted we also record the IP address it came from and the browser it was sent with. We use this only to block automated submissions and to limit how often the same connection can post. It is not used to identify you or to build any picture of you.

Our lawful bases for using it

Under UK GDPR we have to have a lawful basis for using your information. Ours are:

• Contract, or steps taken before entering one: handling your booking or stall application, pricing it, confirming it, and taking payment.
• Legitimate interests: replying to general enquiries, keeping records of who has used the hall, protecting our forms from spam and abuse, and publishing photographs of our own events to show what the hall is for. We have considered your interests and rights in each case, and none of this is anything you would not reasonably expect from a village hall.
• Consent: sending stall holders an email when bookings open for a new event. You choose this on the form and you can withdraw it at any time.
• Legal obligation: keeping financial records that charity and tax law require us to keep.

Cookies, and why there is no cookie banner

Browsing this website sets no cookies on your device at all.

There are no analytics cookies, no advertising cookies, no tracking pixels and no embedded social media trackers anywhere on it. That is why you are not asked to accept anything: there is nothing to accept.

Where we switch on Cloudflare Turnstile, the anti-spam check that can appear at the end of the booking and stall forms, it processes your IP address to tell a person from a robot and may set a cookie that is strictly necessary for that check. It does not track you across other websites.

Things on this site that talk to somebody else

Two parts of the site would otherwise contact another company on your behalf, so we have made both deliberate:

• The map on our contact page comes from Google. It does not load until you press Show the map, because loading it shares your IP address with Google. If you would rather not, the address is written out next to it.
• The postcode lookup on the booking form sends the postcode you type, and nothing else, to postcodes.io, so we can fill in your town and county for you. Your name is not sent with it. You can ignore the lookup and type your address yourself.

Photographs of people

We take photographs at our own public events and publish some of them in our gallery, on our blog and on our social media, to show what the hall is used for and to encourage people to come. We do this under legitimate interests, and we display a notice at events where photographs are being taken.

If you would rather not appear, tell the photographer at the time, or write to privacy@bowersallertontrust.org.uk and we will take the photograph down. You do not have to give a reason and we will not ask for one.

We do not publish a photograph in which a child is identifiable without the agreement of their parent or carer.

Who else sees your information

We use a small number of established companies to run the hall's systems. They act on our instructions and may not use your information for their own purposes:

• Google, for the Trust's email. Emails to and from us are held in Google Workspace, which may store or process them outside the United Kingdom under the safeguards UK law requires.
• Stripe, if and when we take a payment online. Your card details go straight to Stripe and are never seen by, or stored on, this website.
• Cloudflare, where the anti-spam check described above is switched on.
• postcodes.io, for the postcode lookup, which is a United Kingdom service.

Where your information is kept

The website, its database and the photographs and documents it holds are on a server in the United Kingdom.

Email is the exception. Because our email is provided by Google, messages you send us and messages we send you may be processed outside the United Kingdom. Where that happens, it is covered by the safeguards UK data protection law requires for international transfers.

How long we keep it

• General enquiries, and booking or stall requests that did not go ahead: 12 months.
• Bookings, hirer records, stall bookings and the financial records that go with them: seven years, being the current year and six before it, which is what charity and tax record keeping requires.
• Stall holders on our mailing list: until you tell us to stop, and we act on that straight away.
• Public liability insurance certificates: never stored on this website at all. The certificate you upload is checked, emailed once to our bookings mailbox and discarded by the website. We keep the copy in that mailbox only as long as we need it to confirm your cover.
• Photographs: for as long as they are useful to the Trust, and removed on request.

Your rights

Under UK data protection law you have the right to ask us for a copy of the information we hold about you, to have it corrected if it is wrong, to have it deleted, to ask us to stop or limit what we are doing with it, to object to our using it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time.

Write to privacy@bowersallertontrust.org.uk. We will reply within one month, and there is no charge.

Some limits apply. Where the law requires us to keep a financial record, we cannot delete it before its time, but we will tell you plainly if that is the case.

We do not make any decision about you by automated means, and we do not profile you.

Keeping it safe

The site is served over an encrypted connection. What you send us is visible only to the trustees who need it to answer you or run your booking, and each of them has their own account rather than a shared one. We do not store card details at any point.

If something ever goes wrong and your information is put at risk, we will tell the Information Commissioner's Office within 72 hours where the law requires it, and we will tell you directly if it is likely to affect your rights.

Registration with the Information Commissioner

The Trust relies on the exemption from data protection fee registration available to not-for-profit organisations. Relying on that exemption does not change any of our obligations: UK GDPR and the Data Protection Act 2018 apply to us in full, and this policy is written on that basis.

If you are unhappy

Please tell us first, at privacy@bowersallertontrust.org.uk, and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office at any time. They can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to this policy

This policy was last updated on 26 August 2026. If we change how we use your information we will update this page, and we will change the date above so you can tell.