Last updated: 2 May 2026
Who we are
This site is run by the organisers of Flat Out Festival 2026. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), we're the data controller for any personal information you give us through this website.
Get in touch any time at info@flatoutfestival.com.
What we collect, and why
We only collect what we need to run the festival. Specifically:
When you RSVP for a ticket
- Full name — so we can find you on the door list.
- Email address — so we can send your confirmation and the venue address.
- Mobile (optional) — only used if we need to contact you urgently about the festival (cancellation, schedule change).
- Number of tickets and day(s) attending — for capacity planning.
- How you heard about us (optional) — helps us understand which channels work.
- Access requirements (optional) — so we can plan accommodations.
- Marketing opt-in (optional, off by default) — only if you tick the box, we'll add you to the list for future events.
When you pre-order merch
- Name, email, item, size, quantity — to match your order at the merch desk on the day. Merch is pickup-only at the festival; we don't ship.
When you donate
Donations are processed by Stripe. Your card details never touch our servers — Stripe handles all of it. We see only: amount, date, your name, and your email (so we can thank you). Stripe's own privacy policy: stripe.com/gb/privacy.
What we don't collect
We don't run analytics, tracking pixels, advertising cookies, or social media trackers on this site. No Google Analytics, no Meta pixel, none of that. The site uses a single technical cookie from Google Fonts (to load the typography) and that's it.
Where your data lives
- Google Sheets / Google Workspace — RSVPs, merch orders and waitlist signups land in a private Google Sheet that only the festival organisers can access. Hosted in Google's UK/EU data centres.
- Stripe — payment data only. UK/EU based.
- Netlify — hosts the website itself. Receives standard server logs (IP address, browser type, page visited) which Netlify retains for up to 30 days for security and abuse prevention.
Lawful basis for processing
- RSVPs and merch orders: processing is necessary to perform the contract you've entered into with us (your free ticket / your pre-order).
- Marketing emails: consent — only if you tick the opt-in box. You can unsubscribe at any time by replying to any marketing email or emailing us.
- Donations: contract (Stripe processes the payment) and our legitimate interest in keeping records for accounting.
How long we keep your data
- RSVPs: until 30 days after the festival ends, then deleted (unless you opted into marketing — see below).
- Marketing list: kept until you ask to be removed.
- Merch orders: until your order is fulfilled, plus 6 years for tax/accounting purposes (HMRC requirement).
- Donation records: 6 years (HMRC requirement).
Your rights
Under UK GDPR you have the right to:
- Access — ask us for a copy of the data we hold about you.
- Rectification — ask us to correct anything that's wrong.
- Erasure — ask us to delete your data (subject to legal retention requirements).
- Object — object to processing (e.g. ask to be removed from marketing).
- Portability — get a copy of your data in a portable format.
- Withdraw consent — at any time, where we're relying on consent.
To exercise any of these, email info@flatoutfestival.com. We'll respond within 30 days.
Complaints
If you think we've handled your data badly, please tell us first so we can fix it. If you're still unhappy, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):
Changes to this policy
If we change anything significant, we'll update the "Last updated" date at the top and, if it's something material, email anyone who's opted into our list. The current version is always at flatoutfestival.com/privacy.html.
Questions? info@flatoutfestival.com