Privacy notice

Short version: we collect as little as we can get away with, we don't track you around the internet, we don't sell anything about you, and we don't store your IP address.

Who we are

Here in the City, Cardiff (company details to be added before launch), is the data controller for the information described here. When you buy from a shop, that shop is a controller too for the details it needs to fulfil your order.

What we collect, why, and on what basis

We never store raw IP addresses, and we don't use analytics that does. We don't run advertising pixels, we don't track you across other websites, and we don't sell or share your details with anyone for marketing. The one thing we do hold about you beyond your name and address is the list of interests you ticked, which is described below and which you control.

Postcodes are stored as the outward code only (CF24, not CF24 3AA) wherever the full postcode isn't needed to deliver something.

Cookies

This site sets no advertising or analytics cookies. When ordering is switched on, we will need a small number of strictly necessary cookies to keep your basket and your session — those are exempt from consent. If we ever add anything beyond that, we'll ask you first and you'll be able to say no, and nothing non-essential will be set unless you say yes.

What you tell us you're interested in

When you make an account we ask what you're here for — sport, work and training, markets, things with children, and so on. You can tick none, some or all of them, and change your mind whenever you like on your account page.

We use it for one thing: deciding what to tell you about. It is not sold, not shared with organisers or shops, and not visible to anybody but us. Ticking nothing is a real answer — it means you hear about everything.

We should be straight that this is a change. This notice used to say we build no profile of you at all, and attaching interests to a named account is a profile, however small and however plainly it is explained. What has not changed is the rest: no tracking cookies, no advertising pixels, no analytics that follows you, and no selling anything to anybody. If you'd rather we knew nothing, untick everything — the account still works exactly the same.

Signing up for something

When you reserve a place at an event, the group running it can see your name, whether you're coming or waiting, and anything you answered when you signed up. Nobody else can — not other members, not the public.

Some events are run by more than one group. When they are, every group hosting it sees that same information, and they are joint organisers of the event for data protection purposes. The page tells you which groups those are before you sign up, by name, and asks you to agree. A group that has only been invited to co-host sees nothing at all until it accepts.

Organisers can ask questions when you sign up — a shirt size, which session you want, whether you need step-free access. If a question asks about your health, your diet, your beliefs or your access needs, we treat your answer as special category data under Article 9 and only process it with your explicit consent, which is what the tick box on the sign-up form is. You can see every question before you decide to come.

If you drop out, your answers are deleted with your place. Not archived, not anonymised — deleted, by the database itself. The same happens if an organiser removes a question, or if a group stops hosting the event: its access ends the moment it steps out.

We tell organisers to keep that information on the event page and not to copy it into spreadsheets or group chats. We can't enforce what somebody does after reading their screen, which is a limit worth knowing about: tell an organiser only what you're willing for that group to know.

Who else sees your information

• The shop you bought from — the details needed to pack and hand over your order.
• The groups running an event you signed up for — as described above.
• Stripe — card payments. We never see or store your card number.
• Our email provider — to send order updates and, if you asked for them, Last Call alerts.
• Our hosting provider — which runs the website.

That's it. No data brokers, no ad networks.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of what we hold about you;
• correct anything that's wrong;
• delete it, where we don't need it for a legal reason like tax records;
• restrict or object to how we use it;
• send it to you or someone else in a portable format;
• withdraw consent at any time, where consent is the basis — unsubscribing does this for alerts.

Ask through the contact details that will be published here at launch. If you're not happy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

This site isn't aimed at children.

While the site is a demo

Nothing you type into the forms on this version of the site is stored at all. The forms check what you've typed and then discard it. See the site terms.