1. Who we are
Bespoked Events Ltd ("BESPOKED", "we", "us", "our") is registered in England and Wales (company number 13730324) with its registered office at Unit 3, Phoenix Business Park, Continental Approach, Westwood, Kent, CT9 4HL.
We are the data controller for the personal data described in this policy, unless stated otherwise.
Contact for data protection matters: Data Protection Lead, info@bespoked.cc.
2. What personal data we collect
We collect different data depending on how you interact with us:
- Ticket buyers: name, email, billing address, payment confirmation details (full card numbers are processed by Stripe, not stored by us), order history.
- Newsletter subscribers: name, email, marketing preferences.
- Exhibitors: company name, contact name, job title, business email and phone, billing/VAT details, stand and logistics details, directory or badge data.
- Tour/programme participants: name, company/organisation, contact details, and tour preferences (e.g. bike/no bike), submitted when booking onto a partner-run tour or programme (such as the Saxony business tour).
- General enquiries: name, email, and the content of your enquiry, submitted via our contact form (hosted by Fillout).
- All website visitors: technical data such as IP address, browser, device information and cookie identifiers.
- All event attendees: image, such as a photo or video still.
3. How we use your data and our legal basis
We only process personal data where we have a lawful basis to do so:
| Purpose | Legal basis | Data used |
|---|---|---|
| Processing ticket orders and entry | Performance of a contract | Name, email, billing, order data |
| Responding to enquiries | Legitimate interest (customer service) | Name, email, enquiry content |
| Managing exhibitor bookings | Performance of a contract | Company/contact details, billing |
| Arranging participation in partner-run tours/programmes (e.g. Saxony tour) | Performance of a contract / legitimate interest (fulfilling your request) | Name, contact details, tour preferences |
| Sending marketing newsletters | Consent | Name, email, preferences |
| Fraud prevention, accounting, legal compliance | Legal obligation / legitimate interest | Transaction and billing data |
| Site analytics (non-essential) | Consent (via cookie banner) | Cookie/device identifiers |
| Event photography | Legitimate interest | Image |
Where we rely on consent (e.g. the newsletter, or non-essential cookies), you can withdraw it at any time - see Section 8.
4. Cookies
Our website uses cookies and similar technologies. Full details, including which cookies require your consent, are set out in our separate Cookie Policy.
5. Who we share your data with
We share personal data only where necessary, with:
- Stripe, to process ticket payments - data processed in the US.
- Mailchimp, to send newsletters - data processed in the US.
- Ticket Tailor, to issue and manage tickets - data processed in the UK.
- Fillout, to process general enquiries submitted via our contact form - data processed in the US.
- Baserow, to store information in a database format - data processed in Germany.
- Pipedrive, to carry out CRM activities - data processed in the EU.
- Google Workspace, for document creation and file storage - data processed in the US and EU.
- Event sponsors or partners, but only where you have separately opted in to have your details shared (exhibitors/attendees) - data processed in the country where the sponsor or partner is based, and elsewhere in the world, using various services, in accordance with this policy.
- Wirtschaftsförderung Sachsen GmbH (WFS), where you book onto a Saxony tour or programme via our website, so they can organise, run, and follow up on the tour you've selected - data processed in Germany, and elsewhere in the world, using various services, in accordance with this policy.
- Professional advisers, regulators, or law enforcement, where required by law - data processed in the country where the service provider is based, and elsewhere in the world, using various services, in accordance with this policy.
We do not sell personal data to third parties.
6. International data transfers
Because we operate events in the UK, Germany, and Japan, personal data may be transferred internationally:
- UK/EU: Germany is subject to the EU GDPR, which provides an equivalent standard of protection to the UK GDPR.
- Japan: recognised as providing an adequate level of protection under both UK and EU adequacy regulations; data is also subject to Japan's Act on the Protection of Personal Information (APPI) - see Section 14 for more detail.
- Other transfers outside the UK/EEA/Japan only take place with appropriate safeguards (such as Standard Contractual Clauses or the UK International Data Transfer Agreement) or with your explicit consent.
A list of our current international sub-processors is available on request from info@bespoked.cc.
7. How long we keep your data
- Ticket/order records: 6 years (UK accounting and tax law).
- Newsletter subscribers: until you unsubscribe, or after 24 months of no engagement.
- Exhibitor records: for the duration of the relationship, plus 6 years.
- General enquiries: 12 months from resolution.
- Tour/programme participant records: 12 months from the event date, unless you've separately consented to further contact.
We delete or anonymise personal data once it is no longer needed, unless we are required to keep it longer by law.
8. Your rights
Under UK GDPR (and EU GDPR, if you are in the EU), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion ("right to be forgotten"), in certain circumstances
- Object to or restrict certain processing, including direct marketing
- Withdraw consent at any time, without affecting processing carried out before you withdrew it
- Request a copy of your data in a portable format
- Lodge a complaint with a supervisory authority
To exercise any of these rights, contact us at info@bespoked.cc. We will respond within one month, as required by law.
If you are in Japan, see Section 14 for how to exercise your rights under Japanese law.
9. Children
Our website and ticketing services are not directed at children. Where an event is family-friendly, under-16s may attend free of charge (subject to payment of the applicable booking fee), but tickets must be booked by an adult, who is responsible for the accuracy of the information provided and for the child while at the event.
10. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including encryption in transit, access controls, and regular review of our third-party processors.
11. How to complain
If you are unhappy with how we have handled your personal data, please see our Data Protection Complaints Procedure. You also have the right to complain directly to:
- the UK Information Commissioner's Office (ico.org.uk), or
- if you are in the EU, your local data protection authority, or
- if you are in Japan, the Personal Information Protection Commission (個人情報保護委員会).
12. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it was last revised. Material changes will be highlighted on our website.
13. Contact us
Bespoked Events Ltd, Unit 3, Phoenix Business Park, Continental Approach, Westwood, Kent, CT9 4HL. Email: info@bespoked.cc.
14. For individuals in Japan / 日本にお住まいの方へ
This section supplements this policy under Japan's Act on the Protection of Personal Information (APPI). For this section, the Japanese version prevails.
Operator: Bespoked Events Ltd (address in Section 1). Representative: Petor Georgallou.
Purposes: Ticket sales and entry - Booking communications - Enquiries - Exhibitor management - Newsletters (with your consent) - Event photography for promotion - Legal compliance.
Transfers outside Japan: Your data is handled in the UK, and by our service providers in the US and EU, including Google, Mailchimp, Stripe and Ticket Tailor.
- The UK and the EU are recognised by Japan as having equivalent data-protection standards.
- US providers are bound by contract to take measures equivalent to those required by Japanese law.
Details are available on request.
Security: Internal rules - Staff training - Access controls - Multi-factor authentication - Encryption - Supervision of our providers.
Your rights: You can ask us to disclose, correct, stop using or delete your data, or to stop sharing it with third parties.
- Contact: info@bespoked.cc. There is no fee.
- You can also complain to Japan's Personal Information Protection Commission.