Privacy Policy | Leigh Park Fest

Who we are

Niffty Witchy Supplies Limited is the data controller for the Leigh Park Fest website and shop, festival enquiries and trader applications. We decide why and how the personal information covered by this notice is used.

We are registered in England and Wales under company number 16716304. Our registered office and business address is 28 Park Parade, Havant, Hampshire, England, PO9 5AD.

Information we collect

Shop orders. We use the details needed to arrange your purchase, including your name, billing and delivery information, contact details, items ordered, order value, payment status and related order correspondence. Payments are processed through Square. Customer account registration is currently disabled, so you can order as a guest.

Payments are processed by Square. Saving payment-card details for later purchases is not enabled in this shop.

Trader applications. Our form asks for your full name, business or trading name, email, phone number, trader type, selected pitch size and applicable fee, postal address, stall or product information and setup notes. Registered-charity applicants must provide a charity registration number. The form also requires a public liability insurance certificate and a JPEG or PNG photo of your stall or ride. The photo is used privately to assess your application and is not published on our website or social media. Please avoid including identifiable people.

Trader submissions, including the uploaded insurance certificate and stall or ride photo, are emailed privately to info@leighparkfest.uk. The form’s temporary upload is removed after sending; the emailed copy and attachment remain subject to our mailbox retention arrangements.

Enquiries. When you email or phone us, we use your contact information and the information you provide to deal with your enquiry.

Website use. The website has analytics, order-attribution and embedded-map features, described below. These can involve information about your device, pages visited and how you reached the site.

Why we use information

Purchases and order support: to take payment, fulfil orders and handle delivery, cancellations and refunds. For the customer placing the order, the lawful basis is performance of a contract or taking requested steps before a contract.
Required records: to keep accounting records and meet applicable legal duties. The lawful basis is compliance with a legal obligation.
Festival enquiries and trader applications: to answer questions, assess applications, check the supplied insurance evidence, review the stall or ride photo and administer participation. We rely on our legitimate interests in answering enquiries, assessing trader applications and administering the festival. Where processing is necessary to take steps you request towards a contract, or to fulfil a contract with you, we rely on that contract.
Information about a delivery recipient who is not the purchaser, or a business contact acting for an applicant: we use this information in our legitimate interests in completing the requested delivery or handling the organisation’s application.
Site operation and troubleshooting: our shop software records diagnostic information to help identify errors and keep the shop working. Where this contains personal information, we use it in our legitimate interests in operating a reliable and secure service.
Optional analytics, order attribution and embedded maps: with your consent, we measure website use, understand how visits lead to orders and display the embedded Google Map. We rely on consent for these optional technologies and the related personal-information processing. You can change or withdraw your choice through Cookie Settings.

We need sufficient order and delivery details to fulfil a purchase. We also need the required trader-application information to assess an application. Without those details we may be unable to process the purchase or application.

Email updates

If you choose to subscribe, Niffty Witchy Supplies Limited will use your email address to send Leigh Park Fest news and event updates. We rely on your consent. Signup is optional and separate from buying merchandise, attending the festival or making a trader application.

Our form asks only for your email address and an unticked consent choice. We send a confirmation email and add you to the active mailing list only after you confirm. We keep your subscription status and dated records of subscription, confirmation and withdrawal to manage the list and demonstrate your choices.

The mailing list is held in the Newsletter plugin on our website and emails use our existing website and email services provided by Fasthosts. We have disabled newsletter open and click tracking and do not store IP addresses in the newsletter subscriber records.

You can withdraw consent at any time using the unsubscribe link in an email or by contacting info@leighparkfest.uk. We keep active subscription details while you remain subscribed and the service continues. After withdrawal, we retain the minimum suppression and consent records needed to respect your choice and handle any related enquiry or complaint. We review mailing-list records after each festival and remove information that is no longer needed. We do not send promotional text messages.

Who receives information

Inkthreadable: Hyper Merch Limited, trading as Inkthreadable, receives your name, delivery address and relevant order details to print and dispatch merchandise. Its privacy policy explains its processing.
Delivery providers: delivery information is used to deliver your order, including by Royal Mail for the standard service.
Square: processes payments and related transaction information. Square also processes some information for its own purposes, including security and legal requirements, as explained in its buyer privacy notice.
Google: when you consent to the relevant feature, Google Analytics 4 receives website-use information and the embedded Google Map connects your browser to Google. See the cookies section below and Google’s privacy policy.
Automattic/WooCommerce: WooCommerce usage tracking is enabled in the current configuration. The provider’s documentation describes store-configuration and usage statistics and, when attribution is enabled, statistical order-attribution information. It says the latter excludes customer email, billing and shipping details.
Website hosting and email: we use Fasthosts Internet Limited to provide website hosting and email services. These services support website operation and the delivery and storage of communications, including trader applications and their attachments. Its data processing agreement describes processing on customers’ behalf.

Trader applications, insurance certificates and stall or ride photos are handled by Niffty Witchy Supplies Limited. We do not share them with other event organisations. The website-hosting and email services described above support their submission and delivery.

International processing

Some of our service providers operate internationally, so information may be processed outside the UK, including in the United States. The safeguards depend on the provider and the processing involved.

Google’s Analytics transfer information and its general transfer framework describe recognised adequacy arrangements, including the UK Extension to the EU–US Data Privacy Framework where applicable, and standard contractual clauses for other relevant transfers. Automattic describes using standard contractual arrangements approved for transfers from the UK. Square’s published terms require applicable transfer safeguards and explain how to request further details.

Fasthosts’ processing agreement says its services normally involve processing mainly in the UK or European Union, with transfers elsewhere where necessary and subject to applicable data-transfer requirements. Inkthreadable’s privacy policy also describes the possibility of international processing and its commitment to protective controls.

You can contact info@leighparkfest.uk for information about the safeguards relevant to our use of these providers.

How long information is kept

We determine retention using the purpose of the information, the status of an order, enquiry or application, the relevant event date, any unresolved refunds or complaints, and applicable legal requirements.

After each festival, we review old enquiries and trader paperwork, including application correspondence, selected pitch size and fee, insurance certificates and stall or ride photos, and remove information that is no longer needed. We keep records that are still needed for accounts, complaints or legal obligations. This is a review-based policy, not an automatic deletion schedule.

Accounting records: records required for company tax are retained for six years from the end of the relevant company financial year, or longer where legally required. This does not mean that every enquiry, certificate or analytics record needs to be kept for six years.
Order correspondence and unsuccessful orders: retain the information needed while payment reconciliation, fulfilment, refunds or related enquiries remain open. Review other details once those purposes end, taking account of any specific dispute or legal duty.
General enquiries: keep the information while answering the enquiry and dealing with related follow-up. Review it once the matter is closed; retain more only where a continuing purpose is identified.
Trader applications, insurance certificates and stall or ride photos: retain information needed for selection and, for successful applicants, the relevant event and its administration. Review it after the application or event concludes, considering unresolved complaints, insurance matters or claims. Keep only the information needed for any continuing purpose.
Analytics and technical records: retention depends on the relevant service settings and the continuing need to measure website use, resolve faults, prevent misuse or meet legal requirements. We consider the age and relevance of the information and whether the issue or analysis remains active. Cookie information is also subject to its configured expiry and the choices available through Cookie Settings and your browser. Email correspondence and attachments follow the enquiry, order or trader-record criteria above. Copies held in backup systems follow the applicable retention and recovery processes and may not be removed at the same time as the active record.

Cookies and similar technologies

We use necessary technologies to operate the shop and remember your privacy choices. Optional analytics, order-attribution and embedded-map features are controlled by your cookie choices.

Necessary shop functions: WooCommerce uses basket and session information to remember your selections and support checkout. Necessary shopping and payment functions remain available when you reject optional cookies.
Google Analytics 4: with statistics consent, we use Google Analytics to measure website use. Its first-party cookies include _ga and _ga_FXJW85BYQ7. The Analytics tag is blocked until statistics consent is given.
WooCommerce order attribution: with the relevant optional consent, Sourcebuster-based sbjs_* cookies record referral or campaign information and session/device details. This helps us understand how visitors reach the shop and can be stored with an order.
Google Maps: the homepage map stays blocked until the relevant consent is given. Loading it connects your browser to Google, which processes information under its own privacy policy.

Use Accept to allow the optional categories, Reject to refuse them, or Preferences to choose. You can reopen Cookie Settings to change or withdraw your choices.

Withdrawing statistics consent switches off this site’s Analytics tag and clears the first-party Analytics cookies controlled by the site. You can also remove cookies through your browser settings. Withdrawal does not delete information already received by a provider or automatically remove cookies controlled by another website. Necessary basket information is preserved.

Your rights

Depending on the circumstances and lawful basis, you can request access to your information, correction, deletion, restriction or a portable copy. Some rights have exceptions, including where information is needed to meet a legal duty.

Your right to object: you can object to processing based on legitimate interests. You can object to direct marketing at any time.

Where processing relies on consent, you can withdraw it. Withdrawal does not change the lawfulness of processing that took place before withdrawal.

Contact info@leighparkfest.uk to ask about your rights or raise a privacy concern. You also have the right to complain to the Information Commissioner’s Office.

Last updated: 9 October 2026.