Privacy policy

Who we are

This website is run by BCDA-UK, the UK chapter of BCA Europe, which hosts the BCA Europe Convention 2027. For the personal data collected through this website, BCDA-UK is the data controller. That means we decide why and how your data is used, and we are responsible for looking after it.

You can contact us about anything in this policy at hello@bcaeurope.org, or through the contact form (choose “Something else”). We follow the UK General Data Protection Regulation (UK GDPR) and, for visitors in the European Union, the EU GDPR.

The short version

We only ask for what we need to run the convention and to answer you.
We don’t use advertising or tracking cookies, and we don’t sell or share your data for marketing.
We never collect children’s names through our forms. Party sizes are counts only.
Your data is stored in the EU or the UK, and deleted when we no longer need it.
You can ask to see, correct or delete your data at any time.

What we collect and why

We only collect personal data that you give us through a form. Each form says what it is for, next to the consent box.

Register interest and waitlist

Your name, email address, chapter, the country you live in (optional), how many adults, young people and children might come (numbers only), your preferred language and, for the waitlist, the pass you’d like. We use it to tell you when passes go on sale and to plan the convention. Lawful basis: your consent. You confirm your email address before we send you anything (double opt-in).

Contact form

Your name, email address, the topic and your message. We use it to reply to you and to pass your message to the right workstream. Lawful basis: our legitimate interest in answering the questions people send us.

Your organisation, name, role, email, phone number (optional), interests or stand details, and for food vendors your hygiene rating, allergen information and insurance certificate. We use it to discuss sponsorship or to assess your application. Lawful basis: steps taken at your request before entering into a contract, and our legitimate interest in running the convention.

Volunteer form

Your name, email address, chapter, age group, the roles and days you’re interested in, any notes, and for under-18s a parent or guardian’s email address. We use it to organise volunteers. Lawful basis: our legitimate interest in organising the convention safely, and, for under-18s, the consent of a parent or guardian. Adults working with children are asked for an enhanced DBS check (or an equivalent); that check is handled separately and securely, under the safeguarding policy.

Invitation letters for visas

Your full name as in your passport, nationality, passport number, travel dates and registration reference. We use it only to prepare a letter of invitation. Lawful basis: steps taken at your request. This data is encrypted at rest and kept for the shortest time possible.

Your email address, language and, for some lists, your name, chapter or interests. We use it to send you the updates you asked for. Lawful basis: your consent, which you can withdraw at any time with the link in every email.

Bali Passes

Passes are bought in the separate registration app, not on this website. The app has its own privacy notice, which you’ll see before you pay.

How long we keep it

We keep data only as long as we need it, and a scheduled job deletes it automatically when the period ends. These periods are proposed and will be confirmed by the steering group.

Interest list and waitlist: until 31 December 2027.
Contact messages: 12 months after our last reply.
Sponsor enquiries: until 31 December 2027, or longer if we sign a partnership agreement with you.
Exhibitor and vendor applications: until 31 December 2027; uploaded documents are deleted 90 days after the convention.
Volunteer details: until 31 December 2027, except records we must keep longer for safeguarding.
Invitation letter data: 30 days after the letter is issued.
Newsletter: until you unsubscribe.

We never sell your data. Only the convention team and the workstream that needs it can see your submission. We use a small number of trusted service providers (processors) who handle data on our behalf, under data processing agreements:

Cloudflare: hosts this website, runs our forms, stores submissions and uploads in its EU data centres, and protects the forms against spam (Turnstile).
An email provider: sends replies, confirmations and notifications to the right inbox.
A newsletter tool: manages the interest list and newsletter, including double opt-in and unsubscribe.
A cookieless analytics provider: counts visits to pages without identifying you.

We’ll name each provider here once contracts are signed. We choose providers that store data in the UK or the EU, or that offer equivalent protection.

Cookies and similar technologies

This website sets no cookies by default, so there is no cookie banner.

Your theme choice (light, dark or high contrast) is stored in your browser’s local storage. It never leaves your device.
If you choose a language with the language switcher, we may remember it in a small cookie so you see the site in that language next time.
Our analytics are cookieless and don’t track you across sites.
Videos, maps and the charity’s live total load only after you click, with a note explaining what will load.

If we ever add a non-essential tracker, we will ask for your consent first.

Your rights

You have the right to:

ask for a copy of the data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data;
ask us to restrict or stop using your data, or object to how we use it;
receive your data in a portable format;
withdraw your consent at any time, without affecting what we did before.

To use any of these rights, email hello@bcaeurope.org. We’ll reply within one month, and we may need to confirm your identity first.

Complaints

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. If you live in the EU, you can also contact the data protection authority in your country.

Children

Our forms never ask for children’s names. When you tell us who might come, we only ask for numbers of adults, young people and children. Young people under 18 who offer to volunteer need a parent or guardian’s consent, and we contact that adult before giving them a role. Children under 13 should ask a parent or guardian to fill in any form for them.

Security

Forms are sent over an encrypted connection, protected against spam and abuse, and stored in access-controlled systems. Staff access is limited to the people who need it and protected by sign-in checks. Uploaded files are stored privately and checked for viruses before anyone opens them.

Changes to this policy

We’ll update this policy when our services or the law change. The version and the date at the top of the page always show the latest update. If a change affects how we use data you’ve already given us, we’ll tell you by email.