Prototype policy

Privacy, in plain English

We use your email address to remember your digital stamps and contact prize draw winners. Marketing is optional and never required to take part.

What we store

Your email, optional name, consent choice, venue stamps, prize eligibility and any message you send to the festival team.

Returning to your passport

For email login, our configured email provider (Brevo or Resend) delivers a one-time code to the email address on your passport. The code expires after 10 minutes and can only be used once. We store a protected version of the code, its expiry and the number of attempts. These login emails are separate from optional marketing.

Participating businesses

For a business setup request, we store your chosen venue, business email, representative name, role, optional phone number and the request’s review status. For a confirmed business account, we also store the venue and offer reviewed, participation statement and version, and when it was accepted. Business login uses a one-time emailed code and a separate necessary sign-in cookie. Approved festival organisers can also use their Google sign-in to open business tools for venue accounts registered to the same verified email; this does not change the business owner or participation record. Older participation records may retain the original site sign-in identifier. These records connect the business to its offer controls and staff QR code. The representative with verified access to the registered business email can manage their venue; authorised festival organisers can review participation status.

Venue visit records

The participating business where you collect a stamp can see your optional first name, the time of that verified visit and a reference specific to that venue. This helps staff understand their festival activity. Your email address, messages and visits to other venues are not included in the business visit list or its export.

Festival organisers

Approved organisers sign in with Google. We store their Google account identifier, verified email and name to identify who can use the control room. A necessary organiser sign-in cookie lasts up to 12 hours; signing out revokes that session. Signing out of the business page also revokes an organiser session in the same browser. A separate temporary cookie protects the Google sign-in request and expires after 10 minutes. Google authenticates the account; we do not store Google passwords or Google access, refresh or identity tokens.

Cookies

A necessary sign-in cookie keeps you signed in to your passport between visits. You can log in with your email address on any device. No optional analytics or advertising cookies are used. The organiser dashboard reports aggregate verified visits and passport activity from the records needed to operate the trail.

Interactive map

The map loads tiles from OpenStreetMap. Your browser connects to their servers to display the map; directions open Google Maps only when you choose that link.

Your choices

You can ask Southend City BID to access, correct or delete your information. Final retention periods and contact details will be confirmed before launch.

This is placeholder copy for prototype testing and should receive a final GDPR review before the public campaign.