Last updated: 22 January 2026

1) Who we are (Data Controller)

The Oracle Tree (“we”, “us”, “our”) is the data controller for personal information collected via this website.

Contact email:

2) What this policy covers

This policy explains how we collect, use, store and share personal data when you use our website and, in particular, when you submit the stallholder application form.

3) What personal data we collect

a) Data you provide via the stallholder application form

When you apply for a stall, we collect the information you enter into the form. This may include:

  • Your name and/or business name
  • Email address and other contact details you provide
  • Details about your products/services and your application (e.g., requirements, preferences, pricing, descriptions)
  • Marketing information you choose to provide (e.g., bio, website, social media links/handles)
  • Images or files you upload (if the form includes uploads)

You can choose how much information to provide, but some details are required so we can process your application.

b) Website and technical data

Our website may automatically log limited technical information when you visit it (for example: IP address, browser/device type, pages requested, and the date/time of access). This is used for site security, troubleshooting, and performance.

4) How we use your data (purposes)

We use stallholder application data to:

  • Receive and assess your application for a stall
  • Contact you about your application outcome and next steps
  • Administer bookings and event logistics where an application is accepted
  • Keep internal records of applications and stallholder participation
  • Use the marketing information you provide to promote stallholders and events (for example on our website and/or social channels), where relevant

We use technical/server log data to:

  • Maintain the security and operation of the website
  • Diagnose technical issues and prevent abuse

5) Lawful bases under UK GDPR

We process personal data on the following lawful bases:

a) Contract / steps before entering a contract (UK GDPR Article 6(1)(b))

We process your data to take steps at your request before entering into a contract and, if accepted, to manage the booking. This includes handling your application, communicating with you, and administering arrangements for your stall.

b) Legitimate interests (UK GDPR Article 6(1)(f))

We process data where it is necessary for our legitimate interests in running and protecting the event and website, such as:

  • Keeping records of stallholder applications and participation
  • Communicating efficiently with stallholders about applications and logistics
  • Preventing fraud, misuse, or other harmful activity
    We consider and balance these interests against your rights and freedoms.

c) Consent (UK GDPR Article 6(1)(a)) — where applicable

Where we rely on your consent (for example, if you provide optional promotional content and ask us to use it in a particular way), you can withdraw consent at any time by emailing the address above. Withdrawal will not affect processing already carried out before you withdrew consent.

6) How your data is stored

We store stallholder application submissions and related communications in digital systems used to administer applications and events. Access is restricted to those who need it for application handling and event administration.

7) Who we share your data with

We do not sell your personal data.

We may share personal data with service providers who help us operate the website and administer applications/events (for example: website hosting, form processing, email/communications tools, and related IT services). These providers act under our instructions and only process data for the purposes described in this policy.

We may also disclose information if required to do so by law, or to protect rights, property, safety, or the integrity of our event and systems.

8) International transfers

Some of our service providers may process data outside the UK. Where this happens, we use appropriate safeguards recognised under UK GDPR (such as adequacy regulations where applicable, or appropriate contractual protections) to protect your information.

9) How long we keep your data (retention)

We keep personal data only as long as necessary for the purposes set out in this policy:

  • Unsuccessful applications: retained for 12 months after the relevant event date (or application decision, where appropriate)
  • Successful applications/stallholders: retained for 36 months after the relevant event date
  • Accounting records (e.g., invoices/payments): retained for 6 years to meet UK accounting/tax requirements

We may retain data for longer if needed to deal with a dispute, enforce our rights, or comply with legal obligations.

10) Cookies

Our website may use essential cookies required for basic site functionality and security.

11) Your data protection rights

You have rights under UK GDPR, including:

  • Access – request a copy of your personal data
  • Rectification – correct inaccurate or incomplete data
  • Erasure – request deletion of your data (where applicable)
  • Restriction – request limitation of processing in certain cases
  • Objection – object to processing based on legitimate interests
  • Data portability – receive certain data in a portable format
  • Withdraw consent – where processing is based on consent

To exercise your rights, email the address above. We may need to verify your identity before responding.

12) Complaints

If you’re unhappy with how we handle your data, please contact us first at the above address, so we can try to resolve it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO).

13) Security

We take reasonable technical and organisational measures to protect personal data and restrict access to authorised users only. No method of transmission or storage is completely secure, but we work to reduce risk.

14) Children

Our stallholder application process is intended for adults/businesses. If you believe a child has provided personal data via our site, contact us and we will take appropriate steps.

15) Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last revised.