Privacy Policy

1. Who we are

Festriva is a UK-based event vendor marketplace operated by Festriva Ltd. Our platform connects customers planning events with verified event professionals across the United Kingdom. When we refer to "Festriva", "we", "us" or "our" in this policy, we mean Festriva Ltd.

We are committed to protecting your personal data and handling it responsibly in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your data, you can contact us at privacy@festriva.com.

2. What data we collect

We collect the following categories of personal data:

3. How we use your data

We use your personal data for the following purposes:

• To create and manage your account on Festriva
• To facilitate bookings between customers and vendors
• To process deposit payments securely via Stripe
• To send booking confirmations and notifications by email
• To display vendor profiles and portfolios to customers
• To review and approve vendor applications
• To resolve disputes between customers and vendors
• To improve the platform and user experience
• To comply with our legal obligations

4. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract performance — to provide the booking service you have requested
• Legitimate interests — to improve our platform, prevent fraud, and communicate with users
• Legal obligation — to comply with applicable UK law
• Consent — where you have explicitly agreed, such as marketing communications

5. Who we share your data with

We do not sell your personal data. We may share it with:

• Stripe — to process payments securely
• Supabase — our database and authentication provider
• Vercel — our hosting provider
• Law enforcement — where required by law or to protect our legal rights

When a booking is confirmed, limited contact details may be shared between the customer and vendor to facilitate the event.

6. How long we keep your data

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes.

Booking records are retained for 7 years in line with UK financial record-keeping requirements.

7. Your rights

Under UK GDPR, you have the following rights:

• Right of access — to request a copy of the data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restrict processing — to limit how we use your data
• Right to data portability — to receive your data in a portable format
• Right to object — to object to processing based on legitimate interests

To exercise any of these rights, email us at privacy@festriva.com. We will respond within 30 days.

8. Cookies

Festriva uses essential cookies to keep you signed in and to maintain your session. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this may affect your ability to use the platform.

9. Security

We take data security seriously. Your data is stored securely using Supabase with row-level security policies. Passwords are hashed and never stored in plain text. Payment data is handled entirely by Stripe and never passes through our servers.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page and notify registered users by email if the changes are significant.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.