Privacy Notice
This notice explains what personal information The Lab Con collects, why, who we share it with, how long we keep it and the rights you have. We keep it short and plain on purpose. If anything is unclear, just email us.
Who we are
The Lab Conventions Limited (trading as The Lab Con)
6 High Street, Wheathampstead, St Albans, AL4 8AA
Registered in England & Wales, company number 17154627 (registered office as above)
Email: thelabconvention@gmail.com
We are the “controller” of the personal information described here, which means we decide how it is used and are responsible for looking after it under UK data protection law (the UK GDPR and the Data Protection Act 2018).
What we collect and why
If you apply to vend
Through our vendor application form we collect your business name, contact name, email address, phone number, Instagram handle, invoicing name and address, what you sell, any notes you add, and your logo if you upload one.
- To review your application, allocate tables, invoice you and contact you about the event. Lawful basis: contract — we need this information to take steps towards, and then carry out, our agreement with you.
- To keep accounting records. Lawful basis: legal obligation — UK tax law requires us to keep invoices and records of payments.
- To promote confirmed vendors. Once your table is confirmed and paid, your business name, logo, Instagram link, what you sell and which floor you are on appear in the public vendor list on this website, and may appear in our event brochure, floor maps and social posts. Lawful basis: legitimate interests — promoting the event and the vendors at it. Tell us if you’d rather not be listed and we’ll remove you.
If you buy a ticket
Tickets are sold through Eventbrite. Eventbrite collects your order details and passes us the information we need to run the event (such as your name, email address and ticket type). We use it to admit you, contact you about the event (for example a change of time) and handle refunds. Lawful basis: contract. Eventbrite’s own use of your information is covered by Eventbrite’s privacy policy.
If you join our mailing list
We collect your email address to send you news about The Lab Con. Lawful basis: consent. Our mailing list is run by Mailchimp; you’ll be asked to confirm your subscription, and every email has an unsubscribe link. You can withdraw your consent at any time.
If you email us
We use what you send (including your name and email address) to reply and to deal with your enquiry. Lawful basis: legitimate interests — responding to people who contact us.
When you visit this website
- Security. To stop spam and password guessing on our forms, we briefly record a scrambled (one-way hashed) version of your IP address — never the address itself — and delete it within an hour. Our host, Netlify, also keeps standard server logs. Lawful basis: legitimate interests — keeping the site and your data secure.
- No tracking. We don’t use analytics, advertising or tracking cookies, and our fonts are hosted on our own site.
- Files from other services. Some page code is delivered by public content networks (jsDelivr and unpkg), photos in our Instagram feed are loaded from Instagram, and the ticket checkout is provided by Eventbrite. Like any website, those services receive your IP address so they can send the files to your browser.
Cookies and browser storage
We don’t set advertising or analytics cookies. The site stores a few small items in your own browser, only so that features work:
- the latest event dates, so pages show the right date straight away;
- a draft of your vendor application, so you don’t lose it if you leave the page — deleted when you submit;
- a note that you’ve unlocked a password-protected page, so you aren’t asked again.
These are strictly necessary for the features you use, so they don’t need consent. You can clear them at any time in your browser settings. If you use the Eventbrite checkout, Eventbrite may set its own cookies — see their policy.
Who we share it with
We never sell your information. We use these service providers (“processors”), who may only use it to provide their service to us:
| Service | What for |
|---|---|
| Netlify | Hosts this website and stores vendor-application data |
| Cloudinary | Stores logos uploaded with vendor applications |
| Airtable | Secure backups of our vendor admin system |
| Xero | Invoicing and accounts |
| Eventbrite | Ticket sales and check-in |
| Mailchimp | Our mailing list |
| Our email, and the spreadsheet behind the public vendor list |
We may also share information if the law requires it, or with our professional advisers (such as our accountant).
Transfers outside the UK
Some of these providers are based in, or store data in, the United States or the EU. Where information leaves the UK, it is protected by UK-approved safeguards — for example the UK’s adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum to standard contractual clauses.
How long we keep it
| Information | Kept for |
|---|---|
| Vendor applications and vendor records | 2 years after the event you applied for, so we can invite you back and deal with any questions. After that, your details are anonymised — we keep only totals and invoice numbers. |
| Invoices and payment records | 6 years from the end of the financial year they relate to, as required by HMRC. |
| Ticket orders | Held by Eventbrite under their policy. Any attendee lists we download are deleted within 3 months of the event. |
| Mailing list | Until you unsubscribe. |
| Emails to us | As long as needed to deal with your enquiry, and no more than 2 years after our last contact. |
| Scrambled IP records used for security | Up to 1 hour. |
How we protect it
Our admin system is password protected, with lockouts against password guessing, and is only used by our team. Data is sent over encrypted (HTTPS) connections and stored with reputable providers. Payment card details are handled by Eventbrite and never reach us.
Your rights
You have the right to:
- access the information we hold about you and get a copy;
- correct anything that is wrong or incomplete;
- erase your information, where we no longer have a good reason to keep it;
- restrict how we use it, or object to us using it on the basis of legitimate interests (including the public vendor list);
- take information you gave us to another organisation (data portability);
- withdraw consent at any time, for anything we do based on consent (such as the mailing list).
To use any of these rights, email thelabconvention@gmail.com. It’s free, and we’ll reply within one month. We may need to confirm who you are first. Some information, such as invoices, has to be kept by law even if you ask us to erase it — if so, we’ll tell you.
Complaints
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
We’ll update this page if the way we use information changes. The date at the top shows when it was last updated.