Privacy Notice
Last updated 25 September 2026
Who we are
Bath Balls is a trading name of Xongile Limited, company number 15928544, registered office 128 City Road, London EC1V 2NX. Xongile Limited is the controller of the personal information described here. Contact us about anything in this notice at hello@bathballs.uk.
What we collect, why, and our lawful basis
| Information | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|
| Buyer's name, email address and phone number; each guest's name | To sell tickets, send tickets, and contact you about your booking | Contract (Article 6(1)(b)) |
| Payment details | Card payments are taken by Stripe. We never see or store card numbers. We receive the amount, the date, Stripe's fee and a payment reference. | Contract; legal obligation to keep accounting records (Article 6(1)(c)) |
| Each guest's age group on the date of the event (16 or 17, or 18 and over) and an emergency phone number | To apply the age rules, including who may be served alcohol, and to contact someone if a guest is ill, hurt or needs collecting | Contract; legitimate interests in running a safe event (Article 6(1)(f)); vital interests in an emergency (Article 6(1)(d)) |
| For release and indemnity forms signed before 25 September 2026: the guest's date of birth; the emergency contact's name, relationship, phone and email; the name and capacity (guest, parent or guardian) of the person who signed; when, and the internet address and browser used | To keep a record of the indemnity and release that was agreed | Legitimate interests in being able to show what was agreed (Article 6(1)(f)) |
| Time of entry | To make sure each ticket is used once and to know who is in the building | Legitimate interests in security and safety |
| Photographs and video taken at the event | To provide a private gallery to ticket holders | Legitimate interests in recording the event for those who attended |
| Photographs and video published on bathballs.uk or social media | To show and promote Bath Balls events | Consent (Article 6(1)(a)), given when tickets are bought or on the guest's ticket, and withdrawable at any time |
We only send emails about your booking. We do not send marketing emails.
Guests under 18
Guests aged 16 and 17 may attend. For them, the emergency phone number must be a parent's or guardian's. The photography choice is made by whoever buys the ticket; the guest can change it from their ticket, and a parent or guardian can ask us to change it at hello@bathballs.uk.
Who we share it with
- Cloudflare hosts this website and its database, and forwards email sent to bathballs.uk addresses.
- Stripe takes card payments.
- Resend sends our emails.
- Our event photographer and the gallery service used to share photographs with ticket holders, under contract with us.
- The venue, event security and the emergency services, only where needed to deal with safety, an incident or an emergency.
- Our accountants and HM Revenue & Customs, for accounting and tax records.
We do not sell personal information.
Transfers outside the UK
Cloudflare, Stripe and Resend may process information in the United States and other countries. Where they do, the transfer is protected by the UK-US data bridge where the provider is certified under it, or by the UK International Data Transfer Addendum to the EU standard contractual clauses in their data processing terms.
How long we keep it
| Information | Kept until |
|---|---|
| Details entered for a checkout that was never paid | 30 days after the checkout was started |
| Emergency phone numbers, and the emergency contact details on forms signed before 25 September 2026 | 30 days after the event |
| Buyer's name, email and phone; guest names on tickets; entry times and the log of door scans | 12 months after the event |
| The record of a release and indemnity form signed before 25 September 2026 (guest's name and date of birth, who signed and in what capacity, when, the form version and the photography choice) | 3 years after the event, or the guest's 21st birthday if later, because that is how long a claim for injury can be brought |
| Order totals, dates and payment references (with names removed after 12 months) | 7 years after the event, for tax and accounting |
| Photographs in the private gallery | 12 months after the event |
| Photographs we have published | Until the guest (or their parent or guardian) withdraws permission |
Organisers and door staff
If you have an organiser or door account, we keep your name, email address, your password (stored only in a scrambled form that cannot be turned back into the password) or your Google account identifier if you sign in with Google, when you signed in, and which door scans you made. We use this to control who can see guest information, on the basis of our legitimate interest in keeping it secure. Accounts that are never confirmed are deleted after 7 days, and accounts that are declined or removed are deleted 30 days later. If you sign in with Google, Google tells us your name and email address; Google's own privacy policy applies to your Google account.
Your rights
You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to have it transferred to you in a usable format, and to withdraw consent at any time. Email hello@bathballs.uk. We will reply within one month.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, but we would appreciate the chance to put things right first.
Cookies
This website sets no advertising or analytics cookies and loads no tracking scripts. Our fonts are served from our own website. The only cookies are sign-in cookies used by event organisers and door staff. When you pay, Stripe's payment page sets its own cookies to prevent fraud, as described in Stripe's privacy policy.
Changes
We will post any changes to this notice on this page and update the date at the top.