Privacy Policy
Last updated: September 2026
1. Introduction
Mardi Gras Blackpool ("we", "us", "our") is committed to protecting your personal data and your right to privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information within the Mardi Gras app and website, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
Mardi Gras Blackpool, 41-43 Lord Street, Blackpool, Lancashire, FY1 2BD, is the data controller for the purposes of UK GDPR. This means we are responsible for deciding how and why your personal data is processed.
3. Data We Collect
Through the Mardi Gras app we may collect the following types of personal data. Each type below is collected, stored securely, and transmitted encrypted in transit: • Name — your chosen display name, and (optionally) first/last name for your profile • Email address — used to create and sign in to your account • User IDs — an internal identifier linked to your account • Address — optional postal address saved to your profile • Phone number — optional, for your profile • Sexual orientation — optional LGBTQ+ identity you choose to display on your profile • Other personal info — optional pronouns and a short bio on your profile • Purchase history — your booking enquiries, event RSVPs, and loyalty point transactions • Approximate location — country-level location inferred from your IP address for analytics only (we do not access your device's precise GPS location) • Other in-app messages — forum posts, replies, and chat messages you create • Photos — images you upload to the forum, gallery, or your profile • App interactions — anonymised analytics on how you use the app (pages viewed, taps, form submissions) • Other user-generated content — contact enquiries, reviews, and room requests you submit • Other actions — loyalty bar-visit scans, referrals, and event check-ins • Device or other IDs — a push-notification token so we can send you notifications (if you enable them)
4. How We Use Your Data
We process your personal data for the following purposes: • App functionality — to run your account, bookings, loyalty rewards, room requests, and the community forum • Account management — to create and manage your account, display name, and profile • Analytics — to understand how the app is used and improve it (approximate location and app interactions) • Developer communications — to send you booking confirmations, replies to your enquiries, and (with your consent) promotional emails and SMS, plus an optional birthday treat • Personalisation — to show your profile, pronouns, and LGBTQ+ identity as you choose • To comply with legal obligations and licensing requirements You can choose whether to provide optional data (address, phone, sexual orientation, pronouns, bio, photos, and forum content). Some data (email, user ID, push token, and analytics) is collected automatically to keep the app working and is required.
5. Legal Basis for Processing
We process your personal data under the following legal bases: • Performance of a contract: To set up and run your account and provide the services you have requested • Legal obligation: To comply with licensing laws, age verification, and tax requirements • Legitimate interests: To operate our business, ensure security, and improve our services • Consent: For marketing communications, SMS, birthday treats, and non-essential analytics. You can withdraw consent at any time.
6. Data Sharing & Third-Party Processors
We do not sell your personal data. Your data is processed by trusted third-party service providers acting on our behalf (as processors) and bound by contract to protect your information: • Base44 — backend, authentication, database hosting, app analytics, and push notifications • Beds24 — our booking channel manager, to sync your room booking enquiries and availability • Resend — transactional and marketing email delivery • OpenAI — automated moderation of forum posts and replies to keep the community safe • Facebook, Google, and Apple (Sign in with Apple) — optional OAuth sign-in providers • Apple Push Notification service and Firebase Cloud Messaging — delivery of push notifications to your device • QR-code rendering service — generates QR images only; no personal data is sent We may also disclose data to public authorities where legally required (e.g., HMRC, police investigations). Forum content (posts, images) you create is displayed publicly but uses your chosen display name — your real identity is not shown to other users.
7. International Data Transfers
Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area. Where data is transferred outside these areas (for example to the third-party processors listed above), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.
8. Data Retention
We retain personal data only for as long as necessary for the purposes outlined in this policy or as required by law: • Booking and payment records: 7 years (for tax and accounting purposes) • Loyalty account data: While your account is active, plus 2 years after closure • Marketing data: Until you withdraw consent or unsubscribe • Forum posts and chat: Until you request deletion or the content is archived • Analytics data: Retained for up to 1 year • Push notification tokens: Removed when you sign out or disable notifications • CCTV footage (on premises): 30 days, unless retained for investigation purposes
9. Your Rights
Under UK GDPR, you have the following rights: • The right to access — request a copy of the personal data we hold about you • The right to rectification — correct inaccurate or incomplete data • The right to erasure — request deletion of your personal data ("right to be forgotten") • The right to restrict processing — limit how we use your data • The right to data portability — receive your data in a machine-readable format • The right to object — object to processing based on legitimate interests or for direct marketing • Rights regarding automated decision-making — you can request human review of automated decisions To exercise any of these rights, contact us at hello@mardigrasblackpool.com.
10. Deleting Your Account & Data
You can permanently delete your account and the personal data associated with it at any time, directly within the app: • Go to Account → Profile → Danger Zone → Delete Account This immediately removes your account, profile, loyalty data, and personal content. You can also request deletion using our dedicated Account & Data Deletion page, or by emailing hello@mardigrasblackpool.com. Some records (such as booking and tax records) may be retained where we are legally required to do so, as described in the Data Retention section above.
11. Cookies
Our website uses cookies to enhance your browsing experience. Essential cookies are required for the website to function properly and cannot be disabled. Analytics cookies help us understand how visitors interact with our website. Marketing cookies are used only with your consent. You can manage cookie preferences through your browser settings. For full details, see our Cookie Policy.
12. Data Security
We implement appropriate technical and organisational measures to protect your personal data. All data collected by the app is encrypted in transit (SSL/TLS). We also use access controls, secure authentication, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
13. Children's Data
Mardi Gras Blackpool is an adults-only venue (18+). We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us immediately and we will delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
15. Contact
For any data protection enquiries, to exercise your rights, or to submit a complaint, please contact us at: Mardi Gras Blackpool 41-43 Lord Street, Blackpool, Lancashire, FY1 2BD Email: hello@mardigrasblackpool.com If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.