Privacy Policy – Hastings Flyer

Last updated: 21 September 2026

Hastings Flyer is a gig guide. Most of what we hold is information about events — who is playing, where and when — which is not personal data at all. This page covers the parts that are: your account if you make one, your details if you claim a listing or send us a gig, and what happens in your browser while you read the site.

We have written it in plain English rather than legal boilerplate, because a policy nobody reads protects nobody.

Who we are

The data controller for this site is Love Hastings Ltd (company number 10573685), registered at Rock House, Cambridge Road, Hastings, TN34 1DT, trading as Hastings Flyer.

Registered with the Information Commissioner’s Office, registration number ZA481969.

What we collect, and why

If you just read the site

Our web server keeps standard access logs — the page requested, the time, your IP address, your browser and where you came from. These are kept for security and to work out what is broken. We do not use them to build a profile of you.

We also count visits, using software that runs on our own server and stores nothing on your device. More on that under Counting visits.

If you create an account

Accounts are handled by UsersWP and BuddyPress. We hold the username, email address and password you set, anything you choose to put on your profile, and the date you joined. Your password is stored hashed — we cannot read it and neither can anyone who obtains the database.

If you upload an avatar it is stored on our server. If you do not, the site may request a picture from Gravatar using a scrambled version of your email address; Gravatar will see your IP address when it does.

If you claim a venue, promoter or event listing

Claiming tells us you are connected to a listing and would like to edit it. We hold your name, email address, the listing concerned and anything you send us to show the connection is real. We keep the record of an approved claim for as long as you hold the listing, so we know who is responsible for what is published on it.

If you send us a listing

Promoters, venues and artists send us gigs by email, by form and through public feeds. Business contact details — a promoter’s email, a venue’s phone number — are held so we can check a date, chase a change or tell you something has gone wrong. We do not publish a contact that was given to us privately.

If you are listed and would rather not be, or the details are wrong, email us and we will fix it. That includes taking a listing down.

If you join the mailing list

We send an occasional email about what is on. You get it because you asked for it, and every one carries an unsubscribe link that works immediately. We hold your email address and the date you signed up. We do not sell or share the list, and we do not pass it to other promoters.

If you email or phone us

We keep the correspondence so we can follow it up and remember what was agreed. Nothing more.

Cookies and what is stored in your browser

You will see a banner the first time you visit. The full list of what this site stores — each item, what it is for and how long it lasts — is on the cookie policy, which is rebuilt from a monthly scan of the site so it does not go stale. In short:

Strictly necessary — always on

A cookie recording your choice on the banner itself, so we stop asking.
WordPress login and session cookies, set only if you sign in.
Security cookies that protect forms from being submitted by somebody else.

These do not need your permission because the site cannot work without them.

Preferences — stored on your device only

The directory remembers a couple of things locally to make it less annoying: the listings you have recently looked at, and where you were in a long list. These sit in your browser’s own storage, are never sent to us, and clearing your browser data removes them.

Counting visits

We use Burst Statistics, which runs on our own server rather than somebody else’s. It tells us how many people read a listing and which pages are worth keeping.

It is set up to store nothing on your device — no cookies, no identifiers — and what it produces are counts, not profiles. Nothing it collects goes to another company, is used for advertising, or is combined with anything from another website. Because it neither stores nor reads anything on your device, it does not need your permission to run; because it does not identify you, there is nothing in it we could hand back if you asked.

We used to use Google Analytics. It has been removed, along with the Google tag that loaded it. No part of your visit goes to Google any more.

Other people’s services on our pages

Some parts of the site are served by third parties, which means your browser contacts them directly and they see your IP address. We use as few as we can, and there are no advertising or social-media trackers on this site.

Our typefaces are served from our own server rather than from Google, so reading the site does not tell Google anything about you.

Font Awesome — the icons used around the site.
Gravatar — profile pictures, as described above.
OpenStreetMap — venue maps. A map does not load until you click to open it, so if you never open one your browser never contacts them.
Our host — who necessarily processes everything the site does, under a contract that requires them to keep it confidential.

Ticket links point to Skiddle, Ticket Tailor, venue box offices and others. Once you click through you are on their site under their privacy policy, not ours. We get no commission and we do not receive anything back about what you bought.

Why we are allowed to hold it

Consent — the mailing list. You can withdraw it whenever you like.
Legitimate interests — running a gig guide, publishing listings, keeping the site secure and working, counting visits in a way that identifies nobody, and holding business contact details for the people who send us events. We have weighed this against your privacy and think a public listing of public events is what everybody involved expects.
Contract — your account and any listing you claim, because we cannot provide those without the details.

How long we keep it

Accounts — until you close them, or after a long period of inactivity.
Claims — while you hold the listing, and a record of the approval afterwards.
Mailing list — until you unsubscribe.
Server logs — a short rolling period, then overwritten.
Visit counts — kept as totals, which are not about anyone in particular.
Email — as long as it is useful, then deleted.
Listings — past events stay on the site as a record of what happened here. That is the point of an archive.

Who else sees it

Nobody, beyond the services named above and anyone we are legally required to tell. We do not sell data. We do not share the mailing list. We do not run advertising on this site, and nobody pays us to promote a listing.

Where it is held

The site, its database and its visit counts are hosted in the UK or the European Economic Area, and stay there. Nothing about your visit is sent abroad for analytics, because the software that counts visits runs on the same server as the site. The only things that leave it are the icon, avatar and map requests listed above, and only when a page actually needs one.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, restrict what we do with it, or send it to you in a portable form. You can object to processing we do on legitimate interests. You can withdraw consent for the mailing list at any time without giving a reason.

Email john@hastingsflyer.com and we will deal with it within a month. There is no charge.

If you are not happy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you came to us first so we can put it right.

Children

This site is a gig guide for a general audience and is not aimed at children. We do not knowingly hold personal data about anyone under 13. Some listings are marked as all-ages events; that concerns who may attend a gig, not who may use the site.

Security

The site runs over HTTPS, passwords are hashed, and access to the database is limited to the people who run it. No website can promise perfect security, but we do not collect much, which is the most reliable protection there is.

Changes

When this page changes we will update the date at the top. If a change actually affects you — a new third party, a new use of your data — we will say so on the site rather than quietly editing this page.