Information We Collect
We only collect the minimum personal information necessary to provide our services. GatherUK collects information that you provide directly to us, including:
- Name and email address when you register as a member
- Optional interests on My Profile — used only to help you search for groups and see on-site suggestions while browsing GatherUK; never for promotional emails or marketing
- Profile information you choose to share
- Group memberships and event RSVPs
- Messages and communications within groups
Our WordPress database is hosted on UK-based servers. We use only essential plugins to maintain the platform; any third-party services that process data outside the UK are vetted to ensure they comply with the UK-US Data Bridge or equivalent Standard Contractual Clauses.
Data Controller
GatherUK is the data controller for your information. Our website and databases are hosted on UK-based servers operated by Hostworld. We manage the WordPress application and its contents on this infrastructure.
We are registered with the Information Commissioner's Office (ICO); our ICO Reference is ZC101550. If you have any questions about how your data is handled, or if you wish to exercise your rights under UK GDPR, you can contact us using the details provided in the "Contact Us" section of this policy.
Children's Data
GatherUK is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected data from a person under 18, we will delete that information and terminate the associated account.
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Send you event notifications and updates
- Facilitate communication between group members
- Process payments for events and subscriptions
- Respond to your enquiries and provide customer support
Legal Basis for Processing
Under UK GDPR, we process your personal information based on the following legal bases:
- Contractual Necessity: We process your data to provide the services you signed up for, such as sending event updates, facilitating group communications, and processing payments. This is necessary to perform our contract with you.
- Legitimate Interests: We process your data to improve our platform, prevent fraud, ensure security, and maintain the integrity of our services. We only do this where our legitimate interests do not override your rights and freedoms.
- Consent: For marketing communications (such as newsletters or suggested events that aren't strictly part of a group you've joined), we will only send these if you have opted in. You can withdraw your consent at any time.
Information Sharing
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
- With Group Admins and Event Hosts for the groups you join
- With other group members as part of normal group functionality
- When required by law or to protect our rights
- With trusted third-party service providers who assist us in operating our platform, including:
- Payment processor (Stripe) — to process card payments (including Stripe Connect for organiser payouts). Stripe receives payment information necessary for the transaction; GatherUK does not store your full card details.
- Email delivery (Amazon Web Services SES) — to send transactional emails, event notifications, and group messages you have opted into or that are essential to the service.
- Postcode lookup services (postcodes.io) — to help you find events and groups near you. Only your postcode is shared, not your personal information.
- Cloudflare — for content delivery, security (including DDoS protection), and Turnstile bot detection on our sign-in and registration forms. Cloudflare may process your IP address and browser environment signals. Turnstile does not use personal data for advertising. Cloudflare's privacy policy governs this processing.
- Social login providers (e.g. Google) — if you choose to register or log in using a social account, the relevant provider shares your name and email address with us to create or access your GatherUK membership. We do not receive your social media password or post on your behalf.
- Web push notifications (browser) — if you opt in to browser push notifications, your browser generates a unique push subscription token which is stored securely on our servers. This token contains no personal information but allows us to deliver notifications to your browser. You can withdraw consent at any time through your browser settings or your GatherUK profile.
- Google Analytics — to analyse website usage and improve our platform. Google Analytics collects anonymised data about how you interact with our website, such as pages visited and time spent on pages. This data is used to understand user behaviour and improve our services.
- Didit (identity verification for Group Admins) — When you create a group on GatherUK, we are required to confirm that you are 18 or over. We use Didit, a third-party identity verification service, to carry out this one-time check. You will be asked to take a brief selfie; Didit's AI estimates your age from your face and, in edge cases where age cannot be determined from a selfie alone, may ask you to provide a government-issued ID document. GatherUK does not store your selfie or any ID document — these are processed and held securely by Didit in accordance with their own Privacy Policy. GatherUK only receives a pass/fail outcome and a timestamp confirming the check took place. For more information see didit.me/privacy.
All service providers are contractually required to protect your information and use it only for the purposes we specify. We do not sell your data to any third parties.
International Data Transfers
Your personal data is primarily stored and processed in the United Kingdom on UK-based servers operated by Hostworld.
Some of our service providers may also process data outside the UK, including Stripe (payment processing), Didit (identity verification), Cloudflare (security and content delivery), Amazon Web Services (email delivery via SES), Google (Analytics and optional social login), and other providers listed in the "Information Sharing" section above.
When we transfer your personal information to those providers, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements. All third-party providers processing outside the UK are either certified under the UK-US Data Bridge or bound by Standard Contractual Clauses.
Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.
We use industry-standard TLS encryption for all data in transit. All user passwords are cryptographically hashed using WordPress security protocols, meaning we never store or see raw passwords. Our data is stored on RAID-protected SSD storage within a secure UK-based datacentre.
We regularly audit our security protocols and limit administrative data access to a need-to-know basis to ensure the highest levels of member privacy.
Data Retention
We retain your personal information for as long as your membership is active or as needed to provide you with our services. If you leave GatherUK, we will remove your personal data within 30 days, except where we are required to retain it for legal or tax purposes (for example, payment records for accounting and tax compliance). In such cases, we will only retain the minimum amount of data necessary and will delete it once the legal retention period has expired.
Biometric Data (Group Admins only)
If you create a group on GatherUK, you will be asked to complete a one-time age and identity check using Didit. This check may involve processing a selfie image using AI-based age estimation, which constitutes biometric data under UK GDPR (Article 9). We process this data on the basis of your explicit consent, given at the point of verification.
- Your selfie and any ID document are processed by Didit — not stored on GatherUK servers.
- GatherUK receives only a pass/fail outcome and a timestamp. We do not receive or store your face image, biometric template, or document details.
- Didit deletes the verification data after the check is complete in accordance with their retention policy.
- You may withdraw your consent at any time by contacting us. Withdrawal will not affect the lawfulness of any processing already carried out, but will mean your group can no longer remain active as we cannot confirm organiser eligibility.
For full details of how Didit handles biometric data, see didit.me/privacy.
Automated Decision-Making
The Didit age estimation check uses AI to assess whether a Group Admin is 18 or over from a selfie. Where the AI result is clear, verification is automated. Where the result is ambiguous, Didit may request a document and apply a human review step. GatherUK does not make any further automated decisions that produce legal or similarly significant effects on you.
Your Rights
Under UK GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request deletion of your data
- Object to processing of your data
- Data portability
- Restrict our processing of your personal data in certain circumstances
- Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated
To exercise these rights, please contact us.
Marketing & Opt-Outs
We will only send you marketing communications (such as newsletters or suggested events that aren't strictly part of a group you've joined) if you have opted in to receive them. You have the right to withdraw your consent to marketing communications at any time. You can opt out of marketing communications by:
- Clicking the "unsubscribe" link in any marketing email we send you
- Updating your preferences in your profile settings
- Contacting us directly to request removal from our marketing lists
Please note that even if you opt out of marketing communications, we will still send you essential service-related communications (such as event notifications for groups you're part of, account updates, or important platform announcements) as these are necessary to provide you with our services. These essential communications are not considered marketing and cannot be opted out of.
Links to Other Websites
Our platform may contain links to third-party websites (such as event venues or Event Host websites). We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party websites you visit.
Cookie Policy
We use cookies and similar technologies to enhance your experience on GatherUK. This section explains what cookies we use, why we use them, and how you can manage your preferences.
What Are Cookies?
Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. They help websites remember your preferences and improve your browsing experience.
Categories of Cookies We Use
Essential Cookies
These cookies are necessary for the website to function and cannot be switched off. They are usually only set in response to actions made by you, such as:
- Logging in with your member details
- Setting your privacy preferences
- Maintaining your session while you browse
- Remembering your cookie consent choices
Duration: Essential cookies typically last for the duration of your session or up to 1 year for preference cookies.
Analytics Cookies
We use Google Analytics 4 (GA4) to understand how visitors interact with our website. These cookies help us:
- Analyse website traffic and usage patterns
- Understand which pages are most popular
- Identify areas for improvement
- Measure the effectiveness of our platform
Important: We use Google Consent Mode v2, which means Google Analytics cookies will only be set after you have given your consent. If you do not consent to analytics cookies, Google Analytics will not run, and no analytics cookies will be placed on your device.
Cookies used: Google Analytics uses cookies such as _ga, _ga_* (where * is your Measurement ID), and _gid to distinguish users and track sessions.
Duration: Analytics cookies typically last for 2 years, but are only set if you consent to analytics cookies.
Data anonymisation: We have configured Google Analytics to anonymise IP addresses, meaning your full IP address is not stored or transmitted to Google.
Managing Your Cookie Preferences
You have full control over which cookies you accept. When you first visit GatherUK, you will see a cookie consent banner where you can:
- Accept All: Accept all cookies, including analytics cookies
- Reject All: Only accept essential cookies (analytics cookies will not be set)
- Manage Preferences: Choose which categories of cookies you want to accept
Changing Your Cookie Preferences
You can change your cookie preferences at any time by:
- Using the Cookie Settings button (🍪) in the site footer
- Using your browser settings to manage or delete cookies (see below)
When you change your preferences, we will update your cookie consent and reload the page to apply your new settings. If you withdraw consent for analytics cookies, Google Analytics will stop running and any existing analytics cookies will be removed.
Withdrawing Consent
You can withdraw your consent to non-essential cookies at any time. To do this:
- Click the Cookie Settings button (🍪) in the footer
- Turn off analytics cookies in the preferences panel
- Click "Save Preferences"
After withdrawing consent, non-essential cookies will be removed and will not be set again unless you give consent in the future. Please note that essential cookies cannot be disabled as they are necessary for the website to function.
Managing Cookies Through Your Browser
Most web browsers allow you to control cookies through their settings. You can set your browser to refuse cookies or to alert you when cookies are being sent. However, if you disable cookies, some features of GatherUK may not function properly.
For more information on how to manage cookies in your browser, please visit:
Third-Party Cookies
Some cookies are set by third-party services that appear on our pages. For example:
- Google Analytics: Only set if you consent to analytics cookies. Used to analyse website usage.
- Stripe: When you pay on Stripe’s pages, Stripe may set cookies necessary for processing your transaction.
We do not control the setting of these third-party cookies, so we recommend you check the third-party websites for more information about their cookies and how to manage them.
More Information
If you have any questions about our use of cookies, please contact us. For more information about cookies in general, you can visit www.allaboutcookies.org.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.