Privacy & Data Protection Notice

Strawberry Lemonade Events produces this event on behalf of Liverpool Homeless Football Club (registered charity 1182349). For guest and booking data collected through this website, Strawberry Lemonade Events and Liverpool Homeless Football Club (registered charity 1182349) act as joint controllers: Strawberry Lemonade Events manages bookings, guest details and event operations, and Liverpool Homeless Football Club (registered charity 1182349) uses booking contact details for its own fundraising and supporter relationship purposes. The venue, caterers and payment provider act as separate recipients or processors as described below. You can exercise your rights against either controller by emailing flora@strawberrylemonadeevents.com, and we will coordinate the response between us.

We only collect what we need to sell a table, deliver the evening safely and account for the funds raised:

• Booking contact: lead booker name, business or organisation, job title, email address and (if given) telephone number.
• Booking record: booking reference, package or table type, number of seats, amount, payment status and payment reference.
• Guest details: guest names, seat allocation and, where you provide them, dietary requirements and free-text allergy notes.
• Health and access information: accessibility requirements and notes, and any medical or allergy information you choose to tell us. This is special category data under UK GDPR and is handled with additional care.
• Event questions: any question submitted for the headline act.
• Event operations: check-in records and QR check-in tokens, and an audit log of changes made to your booking.
• Enquiries: anything you send us through the contact, waiting list or sponsorship enquiry forms.

We rely on the following lawful bases under UK GDPR Article 6, and Article 9(2)(a) for health-related information:

• Contract — to confirm your booking, take payment, issue your receipt, allocate seats and admit you on the night.
• Legitimate interests — event administration, seating and catering planning, safety and stewarding, fraud prevention, and keeping records of who attended. We have balanced these interests against your rights.
• Explicit consent — dietary, allergy, accessibility and any health-related information. You choose whether to give it, and you can withdraw it at any time before the event.
• Consent — marketing about future events or club fundraising, only where you have opted in. Every message includes an unsubscribe link.
• Legal obligation — financial, tax, Gift Aid and charity reporting records.

We never sell your data and we never share it for third-party marketing. Sharing is limited to what each recipient needs to do their job for this event:

• Liverpool Homeless Football Club (registered charity 1182349) — booking contact details, table and package information, and attendance, for fundraising, stewardship and reporting on the event.
• Palm House, Sefton Park — a final guest and seating list, plus accessibility requirements, shared shortly before the event for admission, safety and access arrangements.
• Catering team — dietary requirements and allergies, provided as a seat-level list. Names are included only where needed to serve the correct meal to the correct guest.
• Stripe — card payments are processed directly by Stripe. We never see or store your card details; we receive only a payment status and reference.
• Our technology providers — the hosting and database platform used to run this site and store bookings, acting under contract as processors.
• Professional advisers, auditors or authorities — only where we are legally required or where necessary to establish or defend legal claims.

Before any guest list is released, we require the venue and catering team to agree in writing that they will: use the information only to deliver this event; keep it confidential and restrict it to the staff who need it; apply appropriate security, including secure transfer rather than open email attachments where possible; not copy, retain or reuse it for their own marketing; and confirm secure deletion or destruction of guest lists after the event. We share the minimum data set for each purpose and pseudonymise where it does not compromise safety — for example allergy lists keyed by table and seat number.

Booking and guest data is stored in an access-controlled database, encrypted in transit and at rest, with access limited to a small number of named administrators at Strawberry Lemonade Events and the club. Some of our providers, including Stripe, may process data outside the UK; where they do, transfers are covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. QR check-in codes contain a signed token, not your personal details.

We keep information for no longer than we need it:

• Guest names, dietary, allergy and accessibility data — deleted within 90 days of the event.
• Working guest lists held by the venue and caterers — destroyed or deleted immediately after the event.
• Booking, payment and receipt records — retained for seven years to meet financial, tax and charity reporting obligations.
• Booking audit logs — retained alongside the booking record for the same seven-year period.
• Marketing consents and supporter contact details — kept until you withdraw consent or ask us to stop.
• Enquiry and waiting list entries — deleted within 12 months of the event unless you become a booker or supporter.

Your details are used by Strawberry Lemonade Events and Liverpool Homeless Football Club to administer this event, and are shared with the venue and caterers only as needed on the night. We do not sell your data or share it with anyone who does not need it. This notice explains the full picture; if you have any questions, email us using the address below.

Under UK GDPR you have the right to be informed; to access a copy of your data; to rectification; to erasure; to restrict or object to processing, including any processing based on legitimate interests; to data portability; and to withdraw consent at any time without affecting processing already carried out. We respond to requests within one month. Some records must be retained for legal or accounting reasons and we will tell you if that applies to your request.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. This is an adult, black tie event and we do not knowingly collect information about children through this site.

We maintain procedures to detect, investigate and report personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected guests without undue delay where the risk is high.