Privacy notice

The three founders operating Just Celebrate jointly are the data controllers for the personal information described here. Privacy enquiries and rights requests should be sent to enquiries@justcelebrate.co.uk.

We do not currently appoint a data protection officer because the nature and scale of our processing does not require one.

Depending on how you use the platform, we collect:

• customer enquiry details: name, email, event date, location, budget, occasion and message;
• vendor details: contact name, business email, telephone, postcode, service areas, website, descriptions, prices and images;
• account and security information: usernames, password hashes, login attempts, setup tokens and sessions;
• platform activity: visits, listings shown, profiles viewed, saved vendors, enquiries and vendor logins, linked to a random browser identifier; and
• information kept on your device, including saved vendors, an unfinished enquiry and app-install preferences.

Please do not include sensitive personal information in free-text fields unless genuinely necessary.

• Providing requested services: creating profiles, processing enquiries, managing drafts, accounts and sessions. Lawful basis: contract and steps before a contract.
• Running and improving the marketplace: reviewing vendors, measuring performance, preventing misuse and improving services. Lawful basis: our legitimate interests in a useful, secure marketplace.
• Communicating: account links, service messages and enquiry notifications. Lawful bases: contract and legitimate interests.
• Legal and safety purposes: complaints, security incidents and lawful requests. Lawful bases: legal obligation and legitimate interests.

We do not sell personal information or use it for third-party behavioural advertising.

Customer enquiry details are available to the selected vendors so they can assess and reply. Approved vendor profile information is displayed publicly.

We use providers for website hosting, database and image storage, email/form notifications and UK postcode lookup. They receive only what is needed for their service. Business discovery may use OpenStreetMap and UK postcode services. Information may also be disclosed where required by law, to protect users, or during a future business transfer.

Some technology providers may process information outside the UK. Where required, we rely on an adequacy regulation or approved contractual safeguards. Contact us for more information about relevant safeguards.

• enquiries: normally up to 24 months after the event date or last activity;
• vendor profiles, accounts and images: while active or under review, then normally up to 24 months after closure;
• security and session records: only as long as needed for protection and troubleshooting;
• pseudonymous analytics: normally up to 24 months; and
• records required for complaints, fraud prevention or legal claims: up to six years.

We may delete data sooner when no longer needed and may keep anonymised statistics that no longer identify anyone.

Subject to legal conditions, you may request access, correction, deletion, restriction or transfer, and object to processing based on legitimate interests. You may withdraw consent where processing relies on it.

Email us to exercise a right. We may confirm identity and normally respond within one month. You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

We use access controls, hashed passwords, expiring private links and restricted administrative access. No online service can promise absolute security.

The platform is for people aged 18 or over. We do not knowingly create accounts for children. We may update this notice when the service or operator changes; the current effective date will remain shown here.