Privacy Notice

Last updated: 21/05/2026

The Gerry McHugh Festival ("we", "the festival") is committed to protecting your privacy. This notice explains what data we collect when you take part in our online auction, and how it is used, stored and shared. We process data under UK GDPR.

What we collect

When you register to bid in the online auction, we collect:

  • Your name, email address and phone number — so we can verify you are a real person and contact you if you win an item.
  • Your bids — the amount, item, and time of every bid you place.
  • Your IP address — logged automatically for every bid as a fraud-prevention measure.
  • A display preference — whether you opted to appear as your first name and last initial (e.g. "John S.") or as "Anonymous" in the public bid history.

What we do not collect

We do not use advertising cookies, tracking pixels, or analytics services. We do not build a profile of your browsing activity. We do not share or sell any personal data to third parties.

Lawful basis

We rely on performance of a contract (processing your bid and contacting you as a potential winner) and legitimate interests (preventing fraud and abuse of the auction system).

How long we keep your data

All bidder data and bid records are automatically deleted 90 days after the close of the festival, unless we are legally required to retain them for longer (e.g. for accounting purposes if you won an item).

Your rights

Under UK GDPR, you have the right to access the data we hold about you, to correct it, or to request its deletion at any time. To exercise any of these rights, email us at ndhs.football.festival@gmail.com.

Raffle ticketing

Raffle tickets are processed by Eventbrite. When you purchase a ticket, your data is handled by Eventbrite under their own privacy policy, which you can read at eventbrite.co.uk.

Security

All data is transmitted over HTTPS. Passwords and one-time codes are stored using industry-standard bcrypt hashing — we never store them in plain text. Bid data is stored in Amazon DynamoDB with access restricted to the festival's administrators.