Privacy, without the small print

1. Who we are

Blaze Weekend is the controller of the personal data described in this policy. We design and coordinate private group weekends and experiences.

For privacy questions or requests, email the address at the end of this policy with the subject ‘Privacy request’. You do not need to complete the commercial enquiry form. We will use your email address only to identify and answer your request.

2. Data we collect

We collect only the information needed to understand and safely respond to your request:

• Contact data, including your name and email address.
• Enquiry details, including the occasion, preferred date, group size, and anything you choose to tell us about the weekend you imagine.
• Limited technical and security data. Cloudflare Turnstile checks whether a submission is legitimate. A protected representation of the submitting IP address is used for rate limiting; Blaze Weekend does not store the raw IP address in that limiter.

3. Why we use it

We use enquiry data to respond, clarify your requirements, prepare a relevant proposal, and take steps at your request before entering into a contract. The legal basis is Article 6(1)(b) GDPR.

We use limited technical data to prevent spam, abuse, and service disruption. This is based on our legitimate interest in operating a secure and reliable website under Article 6(1)(f) GDPR.

We may retain or disclose limited information when necessary to meet a legal obligation or establish, exercise, or defend legal claims. We do not use enquiry data for unrelated advertising, automated decision-making, or profiling.

4. Who receives it

We disclose data only where it is needed to run the enquiry service or where the law requires it. Our current service providers are:

• Cloudflare, for website security and Turnstile bot verification.
• Vercel and Upstash, for hosting, delivery, and short-lived abuse prevention infrastructure.
• Our secure email delivery provider, for securely delivering your enquiry to our team by email.
• Professional advisers, authorities, or courts where disclosure is legally required or necessary to protect legal rights.

We do not sell personal data and we do not share enquiry details with third parties for their own direct marketing. If a proposal later requires a venue or experience partner, we will explain what information needs to be shared before doing so.

5. How long we keep it

Enquiries that do not become a booking are kept for up to 12 months after our last meaningful contact, then deleted or anonymised. If you become a client, relevant correspondence may be retained for the duration of the relationship and any additional period required by tax, accounting, contractual, or legal-claims rules.

Rate-limit identifiers expire after approximately 10 minutes. Provider security logs may be retained for the periods described in each provider’s own documentation and contractual terms.

6. International transfers

Some service providers may process data outside the European Economic Area. Where this happens, we rely on an adequacy decision, approved Standard Contractual Clauses, or another lawful safeguard required by applicable data-protection law.

7. Your rights

Depending on the circumstances and your location, you may ask us to:

• Confirm whether we process your personal data and provide a copy.
• Correct inaccurate data or erase data that is no longer needed.
• Restrict processing while a concern is being resolved.
• Object to processing based on legitimate interests.
• Provide eligible data in a portable format where the right applies.

You may also complain to the data-protection authority in the country where you live or work, or where you believe an infringement occurred. We aim to respond to valid requests within one month.

8. Security and cookies

We use proportionate technical and organisational safeguards, including encrypted connections, access controls, server-side validation, bot protection, and rate limiting. No method of transmission or storage is completely risk-free.

Blaze Weekend does not currently use advertising cookies. Cloudflare Turnstile may read or store strictly necessary browser information to distinguish legitimate visitors from automated abuse. If we later introduce non-essential analytics or marketing technologies, we will update this policy and request consent where required.

9. Age limits

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has submitted information, contact us so that we can remove it.

10. Policy changes

We may update this policy when our services, providers, or legal obligations change. The latest version will remain on this page and the date above will show when it was revised.

11. Contact us

For a privacy question, use our contact form or email us directly. You do not need to provide event details. Do not include identity documents or sensitive information unless we specifically ask for them.