Privacy Policy

This Privacy Policy explains how Gatherstone Ltd (“Gatherstone”, “we”, “us” or “our”) collects, uses, stores and protects personal information when you visit gatherstone.co.uk, contact us, make an enquiry, work with us, or otherwise interact with Gatherstone Ltd.

Gatherstone Ltd is the company behind a number of creative, digital, event and experience-led projects and brands. Individual Gatherstone brands, products and services may provide their own privacy notices where they process personal information in ways specific to that service.

This Privacy Policy is intended to meet our transparency obligations under applicable UK data-protection law, including the UK GDPR and Data Protection Act 2018. ICO guidance requires privacy information to explain matters including the controller, purposes and lawful bases, recipients, retention, rights and complaint arrangements.

The data controller for the processing described in this Privacy Policy is:

Gatherstone Ltd
Company Number: 17465110
Registered in England and Wales
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom

Website: www.gatherstone.co.uk
Email: hello@gatherstone.co.uk

Where Gatherstone determines why and how personal information is processed, Gatherstone will generally act as the data controller. The ICO describes a controller as the organisation exercising overall control over the purposes and means of processing.

Gatherstone Ltd operates, develops or supports a number of brands, projects and services, which currently include:

• Haunted: The Paranormal App
• The Paranormal Festival
• SUMWEN Studio
• other future Gatherstone projects, products, events and services.

Some of these have, or may have, their own privacy policies or privacy notices.

Where a specific brand or service has its own privacy notice, that notice should be read alongside this Privacy Policy where relevant. The more specific notice will explain processing particular to that service.

For example, information processed through Haunted is subject to Haunted’s own Privacy Policy and associated policies rather than this corporate website policy alone.

Depending on how you interact with Gatherstone, we may collect:

• Identity information, such as your name.
• Contact information, such as your email address, telephone number or other contact details you provide.
• Enquiry information, including information you provide through contact forms, emails, messages or other communications.
• Business information, such as your organisation, job title, business contact information or details relevant to a proposed or existing commercial relationship.
• Project information, including information you provide when discussing creative work, websites, digital products, events, partnerships, sponsorships or other projects.
• Transaction and contractual information, where relevant to a business relationship, purchase, booking, invoice, contract or payment.
• Technical information, which may include IP address, browser type, device information, operating system and information about how you access our website.
• Website usage information, where relevant technologies are used, such as pages visited, interactions and general website performance information.
• Marketing preferences, including whether you have asked to receive or stop receiving particular communications.
• Correspondence, including emails and other communications exchanged with Gatherstone.

We only seek to collect information that is reasonably relevant to the purpose for which it is being used.

We may receive personal information directly from you when you:

• contact Gatherstone;
• complete a website form;
• email us;
• enquire about one of our projects or services;
• request information;
• discuss a partnership, sponsorship or commercial opportunity;
• become a customer, client, supplier or collaborator;
• register an interest in a project;
• subscribe to communications where offered;
• attend or enquire about a Gatherstone project or event; or
• otherwise communicate with us.

Where we collect information directly from you, privacy information should be available at the point the information is obtained where required.

We may also receive personal information from other legitimate sources, including:

• one of our brands or projects;
• businesses, suppliers and professional contacts;
• event partners or collaborators;
• service providers;
• payment providers where relevant;
• publicly available professional or business sources;
• social media or other platforms where you choose to interact with us; and
• another person or organisation where there is a lawful reason for them to provide the information.

Where information is obtained from another source, we will provide privacy information where required by law.

We may process personal information to:

• operate and maintain gatherstone.co.uk;
• respond to enquiries;
• communicate with you;
• provide information you request;
• manage business relationships;
• discuss, establish and perform contracts;
• deliver products, services, projects or events;
• administer suppliers and contractors;
• process legitimate business records and transactions;
• manage partnerships, sponsorships and collaborations;
• maintain the security and integrity of our websites, systems and services;
• prevent or investigate misuse, fraud or security incidents;
• comply with legal, regulatory, tax and accounting obligations;
• establish, exercise or defend legal claims;
• improve our websites, services and business operations;
• understand appropriate website usage and performance;
• send marketing communications where permitted by law;
• maintain suppression records where someone has opted out of marketing; and
• operate and develop Gatherstone and its brands.

We will not use personal information for an incompatible new purpose without considering whether an additional lawful basis or further privacy information is required.

UK data-protection law requires us to have a lawful basis for processing personal information. The appropriate basis depends on the purpose and circumstances of the processing.

We may rely on:

Contract. Where processing is necessary to enter into or perform a contract with you, such as providing an agreed service or administering a contractual relationship.

Legitimate interests. Where processing is necessary for our legitimate interests or those of another party and those interests are not overridden by your rights and interests. Our legitimate interests may include:

• operating and developing our business;
• responding to enquiries;
• managing professional and commercial relationships;
• protecting our websites, brands and services;
• preventing misuse and fraud;
• maintaining appropriate business records;
• improving our services;
• understanding appropriate website performance; and
• communicating appropriately with existing or prospective business contacts.

Where legitimate interests are relied upon, Gatherstone is responsible for considering whether the processing is necessary and appropriately balanced against the individual’s interests and rights. The ICO requires organisations relying on legitimate interests to explain those interests in their privacy information.

Consent. We may rely on your consent where consent is appropriate or legally required, including for certain marketing or non-essential website technologies. Where processing relies on consent, you can withdraw that consent.

Legal obligation. We may process personal information where necessary to comply with a legal or regulatory obligation.

Vital interests. In exceptional circumstances, information may be processed where necessary to protect someone’s life.

Other lawful bases may apply where permitted by law and appropriate to the circumstances.

Gatherstone may send marketing or promotional communications where we have a lawful basis to do so. Where consent is required, we will seek it before sending the relevant communication.

In circumstances where applicable law permits marketing without express consent, we may rely on the appropriate lawful basis and applicable direct-marketing rules.

You can unsubscribe from marketing communications using an unsubscribe mechanism provided with the communication, where available, or by contacting hello@gatherstone.co.uk.

You have the right to object to the use of your personal information for direct marketing. The ICO describes this right as absolute.

We may retain limited information about an opt-out so that we can respect your preference in the future.

Gatherstone.co.uk may use cookies and similar technologies for purposes such as:

• essential website operation;
• security;
• remembering preferences;
• understanding website performance; and
• analytics or other optional functionality where implemented.

Where consent is legally required for a cookie or similar technology, it should not be used until the appropriate consent has been obtained.

Further information is provided in Gatherstone’s separate Cookies & Similar Technologies Policy.

Where reasonably necessary, we may share personal information with categories of recipients including:

• website and hosting providers;
• cloud and technology providers;
• email and communications providers;
• payment processors;
• accounting and bookkeeping providers;
• professional advisers;
• insurers;
• contractors and suppliers;
• event or project partners where relevant;
• other Gatherstone-operated brands or services where there is an appropriate lawful basis;
• regulators, law-enforcement bodies, courts or government authorities where legally required or permitted; and
• parties involved in a corporate transaction, restructuring or transfer where lawful and appropriately protected.

Service providers processing personal information on our behalf are expected to handle it only in accordance with appropriate instructions and contractual requirements where applicable.

We do not give third parties unrestricted permission to use personal information merely because they provide a service to Gatherstone.

Gatherstone Ltd is the legal company behind multiple brands and projects.

Information should not automatically be treated as freely interchangeable between every Gatherstone brand merely because they share the same corporate owner.

Where information collected through one brand is used for another materially different purpose, Gatherstone will consider the applicable lawful basis, transparency requirements and any relevant marketing rules before doing so.

Individual brands may maintain separate databases, systems, accounts, websites or privacy notices.

Some service providers used by Gatherstone may process or store information outside the United Kingdom.

Where personal information is transferred internationally and UK data-protection law requires safeguards, Gatherstone will use an appropriate lawful transfer mechanism or other permitted basis. Depending on the destination and circumstances, this may include UK adequacy regulations or appropriate contractual safeguards.

Information about applicable safeguards may be requested by contacting us.

We do not intend to retain personal information indefinitely simply because we have collected it. Retention periods depend on factors including:

• why the information was collected;
• whether an active business relationship continues;
• contractual requirements;
• accounting and taxation requirements;
• legal limitation periods;
• regulatory requirements;
• security and fraud-prevention needs;
• whether information is relevant to a dispute or legal claim; and
• whether deletion is technically and legally appropriate.

When personal information is no longer reasonably required, it should be deleted, anonymised or otherwise securely disposed of, subject to legitimate retention requirements.

The ICO requires privacy information to specify retention periods or, where fixed periods are inappropriate, the criteria used to determine them.

Gatherstone Ltd will take reasonable and appropriate technical and organisational measures to protect personal information for which it is responsible. Measures may include appropriate access controls, authentication, secure service providers, backups, account controls and limiting access according to operational need.

However, no internet-connected service, website, email system or storage system can guarantee absolute security.

If you believe information connected with Gatherstone has been compromised, please contact hello@gatherstone.co.uk.

Where Gatherstone becomes aware of a personal-data breach, we will assess the incident and take appropriate steps in accordance with applicable data-protection law. Where legally required, this may include notification to the Information Commissioner’s Office and/or affected individuals.

We may preserve relevant information where reasonably necessary to investigate an incident, comply with legal obligations or protect affected people.

We do not ask visitors to the general Gatherstone website to provide special category personal information unless it is genuinely necessary. Please avoid sending unnecessary sensitive information through general enquiry forms or ordinary email.

If Gatherstone needs to process special category information, criminal-offence information or similarly sensitive information for a particular project or legal purpose, we will identify the appropriate lawful basis and any additional legal condition required.

The ICO confirms that special category and criminal-offence information can require an additional processing condition beyond an Article 6 lawful basis.

The Gatherstone corporate website is primarily intended to provide information about Gatherstone Ltd, its work and its projects. We do not knowingly use the corporate website to solicit unnecessary personal information from children.

Individual Gatherstone brands, products or events may have their own age restrictions and privacy arrangements. In particular, Haunted: The Paranormal App is an 18+ service and is governed by its own Privacy Policy, Age & Adult-Only Community Policy and related safety documentation.

Our website may contain links to websites, social media platforms, ticketing services, payment services or other third-party services. A link does not mean Gatherstone controls the third party’s processing of personal information.

When you leave a Gatherstone-controlled service, the privacy practices of the destination provider may apply. You should review their privacy information where appropriate.

If you interact with Gatherstone through a social media platform, both Gatherstone and the platform may process information relating to that interaction for their respective purposes. The platform’s own privacy terms also apply to its processing.

Information posted publicly on social media should be treated as potentially visible to other users of that platform.

Gatherstone does not currently intend to use personal information collected through the general Gatherstone corporate website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

If this materially changes, this Privacy Policy will be updated and additional information will be provided where required.

Depending on the circumstances and applicable lawful basis, you may have rights including:

• the right to be informed about how your information is used;
• the right of access to your personal information;
• the right to rectification of inaccurate or incomplete information;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability where applicable;
• the right to object to certain processing;
• the right to withdraw consent where processing is based on consent; and
• rights relating to certain automated decision-making.

These rights are not all absolute and their availability can depend on the lawful basis and circumstances of processing.

You have the right to object to the processing of your personal information in certain circumstances. Where we process information for direct marketing purposes, you can object to that processing at any time.

Where we rely on legitimate interests, you may also have a right to object. We will consider the circumstances and applicable legal requirements.

To exercise a data-protection right or ask a privacy question, contact hello@gatherstone.co.uk.

Please explain enough about your request for us to identify the relevant information. We may need to verify your identity before fulfilling certain requests, but we will not request more information than is reasonably necessary for verification.

We will respond within the applicable statutory timeframe.

If you have concerns about how Gatherstone has handled your personal information, we encourage you to contact us first at hello@gatherstone.co.uk.

You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk. The ICO requires privacy notices to tell individuals about this right.

If Gatherstone or one of its businesses, brands or assets is reorganised, sold, transferred, merged or otherwise restructured, relevant personal information may form part of that transaction where lawful. Any recipient would be required to handle personal information in accordance with applicable data-protection requirements.

We may preserve or disclose personal information where reasonably necessary and permitted or required by law, including to:

• comply with legal obligations;
• respond to valid regulatory or law-enforcement requests;
• establish, exercise or defend legal claims;
• investigate fraud, misuse or security incidents; or
• protect the rights, property or safety of Gatherstone, its users, customers or others.

We will not disclose personal information to an authority merely because someone informally requests it. Requests will be assessed in accordance with applicable law.

We may update this Privacy Policy where our business, website, projects, processing activities or legal obligations change. The latest version is made available through gatherstone.co.uk.

Where a change materially affects how existing personal information is used, we will take appropriate steps to bring the change to affected individuals’ attention where required.

ICO guidance recommends regularly reviewing privacy information and informing individuals of new uses before beginning the relevant processing.

For privacy enquiries, data-protection requests or questions about this Privacy Policy:

Gatherstone Ltd
Company Number: 17465110
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom
Email: hello@gatherstone.co.uk
Website: www.gatherstone.co.uk

© 2026 Gatherstone Ltd. All rights reserved.