Privacy Policy

Last updated: 12 June 2026

1. Who we are

What's On East Lothian ("we", "us", "our") is a free events guide for East Lothian, Scotland, available at https://whatsoneastlothian.com (the "Site" or "website").

Questions about this policy or your data: hello@whatsoneastlothian.com.

This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.

2. What the Site does

The Site is an informational guide to events happening across East Lothian: markets, music, festivals, family events, golf competitions, theatre and similar. It collects publicly available event listings from local venues, councils and festivals, organises and categorises them, and publishes them.

We may use internal tools and technical systems to help manage listings, organise information, improve website content, process submissions, detect errors and maintain the website.

The Site does not offer user accounts, logins, payments, file uploads, comments, reviews or social features. You can browse, search and filter events without giving us any personal data. Personal data is only collected if you choose to use one of two forms: the newsletter signup or the event-submission form.

3. The personal data we collect

3.1 Newsletter signup

When you subscribe to our weekly email, we collect:

• Email address: the address you enter.
• Signup source: a short label recording where on the Site you subscribed (e.g. the homepage footer).
• Hashed IP address: a one-way SHA-256 hash of your IP address, used only to limit abuse and prevent spam signups. We do not store your raw IP address with your subscription.
• Browser/device string (user agent): sent automatically by your browser.
• Date and time of signup.

None of this is published publicly. We use it to send you the newsletter and to keep our records secure.

If you contact us or sign up for updates, we may use email delivery and communication providers to send messages, manage subscriptions and process replies. These providers may process your email address, message content and related technical information where necessary to provide these services.

Lawful basis: Your consent (UK GDPR Article 6(1)(a)) for sending you the newsletter, and consent under PECR for sending you marketing email. We also rely on our legitimate interests (Article 6(1)(f)) in keeping our systems secure for the abuse-prevention metadata above. You can withdraw your consent at any time (see Section 9).

3.2 Event submission form

When you submit an event at /submit-event, we collect:

• Event details: title, description, venue name, address, start and end times, pricing, whether it's free, and an optional link to the original listing. If we approve your event, these details are published on the Site.
• Your name: optional, and never published.
• Your email address: required, used only to confirm receipt and to contact you if we have a question about your event. The form makes clear this is for confirmation only and is never published.
• Abuse-prevention metadata: a hashed IP address, your browser/device string, and a bot-detection flag.
• Moderation data: the status of your submission (pending, approved or rejected) and any internal review notes.

Every submission is manually reviewed before publication. Nothing appears on the Site until we have approved it.

Lawful basis: Our legitimate interests (Article 6(1)(f)) in receiving, reviewing and publishing community event listings, in responding to you about your own submission, and in preventing spam and abuse. Publishing the event details you send us is part of the service you are asking us to provide.

3.3 Information we collect automatically

• Hashed IP address and browser/device string on form submissions, as described above, for security and rate-limiting.
• We use technical service providers to host, secure and deliver this website. These providers may process limited technical information such as IP address, browser type, device information, pages viewed, dates and times of access, and server log data. This is used to keep the website available, secure and working properly.
• We may use privacy-conscious analytics and performance tools to understand how the website is used, improve pages, monitor errors and measure general engagement. This may include information such as pages visited, approximate location, device type, browser type, referral source and interaction data. Analytics only run if you opt in through our cookie banner.
• If you opt in to marketing cookies, we use the Meta (Facebook) pixel provided by Meta Platforms Ireland Limited to measure whether our advertising leads to newsletter signups. This may include pages visited, device and browser information, and conversion events. The pixel only runs if you opt in through the "Marketing" category in our cookie banner.
• We do not collect precise location and we do not use social logins.

3.4 Information we do not collect

We do not collect or store: account credentials or passwords; payment or card details; identity documents; precise geolocation; or any special category data (such as health, race or political opinions). Please do not send us any of this information through the forms.

4. How we organise listings

To keep listings consistent, we may use internal tools and technical systems to help categorise events, apply tags (such as "family-friendly" or "free") and write short factual summaries. This processing uses only event text such as the title, description and venue name.

We do not send your name or email address for this purpose. It is editorial categorisation and does not make any decision that produces a legal or similarly significant effect on you.

5. Third-party service providers

We use trusted third-party service providers to help operate, maintain, secure and improve the website. These providers may process limited information where necessary to provide their services.

This may include providers that help with:

• website hosting and delivery
• database and infrastructure services
• email delivery and communication
• website analytics and performance monitoring
• advertising measurement through the Meta (Facebook) pixel, when you opt in to marketing cookies
• security, spam prevention and abuse detection
• form submissions and message handling
• website maintenance and technical support

These providers only process information where needed to provide their services to us, keep the website working, improve reliability, protect the website, or comply with legal obligations. Meta Platforms Ireland Limited acts as our processor for advertising measurement when you opt in to marketing cookies. We do not sell your personal data.

We may also disclose personal data if required by law, or to establish, exercise or defend legal claims.

When you click a link to a third-party site (for example a venue, ticket seller or festival page), you leave our Site and that third party's own privacy policy and cookies apply. We do not control those sites.

6. International transfers

Some of our service providers may process data outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK law, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the recipient is certified. You can ask us for more detail using the contact address above.

7. How long we keep your data

• Newsletter subscribers: we keep your email address until you unsubscribe or ask us to delete it. We periodically remove addresses that are no longer deliverable.
• Event submissions: while a submission is pending, and for 12 months after a decision, for record-keeping and provenance. Your contact details (name and email) are removed or minimised within 12 months of the event taking place, as they are only needed to contact you about that submission.
• Abuse-prevention metadata (hashed IP, user agent): kept for up to 12 months and then deleted.
• Server and hosting logs: kept for the period set by our hosting providers, typically a short rolling window.

8. Search engines

Approved event listings, town pages and venue pages are intended to be found in search engines. This is a normal and expected part of running a public listings site. Submitter contact details are never included in any page that search engines can index.

9. Your rights

Under UK data protection law you have the right to: access the personal data we hold about you; rectify inaccurate or incomplete data; erase your data; restrict or object to our processing; withdraw consent at any time (this does not affect processing already carried out); and data portability for data you provided to us.

To unsubscribe from the newsletter, click the "unsubscribe" link at the foot of any newsletter email, or email hello@whatsoneastlothian.com.

To exercise any other right, contact hello@whatsoneastlothian.com. We will respond within one month. There is normally no charge.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at hello@whatsoneastlothian.com so we can try to put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk

11. Children

The Site is a general-audience information service and is not directed at children. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. Material changes will be reflected on this page.

13. Contact

Questions about this policy or your data: hello@whatsoneastlothian.com.