What's On Dronfield — Privacy policy

Version 7 (interim), 27 September 2026 (version 1: 21 September 2026; version 2 added the bot check, error reporting and the 7-day removal of unfinished sign-ins; version 3 added the contact form; version 4 added saved events and notifications; version 5 kept usage counts with no time limit and said which actions are linked to your account; version 6 added running a business on What's On Dronfield — claiming or adding a listing; this one names the company behind What's On Dronfield and the email address to write to, and adds who hosts the website, who forwards our email and who looks up postcodes). This policy covers the What's On Dronfield website and app while they are being built and tested. It will be updated before public launch.

Who we are

What's On Dronfield is a trading name of GAGE SPORTING SERVICES LTD, a company registered in England and Wales, company no. 16585275. Registered office: 5 Westbrook Court, Sharrow Vale Road, Sheffield, S11 8YZ. We are the data controller for the personal information described here.

Contact: info@whatsondronfield.co.uk

What we collect, and why

Browsing needs no account. You can read everything on the site and in the app without telling us who you are.

Your area (optional). If you set a postcode and a distance, we keep them so we can show you what's nearby. This creates an anonymous account on your device. We keep only the postcode and the distance, never your street address.

An account (optional). To save events, add friends or message a business you create an account. We ask for your name (shown only to friends you add), the year you were born (accounts are for over-18s; we keep the year only), and your email address for a one-time sign-in code. If you sign in with Google, Google tells us your email address and name. We never see or store a password.

Saved events and notifications (optional). If you save an event, or say you're going to one, we keep which event and which date. Saving works without an account (it creates an anonymous account on your device) and moves into your account if you later make one. When something you saved or are going to changes — a date is cancelled or put back on, or the time or place changes — we put a notice in your Notifications, and keep whether you've read it. Notices are made from the event details only; nobody else sees yours. If an event you saved or are going to moves to another day, we move it for you in your list and ask whether you can still make it.

Businesses you follow (optional). If you follow a business, we keep which one, and whether you've muted it, so we can tell you in your Notifications when it adds an event. Following works without an account and moves into your account if you later make one. A business can see how many people follow it, never who. Unfollowing removes it.

Newsletter (optional). If you sign up, we keep your email address, the interests you chose, an optional postcode, and a record of when you confirmed (we use double opt-in) and the wording you agreed to. Every email carries a one-click unsubscribe. If you unsubscribe we delete your interests and postcode, and keep your address with when you signed up and unsubscribed and the wording you agreed to — so we never email it again, and can show what you agreed to.

Facebook connect (optional, and never a sign-in). If you choose to connect Facebook to find friends, we keep your Facebook user ID, name and profile picture; the Facebook IDs of your Facebook friends who also use What's On Dronfield (so you find each other as they join); and a Facebook access key that lets us refresh that list for about 60 days, stored encrypted. We keep nothing else from Facebook: no posts, no other friends, no email. You can disconnect at any time from the Friends screen, and if you remove What's On Dronfield in your Facebook settings, Facebook tells us and we delete the same data. Either way everything from Facebook is deleted, including your ID from other people's lists.

Messages and story ideas you send us (optional). If you use the contact form or suggest a story, we keep what you write, any link you give, and the contact details you choose to give: your name, email address and phone number (a phone number only so we can ring you back if you'd rather). A story idea can be sent without any contact details. Messages are emailed to our inbox so we can reply. We never publish what you send or your details: if we write about a story idea, we write it ourselves, and we won't name you without asking.

Businesses in our directory. We list local businesses from details they have published themselves — for example in their own adverts: the business name, trade, one phone number, website and business address. We don't take the names or email addresses of the people behind a business, and until a business claims its listing we show its street and postcode but not its house number. We keep a note of where each listing came from, so we can tell anyone who asks. A business can ask us to correct or remove its listing at any time, or claim it and manage it themselves.

Photos of businesses. Some listings show photos of the business — its building, inside, or its food — taken by the business or by someone who posted them online. We only show a photo once whoever took it has agreed. We keep a record, which is not published, of each photo: where we found it, the name it was posted under, how we contacted that person and when they agreed, so we can answer "where did you get my photo?". We don't show who took a photo. Anyone who took one can ask us to take it down at any time, and we will. We don't show photos in which people are the subject, or any photo of a child without a parent's consent.

Photos a business adds itself. The people who run a listing can add up to six photos to it. Before a photo is shown we make a fresh copy of it on our servers, which removes anything hidden in the file, such as where and on what camera it was taken. When they remove a photo, we delete it from our storage straight away. The business is responsible for having the right to show each photo, including a parent's consent for any photo showing a child, under the business terms. Anyone who appears in one can ask us to take it down.

Running a business on What's On Dronfield (optional). If you claim a business's listing, or add one, we keep:

If you give us a "best number to reach you", only we see it, and it is deleted when you stop looking after the business. Your own name and email are never shown on the business's page. What you put on the business's page is public, except:

We use the postcode to work out distances.

Usage counts. We count page views and taps (for example, a tap on a business's phone number), and how often each business appears in the directory's lists and search results, so local businesses can see how many people found them. When you search the directory we count only what the search found (how many results, and which kind of business or public place) — never the words you typed. We do this ourselves, with no cookies and no third-party analytics. Visitors are grouped per day using a code derived from your internet address and browser, keyed with a random value that is deleted after 48 hours; your internet address itself is never stored. A business only ever sees counts, never who you are. We also use these counts to understand how the service is used and whether it is growing. Page views are never linked to your account, even when you are signed in. A few things you do with an account are: signing in, saving an event, saying you're going and following a business. These records are kept with your account so we can see how the service is used over time, and when you delete your account they stop being linked to you.

What we do not do

Who processes data for us

We use Vercel (hosting the website), Supabase (database and sign-in, hosted in London), Upstash (rate limiting), Sentry (error reports, in the EU — they carry the page and browser where something broke, never your IP address or what you typed), Cloudflare Turnstile (an invisible check on the sign-in, newsletter and contact forms that tells people from bots; it sees your IP address and browser details for that check only and sets no tracking cookies), Cloudflare Email Routing (email sent to any @whatsondronfield.co.uk address passes through Cloudflare and is forwarded to our inbox), postcodes.io (turns a postcode you give us into a point on the map; our server sends it the postcode alone, never who you are), Google (if you sign in with Google), Meta (if you connect Facebook), and, once launched, an email delivery provider. Each processes data only on our instructions.

We rely on consent for the newsletter, Facebook connect and your area, on contract for running your account, and on legitimate interests for usage counts, keeping the service secure, and replying to messages you send us. You can withdraw consent at any time by unsubscribing, disconnecting or deleting the setting.

How long we keep things

Your rights

You can ask for a copy of your data, correct it, or have it deleted, by emailing info@whatsondronfield.co.uk. Accounts can also be deleted from within the app. You can complain to the Information Commissioner's Office at ico.org.uk.

Changes

We will update this policy before launch and whenever what we collect changes, and note the date at the top.