Privacy Policy

1. Who we are

Exhibition Tracker (the “Service”) is operated as a personal project by Mick Sadler, based in the United Kingdom. If you want to contact us about anything in this policy, email exhibitiontrack@gmail.com. For the purposes of UK GDPR, we are the data controller for personal data processed through the Service.

2. What personal data we collect

We keep what we need and nothing more. Specifically:

• Account details — your name, email address and a hashed password when you register.
• Your tracking data — the exhibition names, image titles, salon sections, acceptance ticks and awards you log into your BPE and FIAP dashboards.
• Newsletter subscription — your email address and an unsubscribe token if you opt in to the newsletter during signup or via the blog.
• Technical data — basic analytics via Google Analytics 4 (anonymised page views, referrer) to understand which features and blog posts are useful.

We do not collect photographs, image files, payment information (there's no paid tier), or any other sensitive data.

3. Why we process it (legal basis)

• Account & tracking data — processed on the basis of contract (we can't provide the Service without them).
• Service emails (verification, re-engagement nudges, operational updates) — processed on the basis of legitimate interest under UK GDPR Art. 6(1)(f).
• Newsletter emails — processed on the basis of your consent (opt-in checkbox at signup or opt-in on the blog). PECR 2003 soft opt-in for our own customers.
• Analytics — processed on the basis of legitimate interest; anonymised, no cross-site tracking.

4. Who we share it with

We don't sell, rent or trade your data. The only third parties that touch it are our processors, each covered by their own data processing agreements:

• Emergent — our hosting and database provider.
• Resend — transactional and newsletter email delivery.
• Google Analytics 4 — anonymised traffic analytics.
• Cloudflare — DNS, CDN and DDoS protection.

If any of these providers are updated or replaced, this page will be updated accordingly.

5. How long we keep it

• Account & tracking data — for as long as your account is active, plus 30 days after deletion to allow for recovery requests.
• Newsletter data — until you unsubscribe (one click, every email contains a direct link).
• Analytics data — Google Analytics default retention (14 months), after which it's aggregated.

6. Your rights under UK GDPR

You have the right to:

• Access — request a copy of your personal data.
• Rectify — correct inaccurate personal data.
• Erase — delete your account and all associated tracking data (contact us or use the Delete Account button in your settings).
• Restrict — stop us processing your data while you query it.
• Port — export your tracking data as CSV / Excel at any time via the dashboard's Export button.
• Withdraw consent — unsubscribe from the newsletter with one click; no justification needed.
• Complain — contact the UK Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

To exercise any of these rights, email exhibitiontrack@gmail.com. We'll respond within 30 days.

7. Where we store it

Your data is stored on Emergent's cloud infrastructure (currently hosted in Google Cloud, EU regions). We don't transfer personal data outside the UK/EEA without appropriate safeguards in place.

8. Cookies

We use the minimum necessary cookies:

• A session cookie to keep you signed in after login.
• Theme preference (light/dark) stored in your browser's localStorage.
• Google Analytics 4 cookies for anonymous usage statistics.

No third-party advertising cookies. No cross-site tracking.

9. Changes to this policy

If we materially change this policy, we'll update the “Last updated” date at the top and — for substantive changes — send a one-off service email to active users.

10. Contact

Any questions, concerns or data requests: exhibitiontrack@gmail.com.