Privacy policy

Last updated 21 October 2026.

This is how The Grove uses your personal data, mainly for our mailing list.

Who we are

The Grove is run by Cameron Worne, who is the controller of the personal data described here and is registered with the Information Commissioner's Office (ICO) as The Grove Notts, registration number ZB944856. We don't have a Data Protection Officer.

For anything about your data, email info@thegrovenotts.co.uk. To make a complaint, you can also use the form at the bottom of this page.

What we collect and where it comes from

• Your name and email address, when you sign up to our mailing list through our sign-up form on this website.
• Your name and email address from Gigantic, our ticketing partner. When you buy a ticket through Gigantic and tick the box allowing Gigantic to pass your details to The Grove for marketing, Gigantic sends us these and we add you to our mailing list.
• Which links you click in the emails we send you.
• Whether you open our emails. Our current email provider, Sender, records this.
• What you send us through the forms on this website, such as a studio enquiry or a complaint, along with your name and email address.
• A record of your requests, if you ask to see, change or delete your data, or make a complaint.

You don't have to give us your details, but without an email address we can't send you the mailing list or reply to you.

What we use it for and why we're allowed to

Data protection law says we need a lawful basis for each use. These are ours.

Sending you the mailing list

We email you about gigs and other things happening at The Grove. Our lawful basis is your consent. You give it when you sign up on this website, or when you tick the box at Gigantic's checkout allowing Gigantic to pass your details to us for marketing. You can withdraw it at any time.

Not emailing you after you unsubscribe

When you unsubscribe, or an email to you bounces, we add your address to a suppression list so we don't email you again. Our lawful basis is legitimate interests. Our interest is making sure we never email someone who has asked us to stop.

Tracking clicks

We record which links you click in our emails. A click also tells us you still want our emails, so we don't remove you from the list. Our lawful basis is legitimate interests. Our interest is knowing which emails are useful to people, so we can send better ones, and only keeping people on the list who still want to hear from us.

Open tracking, for now

Our current email provider, Sender, records whether you open our emails. We only look at overall numbers, not at what any one person opens. Our lawful basis is legitimate interests. Our interest is seeing roughly how many people read our emails. This stops when we move to our own sending.

Tailoring emails (planned)

We plan to use the links you click to choose which gigs to tell you about. We'll update this policy before we start. Our lawful basis will be legitimate interests. Our interest is sending you emails about the kind of gigs you go to, rather than everything.

Replying to you and keeping records

We use what you send through our forms to reply to you. Our lawful basis is legitimate interests. Our interest is answering the people who get in touch. We keep a record of requests about your data and complaints. Our lawful basis is legitimate interests. Our interest is being able to show we handled each request properly, and to defend legal claims.

Who else handles your data

We use these companies to run things for us. They only use your data on our instructions.

We're moving our mailing list from Sender to Amazon Web Services. Both are listed while we move. Sender will stop holding your data when we close our account with it, about 3 months after the move, and we'll take it off this list then.

• Sender, our current mailing list provider. It stores the mailing list, sends our emails and receives sign-ups from this website.
• Amazon Web Services, which will store the mailing list and send our emails once we've moved. Your data is stored in its London region (eu-west-2). Amazon Web Services is based in the US, so in case data is accessed from outside the UK we rely on the UK International Data Transfer Addendum (the UK GDPR Addendum) to the EU standard contractual clauses as the safeguard.
• Hetzner, which hosts our servers in the EU.
• SiteGround, which hosts this website, sends messages from its forms to our inbox, and forwards email sent to our no-reply address.

Our email inboxes. Our info@ and studio@ addresses forward to Gmail accounts, so Google holds the messages you send us, by email or through our forms, under its own terms. Google does this as a separate company, not on our instructions. See Google's privacy policy.

Some of these companies may handle your data outside the UK. Sender (in Lithuania) and Hetzner keep it in the European Economic Area, which UK law treats as protecting it adequately. Google is based in the US and may hold messages there. It's certified under the UK-US data bridge. This website itself is hosted in London.

We don't sell your data, and we don't share it with anyone not listed here unless the law requires us to.

How long we keep it

• Mailing list: until you unsubscribe, or until 24 months pass without you signing up again or clicking a link in one of our emails, whichever comes first. If you were on our list before we moved off Sender, you'll have at least 60 days after our first email from the new system before this applies.
• Suppression list: for as long as we send emails, so we can keep not emailing you. We keep a scrambled (hashed) version of your email address and the date you left, so we can recognise your address without storing it. Amazon Simple Email Service (SES) keeps your plain email address on its own suppression list.
• Click records: for as long as you're on the mailing list.
• Open records: until we've finished moving away from Sender.
• Messages you send us: 2 years after we last hear from you, or up to 6 years where the message leads to a booking or a payment, because those are business records.
• Request log: records of requests about your data and complaints are kept for 6 years, the time limit for most legal claims.
• Backups: when we delete your data it can stay in our backups for up to about 6 months. It's "beyond use" during that time: we don't look at it or use it, and it's deleted as the backups are replaced.

Cookies and this website

We don't use analytics or advertising tracking on this website.

• Form security cookie. A cookie called PHPSESSID lets our forms check that a submission really came from this website. It's only set on pages that have a form. It's strictly necessary, so it doesn't need your consent. It's deleted when you close your browser.
• Mailing list pop-up. Once you've signed up, your browser remembers it (in its local storage) so we don't show you the pop-up again. This stays on your device and isn't sent to us.
• Spotify and Google Maps. The playlist on our studio page and the map on our contact page only load when you click to show them. When you do, Spotify or Google receives your IP address and may set its own cookies. See Spotify's privacy policy and Google's privacy policy.
• Server logs. SiteGround, which hosts this website, keeps logs of visits, including IP addresses, for about 30 days. We use them to keep the website secure and working. Our lawful basis is legitimate interests: keeping the website secure.
• Complaint form limit. When you send a complaint, we keep a scrambled (hashed) form of your IP address for one hour, so nobody can flood the form. Our lawful basis is legitimate interests: keeping the complaint form working.

Your rights

You have the right to:

• Withdraw your consent to the mailing list at any time. Use the unsubscribe link in any of our emails, or email us. This doesn't affect anything we did before you withdrew it.
• See the data we hold about you and get a copy.
• Have it corrected if it's wrong.
• Have it deleted, in some circumstances.
• Restrict how we use it.
• Get the data you gave us for the mailing list in a format you can take elsewhere.

You also have the right to object at any time to us using your data on the basis of legitimate interests, including click tracking, open tracking and, once we start it, tailoring emails. If you object to us using your data to send you marketing, we'll stop.

To use any of these rights, email info@thegrovenotts.co.uk. We'll reply within a month. If your request is complicated it can take up to two months longer, and we'll tell you if it will.

Automated decisions

We don't make any decisions about you by automated means that have a legal or similarly significant effect on you. If we start tailoring emails, it will only change which gigs we tell you about.

Complaints

If you're unhappy with how we've used your data, tell us first. Use the form below or email info@thegrovenotts.co.uk. Cam deals with privacy complaints. We'll acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.