1. Introduction

The Fibbers York Archive ("we", "our", or "the archive") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your personal information when you visit our website, register as a community contributor, purchase archival merchandise, or interact with our historical records.

2. The Personal Data We Collect

We may collect, store, and process the following categories of personal information:

Account & Identity Data: Your first name, last name, and display initials provided upon registration or profile updates.
Contact Data: Your email address and, if placing an order, your delivery telephone number.
Community & Contribution Data: Public comments, stories, gig memories, uploaded photograph files, self-declared band memberships, and gig attendance check-ins.
Transaction Data: Details of archival products purchased through our store, order totals, and fulfillment records. (Note: Complete payment card details are processed directly by our payment provider, Stripe, and are never stored on our servers.)
Technical Data: Your IP address, login timestamps, browser type and operating system, used to maintain session security and prevent automated abuse.

3. Public Contributor Profiles & Shared Content

The Fibbers York Archive is inherently a collaborative, public cultural project. When you register an account and interact with the archive:

Publicly Visible Information: Your first name, last name, member join date, verified band links, gigs attended, and any posted comments or images are viewable by third parties on your public Contributor Profile and associated gig/band pages.
Private Information: Your email address, password hash, and order transaction history remain strictly private and are never displayed publicly.

4. How We Use Your Personal Data

Under the UK GDPR, we only process your personal information under valid legal bases:

Legitimate Interests: To operate a public historical music archive, attribute fan memories and photographs, preserve cultural heritage, and protect against spam and malicious traffic.
Contract Performance: To process and fulfill orders for archival merchandise, and communicate with you regarding your purchases.
Legal Compliance: To comply with applicable UK accounting, tax, consumer protection, and statutory obligations.

5. Third-Party Service Providers

We work with trusted third-party providers who act as data processors on our behalf:

Stripe (Stripe Payments Europe, Ltd.): We use Stripe to handle secure payment processing for merchandise orders. Stripe processes payment details under strict PCI-DSS security standards.
Google Analytics: We use anonymous analytics cookies provided by Google, Inc. to understand visitor traffic, popular gig pages, and site performance.
Postal & Print Partners: To fulfill custom-printed merchandise orders, delivery address details are shared securely with our print-on-demand and shipping partners.

6. Cookies & Local Storage

Our website uses essential and functional cookies to ensure proper operation:

Session & Security Cookies: Temporary cookies (such as laravel_session and XSRF-TOKEN) essential for keeping you logged in, maintaining form security, and remembering your preferences.
Site Access Cookie: If preview access authentication is active, a secure token (site_access_token) is stored to remember your device for 24 hours.
Analytics Cookies: Cookies used by Google Analytics to collect aggregated, anonymized usage statistics.

7. Data Retention & Account Deletion

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy. You may edit your profile information or delete your account at any time via your Account Settings.

When an account is deleted, your login credentials and personal profile are deactivated. Contributed historical comments and photographs remain part of the public venue archive with appropriate attribution, unless you explicitly request their removal in writing.

8. Your Rights Under UK Data Protection Law

Under UK GDPR and the Data Protection Act 2018, you have rights regarding your personal information, including:

The right to request access to the personal data we hold about you.
The right to request correction of inaccurate data.
The right to request erasure ("right to be forgotten") under certain conditions.
The right to object to or restrict processing of your personal data.

9. Contact Us

If you have questions about this privacy policy, wish to exercise any of your data protection rights, or have an inquiry regarding content attribution, please contact the Fibbers York Archive team via our website.

Privacy Policy.