Privacy Policy

1. Who we are

XploreLiverpool ("we", "us", "our") operates xploreliverpool.co.uk, an event discovery service for Liverpool and Wirral. XploreLiverpool is the data controller for the processing described in this policy.

XploreLiverpool is an independent event aggregator: we collect and display public event listings from organisers, ticketing platforms, and other sources so they can be found in one place. We are not a ticketing platform — we do not sell tickets, take payments, or handle bookings. Any ticket purchase happens directly with the third-party seller linked from an event page.

For privacy questions, data requests, or corrections to an event listing, email events@xploreliverpool.co.uk.

2. Information we process

We process only the information needed to run the service:

• Newsletter information — the email address you provide when you subscribe. It is passed to Brevo, our email provider, and is not stored in the XploreLiverpool event database.
• Messages you send us — your email address and the contents of your message when you contact us.
• Public event information — event details obtained from event platforms, organisers, and public listings. This can include the public professional names of organisers, hosts, performers, and venues. Each event page identifies its listing source where available.
• Technical request information — Vercel, which hosts the website, and Render, which hosts its Django API, process information needed to deliver requests. This can include an IP address, requested URL, date and time, browser or device information, and security or diagnostic data.
• Functional browser-storage information — your cookie consent choice, a signup prompt expiry time and, within the event feed, selected filters or search terms, loaded public event cards, pagination state, and scroll position. Section 5 explains this in detail.
• Analytics information (only with your consent) — if you accept analytics in the cookie banner, PostHog collects usage information such as pages viewed, clicks, referring site, approximate location derived from your IP address, and browser or device type. If you choose "Essential only", none of this is collected.

We do not intentionally collect special-category personal data, and the site does not provide user accounts, payments, or ticket sales.

3. Why we process information and our legal bases

• Newsletter — to send the weekly event email you requested. We rely on your consent. You can withdraw it at any time by unsubscribing.
• Enquiries — to read and respond to messages you send us. We rely on our legitimate interest in communicating with users and event organisers, or on taking steps at your request.
• Website delivery and security — to serve pages, prevent abuse, diagnose faults, and keep the site reliable. We rely on our legitimate interest in operating a secure service.
• Event aggregation — to collect, combine, verify, and display public event information. We rely on our legitimate interest in providing a local event discovery service.
• Analytics — to understand which pages and events are useful so we can improve the site. We rely on your consent, given through the cookie banner, and you can withdraw it at any time (see section 5).

We do not use personal data for automated decision-making or profiling.

4. Newsletter and email reporting

We use Brevo to hold the subscriber list and send our weekly newsletter. Brevo processes your email address on our behalf and keeps operational records such as delivery, bounce, complaint, and unsubscribe status.

Brevo's campaign service also generates email open and link-click reporting. This is reporting about the emails we send; it does not install a Brevo tracker on the XploreLiverpool website or track your browsing across the site. Brevo offers an account setting that anonymises open and click reporting.

Every newsletter includes an unsubscribe link. If you unsubscribe, we will stop marketing emails. Brevo may retain the minimum suppression record needed to honour your opt-out and prevent an accidental resubscription.

Read the Brevo Privacy Policy for more information.

5. Cookies, browser storage, and analytics

When you first visit, a consent banner asks whether we may use analytics. No analytics cookies are set unless you choose "Accept". We do not use advertising pixels, behavioural advertising, or cross-site tracking tools under either choice.

Analytics (only if you accept) — we use PostHog, hosted on PostHog's European Union cloud, to understand how the site is used. If you accept, PostHog sets cookies and local storage in your browser to recognise repeat visits and records usage such as pages viewed, clicks, and referring site. We use this only to improve XploreLiverpool. If you choose "Essential only", PostHog is never loaded.

You can change your cookie choice at any time — your new choice takes effect immediately.

The site also uses these functional browser-storage features, which work without analytics consent:

• Cookie consent choice (local storage) — we store whether you accepted or declined analytics so the banner is not shown on every visit.
• Newsletter prompt preference (local storage) — after you dismiss a signup prompt or successfully subscribe, we store only an expiry timestamp for 28 days so the prompt is not repeatedly shown. Your email address is not stored there.
• Event feed restoration (session storage) — we store the current feed state and scroll position for the lifetime of that browser tab or session, so opening an event and returning takes you back to the same place.

This information stays in your browser. You can remove it using your browser's site-data controls. If browser storage is blocked, the core site still works, but these preferences will not be remembered.

6. Who we share information with

We do not sell personal data or share it with advertisers. We use the following service providers:

• Brevo — newsletter list management and email delivery.
• Vercel — website hosting, content delivery, and traffic security.
• Render — Django API hosting and processing of newsletter subscription requests before they are sent to Brevo.
• Cloudflare — authoritative DNS for the public domain. Cloudflare is no longer the application host after the July 2026 hosting migration.
• Supabase — database infrastructure for event listings and internal newsletter campaign records. Subscriber email addresses are not stored in this database.
• PostHog — website analytics, loaded only after you accept analytics in the cookie banner. Usage data is processed on PostHog's European Union cloud.

We may also disclose information if required by law or necessary to establish, exercise, or defend legal rights.

7. How long we keep information

• Newsletter email addresses remain on the active Brevo list until you unsubscribe. A limited suppression record may remain for as long as needed to honour that request and meet legal obligations.
• Contact emails are kept only for as long as reasonably needed to answer the enquiry, maintain an appropriate record, or deal with a related legal issue.
• Public event information is kept while it remains useful for current listings, source auditing, deduplication, corrections, and maintaining reliable event records.
• Vercel and Render may retain limited technical, security, and diagnostic records under the service settings and retention periods that apply to our hosting accounts. We do not use those records to build visitor profiles or measure website audiences.
• Analytics data is retained under the retention settings of our PostHog project and is deleted or aggregated when no longer needed to understand site usage. Withdrawing consent stops any further collection.
• Browser-storage retention is described in section 5.

8. International processing

Brevo states that its newsletter databases are stored within the European Union, and our PostHog analytics project is hosted on PostHog's European Union cloud. Vercel, Render, and Cloudflare operate international infrastructure and may process technical data outside the UK in the locations described in their service terms.

Where a restricted international transfer occurs, we rely on the provider's applicable lawful transfer safeguards, such as UK adequacy regulations, the UK International Data Transfer Addendum, or approved standard contractual clauses.

9. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

• ask for a copy of your personal data;
• correct inaccurate or incomplete data;
• ask us to delete or restrict the use of your data;
• object to processing based on legitimate interests;
• receive certain data in a portable format; and
• withdraw newsletter consent at any time.

To exercise a right or ask us to correct or remove public event information about you, email events@xploreliverpool.co.uk. We will normally respond within one month.

You can also complain to the Information Commissioner's Office (ICO). We would appreciate the chance to address your concern first, but you do not have to contact us before approaching the ICO.

10. Tickets and third-party websites

As an aggregator, XploreLiverpool does not sell tickets or process payments. Event pages link to ticket sellers, organisers, and source websites; any purchase is made directly with that third party under its own terms and privacy policy. XploreLiverpool does not receive ticket purchase or payment information from those sites.

11. Changes to this policy

We will update this policy if the way the site processes personal data changes. The date at the top shows when it was last revised. We will make material changes clear where appropriate.

12. Contact us

For any privacy question or data request, contact events@xploreliverpool.co.uk.