Privacy Policy

Last updated: 6 September 2026

Your Local Farmers Markets Ltd (“YLFM”, “we”, “us”) is the controller of the personal information described in this notice. This policy covers traders and applicants, portal and website users, competition entrants and voters, people who contact us, venue contacts, suppliers and other people whose information we use in operating our markets and events.

For privacy questions or to exercise your rights, please use our contact form.

Information we collect

Traders and applicants: names, business and contact details, addresses, emergency contacts, account credentials, products, market choices, attendance, correspondence, invoices and payment/customer references.
Compliance: insurance, risk assessments, food-business registration and ratings, inspection dates, Gas Safe and electrical-testing information, together with related documents.
Marketing and profiles: business descriptions, websites, photographs and other material supplied for public promotion.
Competition entrants: entrant first name and email, entry and confirmation records, dog details and uploaded photographs, and optional marketing consent.
Competition voters: email address, selections, verification records, IP address, browser/user-agent information and optional marketing consent.
Website users and enquiries: account details, messages, email address, essential session and security information, device/browser data and server logs.
Other contacts: information needed to work with venues, suppliers, contractors, authorities and members of the public.

We normally receive information directly from you. We may also receive or verify information through your business, staff, public registers, venue operators, local authorities, the Food Standards Agency, insurers and payment providers.

Why we use information and our lawful bases

Contract: to assess applications, administer bookings and attendance, provide portal services, invoice traders and manage payments.
Legal obligation: to meet accounting, tax, food-safety, health-and-safety, insurance and other regulatory duties.
Legitimate interests: to operate safe and balanced markets, communicate about services, prevent misuse and duplicate voting, secure and improve the website, handle enquiries and legal claims, and promote participating traders and events. We balance these interests against your rights.
Consent: for optional email marketing and where consent is the appropriate basis for publishing or using submitted material. You may withdraw consent at any time without affecting earlier lawful use.

We do not make decisions producing legal or similarly significant effects using solely automated processing. Staff make application and market-allocation decisions.

Competitions and public content

We use entrant and voter information to administer entries, verify ownership and votes, prevent abuse, communicate results and award prizes. Published competition pages may show a dog’s name, breed, entry number and photograph. An entrant’s first name may also appear where the competition format makes this clear. Email addresses, IP addresses and private contact details are not published.

A parent or guardian should submit an entry on behalf of a child under 13. Optional marketing consent is separate from entering or voting and is not required to participate.

Who we share information with

We share information only where necessary with service providers supporting hosting, email, cloud storage and backup, security and bot prevention, website delivery, payment processing (including Stripe), professional advice and IT support. We may also share relevant information with venues, event partners, insurers, emergency services, local authorities, regulators or law-enforcement bodies when operationally or legally necessary.

Public trader profiles and approved competition content are visible to website visitors. We do not sell personal information.

International transfers

Some technology providers may process information outside the UK. Where UK adequacy regulations do not apply, we require an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. Contact us if you would like more information about a relevant safeguard.

How long we keep information

Trader, booking, contractual and financial records are generally retained for up to six years after the relevant relationship or accounting period, unless a longer period is required for a dispute or legal obligation.
Current compliance documents are kept while required to administer trading and safety. Superseded or unsuccessful-application material is reviewed and removed when no longer reasonably needed, normally within two years unless connected to an ongoing relationship or claim.
Competition voting and verification records are normally retained for up to 12 months after a competition closes. Winning, published or dispute-related records may be kept longer as part of the event archive.
Public photographs and promotional material remain available while the relevant profile, entry or event archive is published, or until they are no longer needed or permission is withdrawn where consent is the basis.
Enquiries are normally retained for up to two years. Security logs are retained only for as long as reasonably necessary for security and investigation.
Marketing records are retained until consent is withdrawn or you object. We may retain a minimal suppression record so that we honour an opt-out.

Our restricted system backups use daily and weekly rotation with monthly recovery archives. Information deleted from live systems may remain in a backup until that backup is retired. Backups are used only for security and disaster recovery; if a backup is restored, relevant deletions and restrictions will be reapplied where practicable.

Security

We use access controls, account authentication, encrypted connections, restricted administration, backups and appropriate organisational measures. No online service is completely risk-free, but we review safeguards and limit access to people who need the information.

Cookies and website storage

We use a small amount of browser storage to operate the website securely, keep people signed in and remember temporary interface choices. The storage currently used is essential to a service you request, supports website security, or is used only for the limited purposes described below.

Cookie or storage	Purpose	Typical duration
`sessionid`	Keeps authorised traders, staff and venue users signed in and maintains essential application-form progress.	Up to two weeks, or until it is deleted or replaced.
`csrftoken`	Protects forms and signed-in accounts against forged or unauthorised submissions.	Up to approximately one year.
Cloudflare Turnstile security storage	Helps distinguish genuine application submissions from automated abuse. Cloudflare may process device and network information and may place security storage when a challenge requires it.	For the security challenge or as otherwise required by Cloudflare to prevent abuse.
Market-plan interface storage	Uses session storage to remember scroll position and whether staff have collapsed attendance cards.	Until the relevant browser tab or browsing session is closed.
Competition interface storage	Uses session storage to restore the visitor’s position after viewing or updating an entry.	Until the relevant browser tab or browsing session is closed.

Our website analytics are processed on our own server and do not place or read an analytics cookie. We record page paths, broad referral sources, response performance and security events. For visitor counting and abuse prevention, an IP address is immediately transformed into a one-way daily identifier; the raw address is not stored in analytics. These temporary identifiers expire after eight days, while non-identifying aggregate totals may be retained to understand and improve the service.

You can delete or block cookies and website storage using your browser settings, although blocking essential storage may prevent login, forms and other requested features from working. We do not currently use advertising or behavioural-tracking cookies. If we introduce non-essential storage for which consent is required, we will ask for permission before using it and provide a way to change that choice.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, receive a portable copy, and object to processing.

Your right to object: you can object at any time to direct marketing. You can also object to processing based on our legitimate interests; we will stop unless we have compelling legitimate grounds or need the information for legal claims.

Where we rely on consent, you may withdraw it at any time. You may also complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first if you would like us to try to resolve your concern.

Changes to this policy

We may update this policy when our services or legal obligations change. The current version and revision date will remain available on this page.