BRIDGWATER GUY FAWKES CARNIVAL | VOLUNTEER HUB Volunteer Hub & App Privacy Notice Version 1.0 — 27 October 2026 | Prepared for BGFC Officer review and approval. Not yet deployed to the live Hub. This notice describes how Bridgwater Guy Fawkes Carnival Committee (BGFC) handles information through its Volunteer Hub and BGFC Volunteer mobile app. It applies to adult volunteers, authorised officers, team leaders, administrators and relevant emergency contacts. 1. Data controller and contact Data controller: Bridgwater Guy Fawkes Carnival Committee (BGFC). Postal address: Bridgwater Carnival Centre, Town Hall, High Street, Bridgwater, Somerset, TA6 3DD. Privacy and data-rights enquiries: admin@bridgwatercarnivalvolunteers.co.uk. Data protection responsibilities are overseen by BGFC’s Directors and Trustees, chaired by Mr Duncan White. BGFC has not identified a separately appointed Data Protection Officer. Enquiries should be directed to the address above. 2. Who may register BGFC Volunteer registration and app access are intended for people aged 18 or over. Date of birth may be used to verify eligibility. An under-18 registration restriction and any associated minimal rejection audit are planned controls and must be implemented and verified before being described as operating. 3. Information collected BGFC collects information necessary to administer volunteer participation: name, date of birth, email address, telephone number, postcode (not full home address), role/team, operational assignment, registration and account status, photograph, digital/physical badge and QR identifier, emergency contact name and telephone number, and authorised attendance, equipment, incident and audit records. Optional medical, disability, allergy and dietary information may be provided for safety and welfare. It is sensitive information with restricted administrator access. Volunteers may request correction or deletion, subject to any applicable legal requirements. Account security information may include login activity, device/push registration identifiers and security logs. 4. Purposes and lawful bases BGFC uses information to register and contact volunteers, verify identity, allocate duties, manage attendance and equipment, provide announcements and event information, respond to incidents and emergencies, and protect the Hub and app. The likely UK GDPR Article 6 bases include legitimate interests for proportionate volunteer administration and security; legal obligation where a specific law applies; and vital interests in genuine emergencies. The applicable basis must be documented per purpose before final publication. For optional medical or disability information, BGFC must identify and document an appropriate Article 9 special-category condition, provide a clear choice where applicable, and ensure any BGFC • Privacy notice and communications • Review copy • 27 October 2026 BRIDGWATER GUY FAWKES CARNIVAL | VOLUNTEER HUB required explicit consent or other condition is properly implemented. Describing a field as optional is not by itself a lawful basis. 5. Who can access or receive information Access is controlled by role and operational need. Authorised BGFC administrators handle sensitive medical and dietary details. Relevant officers and team leaders access only information needed for their duties. BGFC may disclose necessary information to police, emergency services, insurers, legal advisers or other authorities where lawful and appropriate, including to identify or assist a volunteer and contact their emergency contact. BGFC does not sell volunteer data or use it for advertising tracking. 6. Hosting, suppliers and international transfers BGFC operates its Hub using cloud infrastructure supplied by HostPresto (Enix Ltd). BGFC has identified UK hosting, reportedly in Kent; the location of this specific service, backups, email provider and any international access or processing still require verification. Relevant processors should be subject to appropriate data-processing terms and any international transfers must have an appropriate legal mechanism. 7. Security and backups BGFC uses account authentication, role-based access, encrypted connections, protected medical/dietary fields and operational audit records. Volunteers should protect their account and badge QR code. The approved backup policy is daily backups retained for 30 days, restricted to authorised administrators with Directors’ and Trustees’ oversight. Actual automated backup frequency, backup location, restoration testing and retention implementation have not yet been verified and must not be represented as confirmed operating controls. 8. Retention and deletion Record category Approved policy period Volunteer registration, contact and account 5 years after last involvement records Attendance and participation history 5 years after last involvement Photographs and digital/physical ID records 5 years after last involvement; review/update when necessary Equipment issue/return records 5 years after last involvement Security and audit records 5 years after last involvement, subject to proportionality and security needs Routine incident reports 6 years, normally from incident closure; review where a claim or investigation remains open Serious incidents, safeguarding, insurance Longer only where justified by applicable legal or legal claims or operational requirements; review periodically Backups Target 30-day rolling retention; implementation to verify BGFC • Privacy notice and communications • Review copy • 27 October 2026 BRIDGWATER GUY FAWKES CARNIVAL | VOLUNTEER HUB BGFC will securely delete or anonymise records when no longer needed, unless a documented legal hold or other lawful reason requires longer retention. Account deactivation does not automatically erase historical records. Retention controls must be implemented and checked in the live systems. 9. Volunteer rights Volunteers can request access to a copy of their personal data, correction, erasure where applicable, restriction, objection and other rights under UK data protection law. They may request account deactivation or correction/deletion of optional medical and dietary details. Contact admin@bridgwatercarnivalvolunteers.co.uk. BGFC will respond within the applicable legal timeframe. Individuals may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. 10. Registration, welcome emails and privacy acknowledgement BGFC may send registration confirmation, email-verification, welcome and operational messages necessary to provide the service. Those messages should link to the current privacy notice and provide the privacy contact address. They should not contain passwords in readable form. Any privacy acknowledgement records receipt of the notice, not blanket consent for all processing. Incident notifications are separate from live chat; ordinary live chat messages are not intended to be forwarded by email. 11. Changes and approval BGFC will review this notice when its information collection, operations, suppliers or legal obligations materially change and will inform affected users as appropriate. Approval proposed: BGFC Officer, 27 October 2026. Officer approval and any delegated authority should be confirmed after final review. Copy to Mr Duncan White, Chair of Directors and Trustees. Items to verify before replacing the published draft  Document Article 6 lawful bases and Article 9 condition for optional medical/disability information.  Confirm HostPresto service and backup location, email supplier and any international processing.  Implement and test daily backups, 30-day retention and a successful restore.  Confirm technical data-retention/deletion controls and the proposed under-18 registration check.  Verify the public privacy URL and current welcome/registration email templates; confirm any additional third-party SDK data collection. BGFC • Privacy notice and communications • Review copy • 27 October 2026 BRIDGWATER GUY FAWKES CARNIVAL | VOLUNTEER HUB Email wording to align with the privacy notice These are replacement wording proposals. They have not been installed in the live Hub. Keep the existing verified activation and registration links generated by the backend. A. Volunteer registration confirmation Subject: BGFC Volunteer – Registration Received Thank you for registering as a volunteer with Bridgwater Guy Fawkes Carnival. We have received your registration. Please follow the email-verification instructions provided to complete the next step. Your volunteer information is handled in accordance with our Privacy Notice: https://hub.bridgwatercarnivalvolunteers.co.uk/privacy-notice. For privacy questions or to request access or correction, contact admin@bridgwatercarnivalvolunteers.co.uk. Thank you for supporting Bridgwater Carnival. B. Volunteer welcome / account activation Subject: Welcome to BGFC Volunteer Welcome to the Bridgwater Guy Fawkes Carnival Volunteer Hub. Your BGFC Volunteer account is ready for the next step shown in this email. Use the secure activation or sign-in link provided; never share your account details or volunteer QR badge. You can view our Privacy Notice at https://hub.bridgwatercarnivalvolunteers.co.uk/privacy-notice. Privacy and data-rights enquiries: admin@bridgwatercarnivalvolunteers.co.uk. We look forward to seeing you at Carnival. C. Short GDPR wording for registration screen BGFC uses your registration details to administer volunteer participation, provide identification, manage attendance and support safe Carnival operations. Optional medical and dietary information is used for volunteer welfare and has restricted access. Read our Privacy Notice before registering: https://hub.bridgwatercarnivalvolunteers.co.uk/privacy-notice. You must be aged 18 or over to register. D. Implementation notes Use one canonical public privacy URL in the Hub, mobile app, registration screen, welcome email and registration confirmation email. Preserve transactional verification links, avoid emailing passwords, and do not make the privacy notice itself a blanket consent checkbox. Verify the actual template paths before changing the running server. Test each email with a single authorised recipient before broad distribution. BGFC • Privacy notice and communications • Review copy • 27 October 2026