This policy explains what personal data Biaa.ba.ma collects through biaabama.com, why we collect it, who we share it with, how long we keep it and what your rights are. Last updated: 25 October 2026.
Who we are
Biaa.ba.ma is a private community for elite Persians that organises elegant Persian events mostly in London. The data controller, which decides how we use your details under UK data protection law (UK GDPR and the Data Protection Act 2018), is Biaa.ba.ma. Contact us at [email protected] with any questions about this policy.
What we collect when you join a waiting list
- your full name, email address and mobile (WhatsApp) number
- your Instagram username, if you give it
- how many people are coming with you (up to 10). People who joined before 26 October 2026 may have given their names instead.
- how you heard about us, and whether you are interested in VIP or table options
- your confirmation that you are 18 or over, and whether you asked to hear about future events by email and WhatsApp
- the date and time you joined, your place on the list, and your status on it (waiting, invited, booked or removed), which the organisers set
- a scrambled (hashed) form of your IP address, used for an hour to stop spam sign-ups and deleted within about a day. We don’t store it with your details.
We need your name, email address, and mobile number to add you to the list. Everything else is optional.
What we collect when you visit the site
- Every visit: like every website, our host (GoDaddy) and our security and delivery network (Cloudflare) receive your IP address, browser details and the pages you ask for. They use this to show you the site and to protect it from attacks and bots.
- Only if you accept analytics cookies: Google Analytics records which pages you visit, how you found us (for example from Instagram), your type of device and browser, and your rough location (town or country). It links your visits to a random ID kept in a cookie, not to your name. Google Analytics does not store your IP address. We have switched off Google signals and all advertising features, so we don’t use this data for ads. We use it to look at overall numbers and do not try to identify you.
Why we use it, and our lawful basis
- To run the waiting list: offer early-bird places in the order people joined, send you your place and the private booking link, send updates about this event by email and WhatsApp, and track whether you have been invited, booked, or removed. These are steps you ask us to take before you book (UK GDPR Article 6(1)(b)).
- To stop a removed guest from joining again: if we remove someone from the list, we keep their entry until we delete the waiting list details, so the same email address cannot join again. This is in our legitimate interests in running a safe, guest-list-only event (Article 6(1)(f)).
- To plan the evening: your interest in VIP or table options, and how many people are coming with you, so we can plan numbers, tables and groups. This is in our legitimate interests in planning the evening (Article 6(1)(f)).
- Your Instagram username (if you provide it): to recognise you when we check the guest list and to reach you if email or WhatsApp doesn’t work. This is in our legitimate interests in running the guest list (Article 6(1)(f)).
- How you heard about us: to see which channels bring guests, so we know where to share future events. This is in our legitimate interests in promoting our events (Article 6(1)(f)).
- To protect the site and the form: we use a hashed IP address (kept for an hour and deleted within about a day), plus security records kept by our host and Cloudflare. This is in our legitimate interests in keeping the site and our guests’ details safe (Article 6(1)(f)).
- Photos and video at our events: to record our events and promote future ones (see “Photos and video at our events” below). This is in our legitimate interests in recording and promoting our events (Article 6(1)(f)).
- To tell you about future Biaa.ba.ma events by email and WhatsApp, only if you ticked that box. This is your consent (Article 6(1)(a) and regulation 22 of the Privacy and Electronic Communications Regulations, PECR).
- To count visitors with Google Analytics, click “Accept analytics”. This is your consent (Article 6(1)(a) and PECR regulation 6).
You can withdraw consent at any time. This does not affect anything we did before you withdrew. To stop hearing about future events, email [email protected] or tell us on WhatsApp; you keep your place on the current list. Where we rely on legitimate interests, you can object, and we will stop unless we have a strong reason to continue.
Photos and video at our events
We, and photographers and videographers working for us, take photos and videos at our events, and you may appear in them. By joining a waiting list, booking or coming to an event, you accept that you may be photographed and filmed. We use these photos and videos on our website, on Instagram and other social media, and to promote future Biaa.ba.ma events, now and in the future. Biaa.ba.ma owns the photos and videos taken by us or for us, including the copyright.
If you would rather not be photographed or filmed, tell the photographer or one of our team on the night and we will do our best to leave you out. If you appear in a photo or video we have published and want it taken down, email [email protected]. We will remove it from our website and social media accounts and not use it again. We cannot recall printed material, or copies other people have already shared.
Cookies
Cookies are small files a website stores in your browser. We set one cookie of our own to remember your choice, and Google Analytics cookies only if you accept them. We do not use advertising cookies.
Strictly necessary cookies do not need your consent under PECR. Google Analytics cookies do, so nothing from Google is loaded until you click “Accept analytics”. “Accept analytics” and “Reject” are equally easy.
Changing your choice: use “Cookie settings” at the bottom of any page. If you withdraw, Google Analytics stops, and it deletes its cookies from your browser. If your browser sends a Global Privacy Control signal, we treat it as a reject unless you choose to accept. You can also block or delete cookies in your browser settings.
Who can see your details?
Only the Biaa.ba.ma organisers see waiting list details. We do not sell your details or share them for anyone else’s marketing. These companies process data for us, under contracts that require them to protect it and use it only on our instructions:
- GoDaddy: hosts the website and the database that holds the waiting list.
- Cloudflare: delivers the site quickly and protects it from attacks and bots.
- Brevo: sends the emails from the website, such as your place on the list and the sign-up alerts organisers receive.
- Google (Google Analytics): visitor statistics, only if you accept analytics cookies.
These services also handle your details when we use them to email you, message you or take your booking. They act under their own terms and privacy policies, not only on our instructions:
- Apple (iCloud Mail): our mailbox. It receives and stores the emails you send us and our replies, and the sign-up alerts organisers receive. iCloud Mail is a personal email service, and Apple does not offer a data processing contract for it, so Apple’s own privacy policy applies.
- WhatsApp (Meta): when we message you on WhatsApp, for example with the booking link or event updates.
- Banks: you pay for your place by bank transfer, so your bank and ours handle the payment. We see the name, amount, date and reference on your payment and use them to match it to your place on the list.
We may also share details if the law requires it.
Transfers outside the UK
Google, Cloudflare, GoDaddy, Apple and Meta (WhatsApp) may process data outside the UK, including in the United States. Where they do, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework (for companies certified under it) or by the UK International Data Transfer Agreement or Addendum, which require the same level of protection as UK law. Brevo processes data in the European Union, which UK law recognises as giving adequate protection.
How long we keep it
- Waiting list details: we retain them for up to 1 year after the event, then delete them, along with any spreadsheet copies we made.
- Future events list: If you ask to hear about future events, we keep only your name, email address, mobile number and the date you joined until you ask us to stop. We delete everything else about you, along with the waiting list details.
- Payment records: the name, amount, date and reference of your bank transfer, kept for as long as UK tax law requires us to keep business records (at least 5 years after the 31 January Self Assessment deadline for that tax year), then deleted. Keeping them is a legal obligation (Article 6(1)(c)).
- Hashed IP address: used for an hour, then deleted within about a day.
- Google Analytics: data linked to the cookie ID is kept for 2 months (the shortest setting Google offers), then deleted. Only anonymous totals remain.
- Event photos and video: kept in our archive for as long as we use them to show and promote our events, unless you ask us to take one down.
- Cookies: as shown in the table above.
Your rights
You have the right to:
- get a copy of your details (access)
- have wrong details corrected (rectification)
- have your details deleted (erasure)
- ask us to limit how we use them (restriction)
- object to how we use them where we rely on legitimate interests (objection)
- get the details you gave us in a format you can take elsewhere (portability)
- withdraw your consent at any time, for future events messages or for analytics cookies
Email [email protected]. It is free, and we reply within one month. If you are unhappy with how we handle your details, email [email protected] with “Complaint” in the subject. We acknowledge complaints within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Automated decisions
We allocate places in the order people join. We do not make automated decisions about you or build a profile of you.
Over 18s only
Our events and this website are for people 18 and over. We do not knowingly collect details from anyone under 18. If we find that we have, we delete them.
Changes to this policy
When we change this policy, we update the date at the top. If we start using different cookies, we will ask for your choice again.