DRAFT for the owner to review. Check every line and fill in the three [placeholder] parts (your legal name and address, how long you keep waiting list details, and your booking or ticket provider), then delete this paragraph. Check the reasons given for the Instagram username and “how you heard about us” match what you really use them for. Risk to decide on: site email runs on iCloud Mail, a personal service that Apple offers no data processing contract for. The policy says so, but a business email provider with a processing agreement (for example Google Workspace, Microsoft 365 or Zoho Mail) is the safer choice; if you switch, update “Who can see your details”. While this paragraph is here, the page is hidden from search engines. This is a plain-English starting point, not legal advice.
This policy explains what personal data Biaa.ba.ma collects through biaabama.com, why we collect it, who we share it with, how long we keep it and what your rights are. Last updated: 25 October 2026.
Who we are
Biaa.ba.ma organises Persian events in London. The data controller, which decides how your details are used under UK data protection law (UK GDPR and the Data Protection Act 2018), is [placeholder: the full legal name of the person or company that runs Biaa.ba.ma, and a postal address]. Contact us at [email protected] about anything in this policy.
What we collect when you join a waiting list
- your full name, email address and mobile (WhatsApp) number
- your Instagram username, if you give it
- the names of anyone you are coming with, if you give them
- how you heard about us, and whether you are interested in VIP or table options
- your confirmation that you are 18 or over, and whether you asked to hear about future events by email and WhatsApp
- the date and time you joined, your place on the list, and your status on it (waiting, invited, booked or removed), which the organisers set
- a scrambled (hashed) form of your IP address, used for an hour to stop spam sign ups and deleted within about a day. It is not stored with your details.
We need your name, email address and mobile number to put you on the list. Everything else is optional. If you give us a friend’s name, please check they are happy for you to share it.
What we collect when you visit the site
- Every visit: like every website, our host (GoDaddy) and our security and delivery network (Cloudflare) receive your IP address, browser details and the pages you ask for. They use this to show you the site and to protect it from attacks and bots.
- Only if you accept analytics cookies: Google Analytics records which pages you visit, how you found us (for example from Instagram), your type of device and browser, and your rough location (town or country). It links your visits to a random ID kept in a cookie, not to your name. Google Analytics does not store your IP address. We have switched off Google signals and all advertising features, so this data is not used for ads. We use it to look at overall numbers and do not try to identify you.
Why we use it, and our lawful basis
- To run the waiting list: offer early bird places in the order people joined, send you your place, the private booking link and updates about this event by email and WhatsApp, and keep track of whether you have been invited, have booked or have been removed. These are steps you ask us to take before you book (UK GDPR Article 6(1)(b)).
- To stop a removed guest joining again: if we remove someone from the list, we keep their entry until the waiting list details are deleted, so the same email address cannot join again. This is in our legitimate interests in running a safe, guest-list-only event (Article 6(1)(f)).
- To plan the evening: your interest in VIP or table options, and the names of anyone you are coming with, so we can plan numbers, tables and groups. This is in our legitimate interests in planning the evening (Article 6(1)(f)).
- Your Instagram username, if you give it: to recognise you when we check the guest list, and to reach you if email or WhatsApp does not work. This is in our legitimate interests in running the guest list (Article 6(1)(f)).
- How you heard about us: to see which channels bring guests, so we know where to share future events. This is in our legitimate interests in promoting our events (Article 6(1)(f)).
- To protect the site and the form: the hashed IP address (used for an hour, deleted within about a day), and the security records kept by our host and Cloudflare. This is in our legitimate interests in keeping the site and our guests’ details safe (Article 6(1)(f)).
- To tell you about future Biaa.ba.ma events by email and WhatsApp, only if you ticked that box. This is your consent (Article 6(1)(a) and regulation 22 of the Privacy and Electronic Communications Regulations, PECR).
- To count visitors with Google Analytics, only if you click “Accept analytics”. This is your consent (Article 6(1)(a) and PECR regulation 6).
You can withdraw consent at any time. This does not affect anything we did before you withdrew. To stop hearing about future events, email [email protected] or tell us on WhatsApp; you keep your place on the current list. Where we rely on legitimate interests you can object, and we will stop unless we have a strong reason to continue.
Cookies
Cookies are small files a website stores in your browser. We set one cookie of our own, to remember your choice, and Google Analytics cookies only if you accept them. We do not use advertising cookies.
Strictly necessary cookies do not need your consent under PECR. Google Analytics cookies do, so nothing from Google is loaded until you click “Accept analytics”. “Accept analytics” and “Reject” are equally easy.
Changing your choice: use “Cookie settings” at the bottom of any page. If you withdraw, Google Analytics stops and its cookies are deleted from your browser. If your browser sends a Global Privacy Control signal, we treat it as a reject unless you choose to accept. You can also block or delete cookies in your browser settings.
Who can see your details
Only the Biaa.ba.ma organisers see waiting list details. We do not sell your details or share them for anyone else’s marketing. These companies process data for us, under contracts that require them to protect it and use it only on our instructions:
- GoDaddy: hosts the website and the database that holds the waiting list.
- Cloudflare: delivers the site quickly and protects it from attacks and bots.
- Google (Google Analytics): visitor statistics, only if you accept analytics cookies.
These services also handle your details when we use them to email you, message you or take your booking. They act under their own terms and privacy policies, not only on our instructions:
- Apple (iCloud Mail): our email provider. It sends and stores the emails between you and us, such as your place on the list, and the sign up alerts the organisers receive. iCloud Mail is a personal email service, and Apple does not offer a data processing contract for it, so Apple’s own privacy policy applies.
- WhatsApp (Meta): when we message you on WhatsApp, for example with the booking link or event updates.
- [placeholder: your booking or ticket provider, for example Eventbrite or Stripe]: takes your booking and payment when you use the private booking link.
We may also share details if the law requires it.
Transfers outside the UK
Google, Cloudflare, GoDaddy, Apple, Meta (WhatsApp) and our booking provider may process data outside the UK, including in the United States. Where they do, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework (for companies certified under it) or by the UK International Data Transfer Agreement or Addendum, which require the same level of protection as UK law.
How long we keep it
- Waiting list details: until [placeholder: how long, for example 3 months after the event], then deleted, together with any spreadsheet copies we made.
- Future events list: if you asked to hear about future events, we keep only your name, email address, mobile number and the date you joined, until you ask us to stop. Everything else about you is deleted with the waiting list details.
- Hashed IP address: used for an hour, then deleted within about a day.
- Google Analytics: data linked to the cookie ID is kept for 2 months (the shortest setting Google offers), then deleted. Only anonymous totals remain.
- Cookies: as shown in the table above.
Your rights
You have the right to:
- get a copy of your details (access)
- have wrong details corrected (rectification)
- have your details deleted (erasure)
- ask us to limit how we use them (restriction)
- object to how we use them where we rely on legitimate interests (objection)
- get the details you gave us in a format you can take elsewhere (portability)
- withdraw your consent at any time, for future events messages or for analytics cookies
Email [email protected]. It is free, and we reply within one month. If you are unhappy with how we handle your details, email [email protected] with “Complaint” in the subject. We acknowledge complaints within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Automated decisions
Places are given in the order people join. We do not make automated decisions about you or build a profile of you.
Over 18s only
Our events and this website are for over 18s only. We do not knowingly collect details from anyone under 18. If we find that we have, we delete them.
Changes to this policy
When we change this policy we update the date at the top. If we start using different cookies, we will ask for your choice again.