Draft for review. Not legal advice. Review with a solicitor or SGB Accountants before publishing.
Last updated: 27 October 2026. Version 1 (draft).
This notice explains how The Montaj Foundation C.I.C. uses your personal data when you:
- visit our website, montajfoundation.com
- book tickets for the Montaj Foundation Gala 2027
- sponsor the Gala
- donate
- contact us
- come to the Gala
1. Who we are
THE MONTAJ FOUNDATION C.I.C. ('the Foundation', 'we', 'us') is a community interest company registered in England and Wales, company number 16988732.
- Registered office: c/o SGB Accountants, Sopers House, Sopers Road, Cuffley, EN6 4RY
- Email: info@montajfoundation.com
- Website: montajfoundation.com
- Director: Kaiyan Erkan Ali
We are the 'controller' of the personal data described in this notice. This means we decide why and how it is used.
We have not appointed a Data Protection Officer, because the law does not require one for an organisation like ours. Please send any privacy question to info@montajfoundation.com.
ICO registration: [PLACEHOLDER: the Foundation's own ICO registration number once it registers, or remove this line if the ICO self-assessment confirms it is exempt. Montaj Digital's number can't be used, because the Foundation is a separate controller.]
2. The Gala in brief
The Montaj Foundation Gala 2027 is a black-tie fundraising evening on Saturday 13 March 2027 in the Garden Marquee at Hunton Park Hotel, Essex Lane, Abbots Langley, WD4 8PN. Our fundraising for the Gala supports Barts Heart Centre through Barts Charity. The Foundation runs the Gala, and Mon Bleu Events is our event planner.
3. What we collect
Where we get your data
We get personal data:
- from you, for example when you book, sponsor, donate or email us
- from the person who booked a ticket or table for you
- from the sponsor business that gave you one of its tickets, or from a colleague who named you as a contact for a sponsorship
- from our event planner, Mon Bleu Events, for example when it collects your dietary needs or records seating
3.1 Ticket and table bookings
When you book a single ticket (£150) or a table of 10 (£1,350), we collect:
- your name, email address and phone number
- your billing details and a record of your payment (card details go to our payment provider, not to us; see section 6)
- the names and contact details of the guests you are booking for
- seating requests, such as who you would like to sit with
You must give us your name, contact details and payment to book. Without them we cannot process your booking. Everything else is optional.
Dietary and access needs. Dietary needs and allergies can reveal information about your health. Some dietary choices can also reveal religious or philosophical beliefs. Access needs are often health information. The law treats all of these as 'special category' data, which needs extra protection.
We only collect this information with your own explicit consent, and only use it to cater for you and look after you on the night. When you give consent, you agree that we may share it with our event planner, Mon Bleu Events, and our venue, Hunton Park Hotel, so they can serve you safely and meet your needs. You do not have to give it, but if you don't, we may not be able to meet your needs.
Booking for other people. If you book for guests, please give us only their names and contact details. Do not give us their dietary or access needs. Please tell your guests that you are sharing their details with us, and point them to this notice. We will send each guest a short form so they can tell us their own dietary and access needs and give their own consent. [PLACEHOLDER: confirm how the guest form works and whether the Foundation or Mon Bleu Events sends it.]
3.2 Sponsor enquiries and purchases
When a business enquires about or buys a sponsor package (Silver £1,000, Gold £2,500 or Platinum £5,000), we collect:
- the name, job title, email address and phone number of the contact person
- billing contact details, the business's billing address and payment records
- the names and contact details of the sponsor's guests who use the tickets included in the package
- logos, brochure artwork, goodie bag items (Gold and Platinum), and, for Platinum sponsors, a 60-second video and the name of the person giving the 5-minute speech
- our emails and other messages with the sponsor
Sponsors should give us only their guests' names and contact details. Each guest will receive the same guest form described in section 3.1 to give their own dietary and access needs and consent.
Logos and company details are usually business information rather than personal data. They become personal data if they identify an individual, for example a sole trader's name.
3.3 Donations
When you donate, we or our donation platform collect your name, email address, the amount and date of your gift, payment records and any message you leave. [PLACEHOLDER: whether donor names are published and whether donors can give anonymously.]
The Foundation is a community interest company, not a registered charity, so we cannot claim Gift Aid on donations made to us. [PLACEHOLDER: donation platform, and whether it collects Gift Aid declarations on behalf of Barts Charity. If it does, describe here what it collects (such as your home address and taxpayer status) and who receives it.]
3.4 Contact emails and enquiries
When you email info@montajfoundation.com or use a contact form, we collect your name, email address, any other contact details you give, and what you tell us.
3.5 The night itself
At the Gala we may collect:
- Photos and video. We plan to have a photographer and a content creator at the Gala, and there may be a photobooth. Your image may appear in photos and video of the room, the dancefloor, the stage and the photobooth. [PLACEHOLDER: confirm which photo and video suppliers are booked, their names, and whether a separate videographer is booked.] See section 5 for how to opt out.
- Check-in records. We record who has arrived, so we can manage entry, seating and safety.
- Raffle and other games. These include the raffle and games such as heads and tails. Raffle tickets are sold on the night only, and Hunton Park is a cashless venue. We record the names of prize winners so we can hand over prizes, and we may announce winners in the room. Card payments go through [PLACEHOLDER: payment provider used for raffle and games on the night].
- Incidents. If there is an accident or incident, we may record details, which may include health information, to meet our legal obligations and any insurance requirements.
Mon Bleu Events may photograph the set-up for its own portfolio. Mon Bleu has told us these photos will not show identifiable guests.
3.6 Website technical data and cookies
When you visit montajfoundation.com, our hosting provider automatically records technical data such as your IP address, browser type, device, the pages you visit and the time of your visit. This keeps the site secure and working. For cookies and similar technologies, see section 12.
Hosting provider: [PLACEHOLDER: hosting provider; Vercel is proposed]. We also use analytics cookies, but only if you agree to them (see section 12). Analytics tool: [PLACEHOLDER: analytics tool].
4. Why we use it
The law says we must have a 'lawful basis' for each use of your personal data. For special category data, such as dietary and access needs, we also need an extra condition.
| What we do | Data used | Lawful basis |
|---|---|---|
| Take your booking, issue tickets and manage your place | Your booking details, payment records | Contract: we need it to provide what you have booked |
| Manage guests named by a booker or a sponsor, including seating | Guest names, contact details, seating requests | Legitimate interests: managing attendance, seating and safety at an event you have been invited to |
| Cater for dietary needs and allergies, and meet access needs | Dietary and access information | Your explicit consent (1) |
| Send essential information about the Gala, such as timings and changes | Contact details | Contract if you booked; legitimate interests if someone booked for you |
| Check guests in on the night | Names, check-in records | Legitimate interests: safety and managing entry |
| Deliver sponsor packages, issue invoices and take payment | Sponsor contact, billing and guest details, logos, artwork, video | Contract: if you are the sponsor (for example, a sole trader). Legitimate interests: if you are a staff member we deal with on your company's behalf |
| Reply to sponsor enquiries before a package is agreed | Contact details, enquiry | Legitimate interests: responding to businesses that ask about sponsoring |
| Process and acknowledge donations | Donor details, amount, payment records | Legitimate interests: processing your gift, thanking you and keeping records |
| Reply to emails and enquiries | Contact details, message | Legitimate interests: answering people who contact us |
| Keep financial and tax records | Payment records, invoices, donation records | Legal obligation: tax and company law |
| Share records with our accountants | Financial and transaction records | Legal obligation and legitimate interests: preparing our accounts and tax returns |
| Take photos and video at the Gala and use them to report on and promote the Foundation's events | Images and video | Legitimate interests: showing what the event achieved and promoting future fundraising. Before we feature you prominently in advertising, we will ask for your consent (see section 5) |
| Share sponsor recognition on the sponsor board and step and repeat, the screen loop, the Gala brochure, the partners section of our website and an Instagram thank-you post | Sponsor names, logos, artwork and video | Contract |
| Run the raffle and hand over prizes | Winner names, contact details | Legitimate interests: running a fair draw and delivering prizes |
| Record incidents and keep everyone safe | Incident details, which may include health information | Legitimate interests. For health information: to protect someone's life in an emergency, or to make or defend legal claims (2) |
| Keep the website secure and working | Technical data | Legitimate interests: running a secure website |
| Use non-essential cookies, such as analytics | Cookie data | Consent |
| Send marketing emails about future events and fundraising | Name, email address | Consent (see section 9) |
| Share your details with Barts Charity | Donor or guest details | Consent only (see section 6) |
(1) UK GDPR Articles 6(1)(a) and 9(2)(a). (2) UK GDPR Articles 6(1)(f), 9(2)(c) and 9(2)(f).
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that balancing, and you can object at any time (see section 10).
We do not make decisions about you using only automated means, and we do not profile you.
5. Photos and video on the night
In this notice, 'advertising' means any promotion of the Foundation or its events, paid or unpaid, such as ads, posters, flyers and promotional posts.
- We will tell guests about photography when they book, and we will display notices at the venue.
- If you would rather not be photographed, tell us when you book or tell a member of the team on arrival. We will tell our photographer, content creator and photobooth supplier, and ask them not to feature you. [PLACEHOLDER: how opt-out guests are identified on the night, for example a sticker or wristband.]
- We will not use photos or video in which you are prominently featured in advertising without your consent.
- If you would like us to remove a published photo of you, email info@montajfoundation.com. We will stop using it and remove it from channels we control, unless we have a compelling reason not to.
6. Who we share it with
We only share personal data where we need to, and we never sell it.
Companies that work for us
These companies may only use your data on our instructions and must keep it secure.
| Who | What for | What they receive |
|---|---|---|
| Mon Bleu Events Limited (event planner) | Seating, RSVPs, dietary planning and running the night | Guest names, seating requests, dietary information [PLACEHOLDER: confirm whether access needs are also shared with Mon Bleu Events] |
| [PLACEHOLDER: ticketing platform] | Selling tickets and tables | Booking and contact details, payment records |
| [PLACEHOLDER: payment provider] | Taking card payments for tickets, sponsorship, donations, raffle and games | Payment details |
| [PLACEHOLDER: donation platform] | Taking donations | Donor details |
| [PLACEHOLDER: hosting provider; Vercel is proposed] | Hosting montajfoundation.com | Website technical data, form submissions |
| [PLACEHOLDER: email provider for info@montajfoundation.com] | Our email | Messages and contact details |
| Resend (Resend, Inc., United States) | Sending marketing emails | Name, email address, marketing preferences |
| Our photographer, content creator and photobooth supplier [PLACEHOLDER: supplier names] | Recording the evening | Images and video |
| [PLACEHOLDER: AV and LED wall supplier] | Showing the screen loop and sponsor videos | Sponsor videos and logos |
| [PLACEHOLDER: brochure and goodie bag printer] | Printing the Gala brochure and sponsor items | Sponsor artwork |
| [PLACEHOLDER: MC or host] | Running the stage programme | Names of speakers, such as the person giving a Platinum sponsor's speech |
| Montaj Digital (the Foundation's Founding Partner, which builds and runs our website free of charge). Montaj Digital is run by our director | Building and maintaining the website | Website technical data and form submissions, where needed for the work |
Mon Bleu Events deletes the guest data it holds within 90 days after the Gala.
Other organisations
- Hunton Park Hotel, our venue. [PLACEHOLDER: confirm what guest data Mon Bleu Events or the Foundation shares with Hunton Park, such as dietary lists and table plans, and whether the hotel acts for us or as a separate controller for catering safety only.] The hotel will not use guest data for its own marketing.
- SGB Accountants, our accountants, receive financial and transaction records so they can prepare our accounts and tax returns.
- Barts Charity. Our fundraising for the Gala supports Barts Heart Centre through Barts Charity. [PLACEHOLDER: confirm with Barts Charity what share of proceeds goes to it and that the fundraising activity is registered.] We only share your personal details with Barts Charity if you have given us clear consent, for example by ticking a box asking it to thank you or keep you updated.
- Professional advisers, insurers and authorities, such as our solicitors, insurers, HMRC, the police or a regulator, where the law requires it or where it is needed to make, defend or settle a legal claim.
- Sponsors. If a sponsor gives you one of its included tickets, the sponsor tells us your name, and we may confirm your name to that sponsor. We never share other guests' details with sponsors.
7. Data outside the UK
Some of our service providers may store or access data outside the UK. For example, many website hosting, email and payment providers are based in the United States or the European Economic Area.
If a provider handles your data outside the UK, we make sure it is protected to UK standards. Either the UK government has approved that country or scheme, or we use UK-approved contract terms. (The formal names are UK adequacy regulations, which include the EEA and the UK Extension to the EU-US Data Privacy Framework; and the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.)
Resend, our email provider, is based in the United States. [PLACEHOLDER: the safeguard Resend relies on, for example the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum; check Resend's data processing agreement.] [PLACEHOLDER: add the other providers that transfer data outside the UK once they're chosen.]
You can ask us for a copy of the safeguards by emailing info@montajfoundation.com.
8. How long we keep it
| Data | How long we keep it |
|---|---|
| Dietary and access information | We delete it within 30 days after the Gala. Our event planner, Mon Bleu Events, deletes its copy within 90 days |
| Seating requests and table plans | Deleted within 90 days after the Gala |
| Check-in records | Deleted within 90 days after the Gala |
| Booking, payment, invoice and donation records | 6 years from the end of the financial year they relate to [PLACEHOLDER: confirm retention period with SGB Accountants] |
| Sponsor contact details and correspondence | 6 years from the end of the financial year of the sponsorship [PLACEHOLDER: confirm retention period with SGB Accountants]. Contact details may be kept for longer to discuss future events, unless the sponsor objects |
| Sponsor logos and artwork | Kept for the 2027 Gala season. Logos on the partners section of our website and Instagram posts stay live as a record of the Gala unless the sponsor asks us to remove them |
| Contact emails and enquiries that don't lead to a booking or sponsorship | 2 years from our last contact |
| Raffle winner records | 1 year after the Gala |
| Incident records | 3 years after the incident, or longer if a claim is made |
| Published photos and video | Kept as a record of the Gala and used to promote future events. We review our published image library every [PLACEHOLDER: review period], and you can ask us to remove an image of you at any time |
| Unpublished photos and video | Deleted within 2 years after the Gala |
| Marketing preferences | Until you unsubscribe. After that, we keep your email address on a 'do not contact' list so we don't email you again |
| Website technical logs | [PLACEHOLDER: retention period set by the hosting provider] |
| Cookie data | As set out in the cookie table in section 12 |
When we no longer need data, we delete it securely or make it anonymous.
9. Marketing
We will only send you marketing emails about future events, sponsorship or fundraising if you have opted in, for example by ticking a box when you book. The box will never be ticked for you. This is what UK marketing law requires.
You can unsubscribe at any time using the link in any marketing email, or by emailing info@montajfoundation.com. Unsubscribing will not affect emails we need to send you about a booking you have made.
We send marketing emails using Resend.
10. Your rights
You have these rights over your personal data:
- Get a copy. Ask for a copy of the personal data we hold about you.
- Correct it. Ask us to correct data that is wrong or incomplete.
- Delete it. Ask us to delete your data. This is sometimes called the 'right to be forgotten'.
- Limit how we use it. Ask us to limit how we use your data, for example while we check whether it is accurate.
- Take it with you. Ask for data you gave us in a common digital format, or ask us to send it to someone else. This applies to data we hold because you agreed or because you booked with us.
- Object. Object to our use of your data where we rely on legitimate interests. You can always object to direct marketing, and we will stop.
- Withdraw consent. Where we rely on your consent, such as for dietary and access information, marketing, cookies or sharing with Barts Charity, you can withdraw it at any time. This does not affect anything we did before you withdrew. If you withdraw consent for dietary or access information before the Gala, we may not be able to meet those needs on the night.
Some rights have limits. For example, we may need to keep payment records for tax purposes even if you ask us to delete them. If so, we will explain why.
How to use your rights. Email info@montajfoundation.com, or write to us at our registered office. We may need to confirm your identity first. We will reply within one month. If your request is complex, we may extend this by up to two more months, and we will tell you if we do. There is usually no charge.
11. Complaints
If you are unhappy with how we have used your data, please contact us first at info@montajfoundation.com so we can try to put it right. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Cookies
Cookies are small files placed on your device when you visit a website. Some are strictly necessary for the site to work, and don't need your consent. Others, such as analytics or advertising cookies, are non-essential. We will only set these if you agree, through the cookie banner on our site. You can change your choice at any time using [PLACEHOLDER: cookie settings link]. You can also block or delete cookies in your browser settings.
Our payment, ticketing and donation providers may set their own cookies when you use their checkout pages. Their own privacy and cookie notices apply to those cookies.
We use strictly necessary cookies, which the site needs to work, and analytics cookies, which help us understand how the site is used. Analytics cookies are only set if you accept them. [PLACEHOLDER: complete this table once the site's cookies are audited.]
| Cookie name | Provider | Purpose | Type | Expires |
|---|---|---|---|---|
| [PLACEHOLDER: cookie name] | [PLACEHOLDER: provider] | [PLACEHOLDER: purpose] | [PLACEHOLDER: type: strictly necessary, analytics or marketing] | [PLACEHOLDER: expiry] |
| [PLACEHOLDER: cookie name] | [PLACEHOLDER: provider] | [PLACEHOLDER: purpose] | [PLACEHOLDER: type: strictly necessary, analytics or marketing] | [PLACEHOLDER: expiry] |
13. Children
The Gala is for adults only: guests must be 18 or over. Our website is not aimed at children, and we do not knowingly collect personal data from children. If you think a child has given us their data, please email info@montajfoundation.com and we will delete it.
14. Keeping your data secure
We take sensible steps to protect your data. These include limiting access to the people who need it, using providers with strong security, and using secure (HTTPS) connections on our website. We never store your full card details ourselves.
We will report a breach to the ICO where the law requires, and tell you without undue delay if it is likely to cause a high risk to you.
15. Changes to this notice
We may update this notice, for example when we choose our ticketing, payment and donation providers, or when the law changes. We will post the latest version on this page with its 'last updated' date. If we make an important change that affects how we use data you have already given us, we will tell you directly by email before it takes effect.
This notice is written to follow UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.