Privacy Policy

Last updated: 8 September 2026

Your Local Farmers Markets Ltd (“YLFM”, “we”, “us”) is the controller of the personal information described in this notice. This policy covers traders and applicants, portal and website users, competition entrants and voters, people who contact us, venue contacts, suppliers and other people whose information we use in operating our markets and events.

For privacy questions or to exercise your rights, please use our contact form.

Our approach to privacy

Respect for our traders, venue partners, customers and visitors includes respecting their privacy. We ask for the information we genuinely need to operate our markets, maintain safety and compliance, provide requested services and protect the website, and we explain those uses in this policy.

We do not sell your personal information or use it to build advertising profiles or target you with advertising. We do not share it with social-media or advertising platforms for those purposes, and we do not use Google Analytics, the Meta/Facebook Pixel or similar cross-site tracking technologies. We want you to feel able to deal openly with YLFM, knowing that the information you provide will be handled carefully and used only for the legitimate purposes described here.

Information we collect

Traders and applicants: identity and contact information, account, application, booking, attendance, payment and correspondence records, and information required to assess and administer participation in our markets.
Accreditation and compliance: documents and records reasonably required to assess and demonstrate insurance, licensing, food-safety, health-and-safety and other applicable compliance requirements.
Marketing, profiles and event photography: business descriptions, websites, photographs and other promotional material supplied to us or captured at our markets and events.
Competition entrants and voters: contact information, submitted entries and content, voting and verification records, security and abuse-prevention information, and marketing preferences where provided.
Website users and enquiries: account details, messages, email address, essential session and security information, device/browser data and server logs.
Other contacts: information needed to work with venues, suppliers, contractors, authorities and members of the public.

We normally receive information directly from you. We may also receive or verify information through your business, staff, public registers, venue operators, local authorities, the Food Standards Agency, insurers and payment providers.

Why we use information and our lawful bases

Contract: to assess applications, administer bookings and attendance, provide portal services, invoice traders and manage payments.
Legal obligation: to meet accounting, tax, food-safety, health-and-safety, insurance and other regulatory duties.
Legitimate interests: to operate safe and balanced markets, communicate about services, prevent misuse and duplicate voting, secure and improve the website, handle enquiries and legal claims, and promote participating traders and events. We balance these interests against your rights.
Consent: for optional email marketing and where consent is the appropriate basis for publishing or using submitted material. You may withdraw consent at any time without affecting earlier lawful use.

We do not make decisions producing legal or similarly significant effects using solely automated processing. Staff make application and market-allocation decisions.

Competitions and public content

We use entrant and voter information to administer entries, verify ownership and votes, prevent abuse, communicate results and award prizes. Published competition pages may show a dog’s name, breed, entry number and photograph. An entrant’s name may also appear where the competition format makes this clear. Email addresses, IP addresses and private contact details are not published.

Where an entrant or voter has chosen to receive marketing, we retain their contact details and consent record so that we can send them offers and information about future YLFM events and competitions. Marketing consent is optional, is separate from entering or voting, and is not required to participate. It can be withdrawn at any time.

Event photography and promotion

We may take or use photographs and short videos of our markets and events, including images of traders and members of the public. We may publish them on YLFM websites, social-media pages such as Facebook and Instagram, and other relevant promotional channels to show what our events are like and let people know about current and future events.

We generally rely on our legitimate interests in promoting YLFM and participating traders for general event and crowd photography. We take particular care where an individual is the main subject of an image or where children may be identifiable, and will seek permission where appropriate. We aim to make event photography clear and, wherever practical, respect requests not to be photographed.

If you are concerned about an image of you or would like us to stop using it, please use our contact form. We will consider the request promptly and remove the image where appropriate. Publishing photographs for event promotion is separate from sharing personal information with social-media platforms for advertising profiles or targeted advertising, which we do not do.

Who we share information with

We share information only where necessary with service providers supporting hosting, email, cloud storage and backup, security and bot prevention, website delivery, payment processing (including Stripe), professional advice and IT support. We may also share relevant information with venues, event partners, insurers, emergency services, local authorities, regulators or law-enforcement bodies when operationally or legally necessary.

For a market or event, authorised representatives of the relevant venue and competent authorities may be given restricted access to participating traders’ accreditation status and the supporting compliance documents reasonably required to verify insurance, licensing, food-safety, health-and-safety or other regulatory requirements. This may include a relevant history of document approval, rejection, expiry and replacement where reasonably necessary to demonstrate consistent safety and compliance management. Access is limited to the relevant venue, event and purpose.

Public trader profiles, approved competition content and event photography may be visible to website visitors or published through the promotional channels described above. We do not sell personal information.

International transfers

Some technology providers may process information outside the UK. Where UK adequacy regulations do not apply, we require an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. Contact us if you would like more information about a relevant safeguard.

How long we keep information

Trader, booking, contractual and financial records are generally retained for up to six years after the relevant relationship or accounting period, unless a longer period is required for a dispute or legal obligation.
Current compliance documents are kept while required to administer trading and safety. Superseded or unsuccessful-application material is reviewed and removed when no longer reasonably needed, normally within two years unless connected to an ongoing relationship or claim.
Competition voting and verification records are normally retained for up to 12 months after a competition closes. Winning, published or dispute-related records may be kept longer as part of the event archive.
Public photographs and promotional material remain available while the relevant profile, entry or event archive is published, or until they are no longer needed or permission is withdrawn where consent is the basis.
Enquiries are normally retained for up to two years. Security logs are retained only for as long as reasonably necessary for security and investigation.
Marketing records are retained until consent is withdrawn or you object. We may retain a minimal suppression record so that we honour an opt-out.

Our restricted system backups use daily and weekly rotation with monthly recovery archives. Information deleted from live systems may remain in a backup until that backup is retired. Backups are used only for security and disaster recovery; if a backup is restored, relevant deletions and restrictions will be reapplied where practicable.

Security

We use access controls, account authentication, encrypted connections, restricted administration, backups and appropriate organisational measures. No online service is completely risk-free, but we review safeguards and limit access to people who need the information.

Cookies and website storage

We use a small amount of browser storage to operate the website securely, keep people signed in and remember temporary interface choices. The storage currently used is essential to a service you request, supports website security, or is used only for the limited purposes described below.

Cookie or storage	Purpose	Typical duration
`sessionid`	Keeps authorised traders, staff and venue users signed in and maintains essential application-form progress.	Up to two weeks, or until it is deleted or replaced.
`csrftoken`	Protects forms and signed-in accounts against forged or unauthorised submissions.	Up to approximately one year.
Cloudflare Turnstile security storage	Helps distinguish genuine application submissions from automated abuse. Cloudflare may process device and network information and may place security storage when a challenge requires it.	For the security challenge or as otherwise required by Cloudflare to prevent abuse.
Market-plan interface storage	Uses session storage to remember scroll position and whether staff have collapsed attendance cards.	Until the relevant browser tab or browsing session is closed.
Competition interface storage	Uses session storage to restore the visitor’s position after viewing or updating an entry.	Until the relevant browser tab or browsing session is closed.

Our website analytics are processed on our own server and do not place or read an analytics cookie. We record page paths, broad referral sources, response performance and security events. For visitor counting and abuse prevention, an IP address is immediately transformed into a one-way daily identifier; the raw address is not stored in analytics. These temporary identifiers expire after eight days, while non-identifying aggregate totals may be retained to understand and improve the service.

You can delete or block cookies and website storage using your browser settings, although blocking essential storage may prevent login, forms and other requested features from working. We do not currently use advertising or behavioural-tracking cookies. If we introduce non-essential storage for which consent is required, we will ask for permission before using it and provide a way to change that choice.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, receive a portable copy, and object to processing.

Your right to object: you can object at any time to direct marketing. You can also object to processing based on our legitimate interests; we will stop unless we have compelling legitimate grounds or need the information for legal claims.

Where we rely on consent, you may withdraw it at any time. You may also complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first if you would like us to try to resolve your concern.

Changes to this policy

We may update this policy when our services or legal obligations change. The current version and revision date will remain available on this page.