Who is responsible
Wishes is the public-facing identity used for this website and event enquiries in Cornwall. The owner has intentionally chosen not to publish an individual legal/trader name or a residential, postal or geographic business/service address here. The legal/compliance publication exception remains unresolved and is not represented as satisfied.
Wishes decides why and how the information described here is used. For a privacy question or request, use the Contact page.
Information we collect
We use data minimisation. An enquiry may include your name, email, telephone number, event date, venue, postcode, access notes, event type, selected services, hire items and notes needed to provide the requested service.
The teepee form includes an optional prompt for special requests, allergies or dietary requirements. Do not provide medical or other sensitive information unless genuinely needed. The website does not ask for children's medical records or create a routine childcare register.
Security processing may include limited request and network metadata used to prevent spam, abuse and repeated automated submissions. Raw IP addresses are not used as customer contact records or stored as the abuse key; the enquiry protection code uses a server-side hash for rate limiting.
Why we use information and lawful bases
- to answer an enquiry, check availability and prepare a quotation;
- to arrange and manage a confirmed booking and deliver the service;
- to communicate about dates, venues, access, setup, collection or changes;
- to handle complaints, cancellations, disputes and reasonable business records;
- to protect the website against fraud, spam and abuse; and
- to comply with legal, insurance, accounting or regulatory obligations.
Enquiries are normally processed as steps requested before a contract. Confirmed bookings are normally processed to perform the contract. Legitimate interests may apply to security, fraud prevention, proportionate records and complaint handling, balanced against your rights. Legal obligations may apply to required records. There is no current marketing list or email/SMS marketing system.
Who we share information with
Wishes does not sell customer personal information. Information may be shared only where reasonably needed, including with:
- Google Firebase and Google Cloud services supporting hosting, Firestore, Authentication and Functions;
- Resend, when enabled, for transactional staff and customer communications;
- contractors, suppliers or venues involved in fulfilling an agreed booking;
- payment providers if online payment functionality is introduced;
- professional advisers, insurers or authorities where reasonably necessary or required.
Resend configuration, retention, sub-processors and data-processing terms must be reviewed before production notification is enabled. International transfer locations and sub-processors depend on the providers enabled for the deployment and are not asserted here as a fixed list. Applicable UK transfer safeguards will be reviewed before relying on an overseas arrangement. ImageKit delivers public marketing images and does not receive enquiry details in the current application.
If Google Analytics 4 is configured and you accept optional analytics, Google receives public page paths, page-view and engagement measurements, device and traffic-source categories, and fixed event names for enquiry interactions. The website does not send customer names, email addresses, telephone numbers, booking messages, query strings or full IP addresses as analytics event parameters. Google receives ordinary connection metadata when the browser contacts its service. The website disables advertising signals and ad personalisation. Analytics is not loaded before your choice, and the admin dashboard receives aggregated reports rather than visitor-level records. SeeGoogle's Privacy Policy for its processing information.
How long we keep information
Operational enquiry and booking records are designed to be retained for no longer than 12 months after the relevant hire, event, service, cancellation or final resolution. We may retain a limited record longer where needed for a genuine dispute, legal hold, insurance matter or legal/accounting obligation.
The application calculates a server-side retentionExpiry for resolved records; it is never accepted from a customer's browser. The scheduled purge routine is disabled by default, so expiry does not prove that current production records have been deleted. The owner must verify and explicitly enable it before relying on automated deletion. This remediation does not delete production data.
Children and safeguarding
The website does not require a child's name, date of birth or medical history to send a general enquiry. Any agreed wedding crèche operation will use only information genuinely required for safe delivery, with restricted access and separate safeguarding and regulatory review before the service is accepted.
Your rights
Subject to applicable law, you may ask for access, correction, deletion, restriction, objection, portability or an explanation of complaint handling. These rights are not absolute where Wishes has a lawful reason or obligation to retain information. We may ask for proportionate identity verification and normally respond within one calendar month, subject to lawful extensions.
Contact Wishes through the Contact page. You can complain to the Information Commissioner's Office.
Security
The application uses server-side validation, restricted Firestore access, rate limiting, duplicate protection, server-authoritative pricing and Firebase security controls. Private customer records are restricted to authorised administration workflows, and routine logs do not include full names, contact details, addresses or enquiry messages.
Changes
This policy may change when the website, services, providers or legal requirements change. The last-updated date at the top identifies the current version.