Privacy

Last updated: 24 September 2026

Empty Chairs brings people together in public places so that fewer people have to feel alone. We also believe that people should be able to understand what happens to their personal information. This policy explains what information we may collect when you visit our website, apply to host, volunteer with us, contact us, donate, subscribe to updates or otherwise interact with Empty Chairs. It also explains why we use that information, who we may share it with and the choices and rights you have. You do not need to give Empty Chairs your personal information simply to come and sit at an Empty Chairs table. You do not need to register, create an account, provide contact details or explain why you are attending.

Empty Chairs is a UK non-profit organisation structured as a company limited by guarantee. We organise and support free community events in public venues such as pubs and cafés. For the purposes of UK data protection law, the organisation responsible for deciding how and why personal information is used is usually: Legal name: EMPTY CHAIRS LTD Company number: 17342703 Registered office: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX Privacy email: [email protected] In this policy, “Empty Chairs”, “we”, “us” and “our” refer to that organisation.

This policy applies when you: visit or use our website; look for an Empty Chairs event; apply to become a host or volunteer; host or help organise an event; contact us, give feedback or make a complaint; subscribe to news, local event notifications or other updates; make a donation through our website; buy merchandise, if and when this is available; work with us as a venue, partner, contractor or supplier; appear in or submit a photograph, video or other media; or are involved in an incident, complaint or safeguarding concern reported to us.

Attending an Empty Chairs event

Empty Chairs events are designed so that you can simply turn up. We do not ordinarily ask attendees to: register; give us their name; provide an email address or telephone number; create an account; explain why they came; or share personal details with the host. We may record the total number of people who attended an event, but this is an overall attendance figure rather than a named register. Ordinary conversations at an Empty Chairs table are not routinely recorded or reported to us. Exceptionally, information may be recorded if there is an incident, complaint or safeguarding concern. Section 14 explains this in more detail.

We only ask for personal information where we have a reason to use it. Depending on how you interact with us, this may include the following.

Information you give us directly

This may include your name, email address, telephone number, general location or postcode, social media details, and anything you choose to include in a form, email, message or other communication.

Host and volunteer information

If you apply to host or volunteer, we may collect: the information requested in the application form; your contact details and location; your availability and preferred event area; your application answers and relevant correspondence; records of onboarding, training or guidance provided; information about events you arrange or host; host check-ins, post-event reports and attendance totals; volunteer activity and communications; concerns, complaints or incidents connected with your role; your date of birth, where we need to confirm that a host is old enough to hold the role and to tell apart people with the same name; and an emergency contact, where you choose to give us one, so that we have somebody to call if something happens while you are hosting.

Event information

We maintain information needed to run and publicise events. This may include the venue, location, date, time, status and the host’s first name. This does not mean that we maintain a named register of attendees.

Local event notifications

If you ask to hear about events near you, we store your email address and the postcode you gave us, along with the approximate location we work out from that postcode - the district, region and parliamentary constituency. We do not store a full address, and a partial postcode such as RG14 is enough. We also keep a record of which events we have already told you about, so that we do not send you the same thing twice.

Messages and correspondence

If you contact us, we may keep your message and our response. This can include enquiries, feedback, complaints, partnership discussions, volunteer communications and information submitted through website forms or social media.

Donation and payment information

If you donate, we may receive information from Stripe connected with the transaction, such as your name, email address, donation amount, currency, date and time, payment status, transaction reference, refund information and limited payment-method information. The exact information available to us depends on how our Stripe account and donation form are configured. We do not receive or store your full card number. Card details are entered on Stripe’s own pages and never reach our website.

Website and device information

Our website and its service providers may collect technical information such as your IP address, browser or device type, pages viewed, referral source, cookie identifiers, approximate location and the dates and times you use the site. We do not keep our own web server logs, and our hosting provider does not retain request logs on our behalf by default.

Photographs, video and other media

We may receive or create photographs, video, audio, written stories or testimonials connected with Empty Chairs. These may identify the people shown or described.

Complaints, incidents and safeguarding information

We may occasionally need to record information about a complaint, incident, someone’s safety or wellbeing, or a concern raised with us. This could include information about physical or mental health, disability, religion, ethnicity, sexuality or other sensitive matters that a person has chosen to share. Some of this may be “special category” information under data protection law. A record may also contain information about alleged criminal behaviour, which is subject to additional legal rules. We do not routinely record personal conversations simply because they happen at an Empty Chairs event.

Information from other people or organisations

Sometimes somebody else may give us information about you, for example, a host reporting an incident, a person making a complaint, a partner introducing a contact, or a donor using your details when making a donation on your behalf. We will only use that information where we have a lawful reason to do so and will provide privacy information where required.

We may collect information: when you complete a website, host or volunteer form; when you email, message, telephone or write to us; when you apply, train or act as a host or volunteer; when an event is created, updated, cancelled or reported on; when you ask for local event notifications or other updates; when you donate through Stripe; when you provide feedback, raise a concern or make a complaint; when photographs, video, stories or testimonials are created or submitted; automatically through cookies, logs or similar website technologies, where used; and from another person or organisation where they have a proper reason to give us the information.

Depending on the circumstances, we may use personal information to: assess and respond to host or volunteer applications; onboard, support and communicate with hosts and volunteers; plan, list, administer and monitor Empty Chairs events; help people find an event in their area; send updates or local event notifications that someone has requested; answer enquiries and manage relationships with venues and partners; process donations, recurring donations and refunds; maintain financial, tax and accounting records; prevent fraud, misuse or security incidents; respond to feedback and complaints; manage incidents and safeguarding concerns; create and share agreed photographs, videos, stories or other media; operate, protect, understand and improve our website and activities; establish, exercise or defend legal claims; and comply with our legal and regulatory obligations. We will not use personal information for a new, incompatible purpose without a proper legal basis and, where required, giving you further information.

Data protection law requires us to have a lawful basis for each way we use personal information. More than one basis may apply to the same information in different circumstances. Responding to enquiries. Your contact details and what you wrote, so that we can answer you and keep track of the request. Basis: our legitimate interests in responding to people and running the organisation, or steps you have asked for before entering an agreement. Assessing host or volunteer applications. Your application answers, contact details and any correspondence, so that we can consider your application, talk to you about it and bring you on board. Basis: our legitimate interests in recruiting and supporting suitable volunteers. Supporting hosts and administering events. Host contact details, event information, activity and reports, so that events are safe and reliable. Basis: our legitimate interests in operating Empty Chairs and supporting volunteers. Publishing event listings. The venue, date, time, location and the host’s first name, so that people can find an event and know who to look for. Basis: our legitimate interests in publicising events. Sending local event alerts or email updates. Your name, email address, location preferences and subscription choices, so that we can send the messages you asked for. Basis: your consent, as required by PECR and UK data protection law. Processing donations and refunds. Donor, transaction and correspondence information, so that we can accept and administer a donation or refund. Basis: our legitimate interests in receiving and administering donations, and steps you have asked for as the donor. Keeping financial and accounting records. Donor and transaction records, so that we meet our tax, company and accounting duties. Basis: legal obligation, with legitimate interests covering related administration. Operating and protecting the website. Technical, device, log and security information, so that the site works, stays up and can be checked if it is misused. Basis: our legitimate interests in running a secure website. The services involved are Cloudflare (hosting, content delivery and security), GitLab (the site’s code and editing tools), Google Workspace (application forms and event records), Stripe (donations) and postcodes.io (turning a postcode into an area). None of them place non-essential storage on your device. Analytics. Cookie identifiers and usage data, so that we can understand how the site is used. Basis: your consent, as required by PECR and UK data protection law. We use Google Analytics 4 and nothing else, and we use no advertising, marketing or cross-site tracking technologies at all. Complaints. Identity, contact details and the records of a complaint and its investigation, so that we can look into it, reply and improve. Basis: legal obligation for the data-protection complaints process, and legitimate interests for other complaints and for our own accountability. Safeguarding and incident management. Incident details, contact information and sometimes sensitive information, so that we can assess a concern, respond to it and protect people. Basis: legitimate interests, or legal obligation where one applies. This one needs formal review before publication - see section 14. Photographs, video, testimonials and stories. Images, voices and stories, so that we can show and explain what Empty Chairs does. Basis: consent where somebody is identifiable and has been asked, and legitimate interests for general photography of a venue or a crowd. Adopt the media procedure in section 13 before publishing this. Managing venues, partners, suppliers and professional contacts. Business contact details and correspondence, so that we can run those working relationships. Basis: performance of a contract, and legitimate interests. Legal claims and regulatory compliance. Whichever records are relevant, so that we can meet a legal duty or protect our legal position. Basis: legal obligation, and legitimate interests. Where we rely on legitimate interests, those interests may include running Empty Chairs effectively, supporting volunteers, making events findable, keeping our services safe, responding to people and protecting our organisation. We consider whether the use is necessary and balance those interests against the person’s rights and reasonable expectations. If we process special category information, an Article 6 lawful basis is not enough: we must also identify an applicable Article 9 condition. If we process criminal-offence information, separate safeguards and conditions apply.

We use Stripe to facilitate donations and related payment transactions on our website. When you enter payment details, those details are handled by Stripe and other organisations involved in the payment system, such as your bank or card network. Depending on the payment flow, Empty Chairs may receive transaction information such as your name, email address, donation amount, date, payment status, transaction reference, refund details and limited information about the payment method. Stripe may act as a processor for some activities and as a controller for others. Stripe’s own use of personal information is explained in its Privacy Policy and Privacy Centre. We may use donation information to: process and acknowledge your donation; manage a recurring donation, where offered; issue a refund where appropriate; investigate failed, disputed or potentially fraudulent transactions; reconcile payments and maintain financial records; and respond to questions about a transaction. Making a donation does not automatically sign you up for marketing. We will only send unrelated marketing or general updates where the relevant rules allow us to and, where required, you have actively opted in.

We do not sell personal information. Where necessary and lawful, we may share information with: Stripe and other parties involved in processing a payment; website hosting, form, database, cloud storage, IT and security providers, which at the date of this policy are Cloudflare, GitLab and Google Workspace; Resend, which sends our event notification emails;; volunteers who need limited information to carry out their role; venues and event partners, but only where necessary; accountants, insurers, lawyers and other professional advisers; regulators, courts, law-enforcement bodies or public authorities where required or permitted by law; emergency services, safeguarding organisations or other appropriate bodies where disclosure is necessary and lawful to respond to a serious concern; and another organisation involved in a restructuring or transfer of Empty Chairs’ activities, subject to appropriate protections. Service providers acting on our behalf should only use personal information under our instructions and for agreed purposes, unless they have their own independent legal responsibilities.

Some suppliers may process personal information outside the United Kingdom. Stripe, Cloudflare, GitLab, Google and Resend are global services and may transfer personal information internationally, including to the United States, using applicable transfer mechanisms and safeguards Before using another provider that transfers personal information outside the UK, we check whether the destination is covered by UK adequacy regulations or whether another lawful safeguard is required, such as an approved international data transfer agreement or addendum. We also complete any required transfer risk assessment. You may contact us using the details in section 21 to ask for more information about relevant safeguards.

We keep personal information only for as long as it is needed for the purpose for which it was collected, including any legal, accounting, safeguarding, insurance or dispute-resolution requirements. We then securely delete or anonymise it where appropriate. Host and volunteer applications that were unsuccessful or withdrawn: 6 months from the decision, so that we can explain a decision and answer any questions about it. Records of an active host or volunteer: for as long as they hold the role, reviewed every 12 months to check we still need what we hold. Records of a former host or volunteer: 3 years after the role ends, for accountability, references, any dispute, and in case somebody would like to come back. Date of birth and emergency contact details: for as long as the person holds the role, then 12 months. These are only useful while somebody is actively hosting. Event records and attendance figures: 2 years for anything that identifies a person, such as the host’s first name or a venue contact. Anonymised totals and statistics are kept indefinitely, so that we can show what the campaign has done without keeping names attached to it. General enquiries and correspondence: 12 months after the matter is closed. Partnership, supplier and venue records: 6 years after the relationship ends, which matches the period in which a contract dispute could still arise. Data-protection complaints and rights requests: 3 years after the matter is closed, so that we can show how we handled it. Other complaints: 3 years after the matter is closed, or longer where insurance or legal proceedings require it. Safeguarding and incident records: 6 years after the case is closed, as a working figure pending formal review. Anything involving a child is kept for longer - see section 14. Donation and payment records: the current financial year plus 6 years, for payment administration, fraud prevention and reconciliation. Accounting and tax records: the current financial year plus 6 years, to meet our legal, tax and accounting obligations. Mailing-list and local-alert records: until you unsubscribe. If somebody has not opened anything for 24 months we ask whether they still want to hear from us. Records of which notifications we have sent you: kept for as long as you are subscribed, so that you are not told about the same table twice. Suppression records after you unsubscribe: kept indefinitely - your email address and a date, and nothing else. It is the only way to be certain we never add you back to something you have left. Consent records: for as long as we rely on the consent, plus 2 years, so that we can show what was agreed and when. Website logs and security records: we keep none of our own. Our hosting provider processes traffic data in order to deliver and protect the site, and does not retain request logs on our behalf by default. Cookies and analytics data: up to 2 years. That is how long the _ga cookies last on your device. Inside Google Analytics, user-level data is set to expire after 14 months. Photographs, video, stories and testimonials: potentially indefinitely, for as long as the material remains useful to Empty Chairs. We review retained material periodically, and where we rely on consent it is also subject to that consent being withdrawn. Stripe and other independent organisations set their own retention periods for information they control. Their privacy information explains those periods or the criteria they use.

Cookies and similar technologies are small files or tools that store or access information on a device. On this website: Strictly necessary storage remembers your cookie choice, remembers small interface settings such as which tab you last had open, and signs in the volunteers who edit the site. None of it can be switched off, because without it the site cannot do what you have asked it to. Analytics means Google Analytics 4, and nothing else. It counts visits and shows us which pages people read. It is never loaded until you accept it, and if you accept and later change your mind, we delete the cookies it set. We use no advertising, marketing or cross-site tracking technologies at all. You are asked when you first arrive, and you can change your answer at any time using the Cookie settings link at the bottom of any page. Our Cookies & Terms page explains this in full, including the names of the cookies involved.

We operate two mailing lists: local event notifications and donation updates. You can sign up on our events page to join local event notification and it exists for one purpose - to tell you when an Empty Chairs table is happening near you. Donation updates is avaliable to join after donating and those signed up receive updates on our work at Empty Chairs. If you sign up for email updates, local event notifications or other communications, we will use the information you provide to send the type of messages you requested. Signing up asks for your email address and a postcode, so that we can tell you about events near you rather than everywhere. Where consent is the lawful basis, you can withdraw it at any time. Marketing emails will include an unsubscribe option, and you may also contact us at [email protected]. Withdrawing consent does not affect processing that was lawful before withdrawal. We use the postcode to work out roughly where you are, and we email you when a table is listed within about 30 miles. If nothing new appears near you, you hear nothing. At most you will get one email a day, and usually far less often than that. Every email has a one-click unsubscribe link; using it stops the emails immediately without you needing to contact anyone. We keep a limited suppression record after you unsubscribe - your email address and the date, and nothing else - so that we do not accidentally add you back to the same communications. Attending an event, becoming a host, contacting us or donating does not automatically mean that you have agreed to receive unrelated marketing. We may still send necessary service messages, for example about a host application, an event you are organising, a donation or a response to your enquiry, where these are not marketing messages.

Empty Chairs may use photographs, video, audio, stories or testimonials to explain our work and help people recognise events. We are particularly careful where an individual is identifiable or where the material reveals sensitive information. We may keep this material for as long as it remains useful to Empty Chairs, including as a record of our work and history. This may mean that we retain it indefinitely. We review retained material periodically and will delete or anonymise it when we no longer have a reason to keep it. Where we rely on your consent to use a photograph, video, recording, story or testimonial, you can withdraw that consent at any time by emailing [email protected]. Withdrawing consent does not make any use before the withdrawal unlawful. Once we receive your request, we will stop using the material in new publications and take reasonable steps to remove it from the website, social-media accounts and other digital channels that Empty Chairs controls, unless we have another lawful reason or legal obligation to keep it. We may not be able to recall material that has already appeared in printed publications, independent press coverage, archived materials or copies downloaded, shared or republished by other people. We will explain what action we can take when responding to your request. Material published on social media may be copied or shared by other users beyond our control. The relevant social-media platform also processes information under its own privacy terms. When in attendance of an Empty Chairs event the host may ask to take a photo of the table for use on social media and wider publication, if you do not wish to be photographed all you need to do is tell the host and they will avoid taking your photo.

People sometimes contact Empty Chairs about difficult personal situations. Empty Chairs is not a counselling, medical, healthcare or crisis-support service, and ordinary conversations at an event are not routinely recorded. There may, however, be occasions when a host or team member needs to report and record a safeguarding concern, serious incident or complaint. We collect only the information needed to understand and respond to the concern, restrict access to people who need it, and keep it no longer than necessary. We cannot promise absolute confidentiality. Information may sometimes need to be shared where it is necessary and lawful - for example, with a safeguarding lead, emergency service, regulator, insurer or another appropriate organisation - to respond to a serious and immediate risk, protect a person, investigate a concern or comply with the law. Safeguarding records may include health information or other special category data. They may also include criminal-offence information. If you or someone else is in immediate danger, contact the emergency services. Empty Chairs should not be used as a substitute for emergency, medical or crisis support.

We use proportionate technical and organisational measures designed to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. Measures reflect the sensitivity of the information and the risks involved. These include limiting access to the people who need it, using established service providers rather than building our own systems, taking payments through Stripe so that card details never reach us, protecting the accounts that can edit the website, keeping systems updated, and having a process for dealing with incidents and data breaches. No method of transmission or storage is completely secure, and we cannot promise absolute security.

Depending on the circumstances, you may have the right to: be informed about how your personal information is used; ask for a copy of personal information we hold about you; ask us to correct inaccurate or incomplete information; ask us to delete information in certain circumstances; ask us to restrict how information is used in certain circumstances; object to certain uses, including direct marketing; receive certain information in a portable format where the right applies; withdraw consent at any time where we rely on consent; and ask for safeguards in relation to certain solely automated decisions. These rights do not all apply in every situation, and the law may allow or require us to retain or continue using information in some circumstances. We may need to ask for enough information to verify your identity before acting on a request. To exercise a right, contact [email protected]. We will respond within one month, and will tell you if we need longer because a request is complex. We will explain if a right does not apply or if an exemption is relevant.

We do not make decisions about people based solely on automated processing where those decisions produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.

If you have a concern about how we have used your personal information, please contact us first at [email protected]. We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it, keep you informed as appropriate and explain the outcome without undue delay. This complaints process is separate from the time limits that apply when you exercise a data protection right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. The ICO will usually expect you to have raised the issue with us first. Current information is available on the ICO’s data protection complaints page.

Our website may link to websites, platforms or services operated by other organisations. We do not control how those organisations use personal information. Please read their privacy information before giving them your details.

We may update this policy when our activities, suppliers or legal obligations change. The latest version will be published on our website and the “last updated” date will be changed. If a change materially affects how we use information, we will take reasonable steps to draw attention to it and seek fresh consent where the law requires this.

Questions, rights requests and data-protection complaints can be sent to: Empty Chairs Ltd Email: [email protected] Registered office: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX Company number: 17342703