Privacy and cookies
Privacy notice
Who we are. Plan a Weekend (planaweekend.co.uk) is a trading name of James Myddelton, sole trader. We are the controller of the personal data described on this page. Contact us at [email protected]; our postal address is under Who we are and how to contact us at the end of this notice.
This notice explains what personal data we collect when you browse the site, create an account, and use favourites, the map and ticket links.
What we collect
| When | Data | Why | Legal basis (UK GDPR) |
|---|---|---|---|
| You create an account | Email address; password (stored only as a salted hash, never in plain text) | To create and secure your account, and to let you log in | Contract |
| You confirm your email | Confirmation token (short-lived, one use) | To check the address belongs to you before you can log in | Contract |
| You ask to reset your password | Email address; reset token (short-lived, one use) | To let you choose a new password | Contract |
| You save favourites while logged in | The events, shows and places you save, linked to your account | To keep your list | Contract |
| You make weekend plans (My plans) | Plan names, days and the events, shows and places you add: kept only in your browser; never sent to us or linked to an account | To keep your plans on that device | Not personal data we hold (see Cookies) |
| You save favourites without an account | Kept only in your browser; not sent to us | To keep your list on that device | Not personal data we hold (see Cookies) |
| Our servers handle any request | IP address, time, page requested, browser type | Security, keeping the site running, fixing faults | Legitimate interests |
| You browse the site | A pseudonymous visitor record: a one-way hash of your IP address and browser, the country Cloudflare reports, the page path and the time. The IP address itself is not stored and no cookie is set | To show the site owner how many people are using the site and which pages are popular (the admin-only Who's online page) | Legitimate interests |
| You click a ticket link | The click is recorded for affiliate commission. We store a click record without your name, and Awin and See Tickets record the sale | To attribute commission | Consent for cookies (see Cookies); legitimate interests for the click count |
| You search by postcode | The postcode you type is sent from our server (not from your browser) to postcodes.io, a free service using open data, to find where it is. We keep the postcode and its location for up to 90 days so we do not have to ask again; nothing links it to you. Only a location rounded to about 1 km appears in the page address. Your browser tab also remembers the postcode you typed (session storage, on your device only, never sent to us) so the box stays filled while you browse; it is cleared when you close the tab | To list places near that postcode | Consent (you choose to type it) |
| You use "Near me" | Your approximate position (rounded to about 1 km), shared by your browser only after you allow it. It is part of the page address, so it appears in our server logs; it is not saved anywhere else | To list places near you | Consent (you press the button and allow location) |
| You view the map | Your IP address and the area you view are sent to the map tile provider | To show the map tiles | Legitimate interests |
| We send account emails | Your address and the email content, sent through Amazon Web Services (SES) | To deliver confirmation and reset emails | Contract |
| An email to you bounces, or you report it as spam | Your email address, the reason (bounce or complaint) and the date | So we do not email that address again, which protects your inbox and our ability to send email | Legitimate interests |
We do not sell your personal data and we do not use it to build advertising profiles.
Who we share it with
- Amazon Web Services (SES) sends account emails, from its London region (eu-west-2). AWS acts on our instructions.
- Cloudflare runs our network and security, so it sees your IP address and requests.
- Awin and See Tickets receive data from ticket clicks for commission. Under their programme terms, Awin, See Tickets and we are joint controllers for personal data collected through affiliate tracking. Their own privacy notices apply to what they do with it.
- postcodes.io receives a postcode only when you search by postcode (from our server, with nothing about you attached).
- OpenStreetMap tile servers receive your IP address and the map area you view, when the map is shown.
- Our web hosting provider hosts the site and its database.
Cloudflare and Amazon may process information outside the UK, including in the United States. Where they do, they rely on approved safeguards such as the UK International Data Transfer Addendum or the UK-US data bridge. We do not sell your personal information.
How long we keep it
- Account details: deleted straight away when you delete your account. Copies in our backups are removed as the backups expire, after up to 14 days. The one exception is an address on the do-not-email list (below).
- Do-not-email list: an address that bounces or is reported as spam is kept so we do not email it again. It stays when an account is deleted. Write to [email protected] to have it removed.
- Unconfirmed accounts: deleted 7 days after sign-up.
- Email links: confirmation links last 24 hours and reset links 1 hour. Used or expired links are removed after 7 days.
- Server logs: 30 days.
- Who's online visitor records: 30 days. The 10-minute counts used for the graphs are kept for 400 days and hold no per-person identifier.
- Affiliate click records: 90 days.
Your rights
You can ask us to access, correct or delete your data, to restrict or object to processing, and to receive a copy of your data. We answer within one month and do not charge for it.
- Get a copy: sign in and use "Download my data" on your account page, which gives you a file with your email, your saved favourites and the dates.
- Correct, restrict or object: write to [email protected] from the address on your account, saying what you want changed.
- Delete: use "Delete my account" on your account page, or write to us.
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Children
The site is not aimed at children under 13 and we do not knowingly create accounts for them.
Changes
We will update this notice when we change what we collect. The date at the foot of this page shows the last change.
Last updated: 27 October 2026
Cookies and similar storage
We use the cookies and browser storage below. Nothing else is set. We do not use advertising cookies or third-party analytics. Our first-party who's-online count is a plain request, not a cookie, and it does not identify you. If we add any cookies, this list and the cookie banner change first.
| Name | Where it lives | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|---|
Account session (paw_account) | Cookie (httpOnly, Secure, SameSite) | Us | Keeps you logged in | Strictly necessary | 14 days, or until you log out |
Admin session (paw_admin) | Cookie (httpOnly, Secure, SameSite Strict, admin area only) | Us | Owner sign-in to the admin area | Strictly necessary | 8 hours |
Favourites before login (paw-favourites) | Browser storage | Us | Your saved list on this device, until you create an account or log out | Functional | Until you clear it or log out |
| Colour theme and dark mode | Browser storage | Us | Remembers your theme | Functional | Until you change it |
Affiliate tracking (Awin): aw7816, bId | Cookies on awin1.com, set when you click a ticket link | Awin | Commission tracking: aw7816 records which event the click came from, bId recognises the browser | Non-essential (marketing) | aw7816 1 day; bId up to 1 year |
Tracking only happens if you accept: until then, ticket links go straight to the seller with no affiliate tag and no Awin cookie. You can change your choice at any time from the Cookie settings link in the footer, which brings the banner back.
Complaints and questions
For any question about your data, email [email protected]. If you are not happy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.
Who we are and how to contact us
Plan a Weekend (planaweekend.co.uk) is a trading name of James Myddelton, sole trader, 3 Falldor Way, Ampthill, Bedfordshire, MK45 2GD. Email: [email protected]. James Myddelton is the controller of the personal data described in this notice.