Customer services: We use your identity, contact, financial and payment, transaction, communications, and incident and safety information to manage our relationship with you. This includes sending service and transactional messages, handling cancellations, changes and refunds, and providing customer support.

We do this because it is necessary either:

• to perform our contract with you,
• or for our legitimate interests in administering the customer relationship and providing effective customer service and support before, during, and after the Festival (balanced against your rights and freedoms).

Site safety & security:

We use your identity, contact, transaction, incident and safety, and (where relevant) criminal offence data to investigate and deal with suspected ticket misuse, including suspected breaches of our ticket terms and conditions.

We do this because it is necessary for our legitimate interests in preventing and detecting ticket fraud, misuse and abuse, enforcing our ticket terms and conditions, and protecting other attendees from risks associated with unlawful access (balanced against your rights and freedoms).

Where we process criminal offence data for these purposes, we do so only where necessary:

• to prevent or detect unlawful acts, or
• to establish, exercise or defend legal claims.

On-site services:

We use your identity, contact, property, and communications information to provide attendee support services. This includes sharing event information, running property lock-up services, and helping with lost property.

We do this because it is necessary for our legitimate interests in providing effective support before, during and after the Festival, reuniting attendees with lost items, running secure property lock-up services, and responding efficiently to questions and queries (balanced against your rights and freedoms).

If you purchase a ticket through the general admission, local, or Sunday ticket sales we use your personal information for the purposes below, in addition to those described under the “All attendees” and “All ticketholder” sections.

Registration

As part of our ongoing efforts to prevent ticket touting and make sure tickets are available to genuine customers, you must create an account on our registration site (run by our service provider, See Tickets) before you can buy a ticket to the Festival.

We use your information as follows:

• Verify your email address and send registration links: we use your contact details to validate your email address and send you a unique link to start (or continue) the registration process.
• Create and manage your account: we use your identity and contact details to process your registration, create your account in our registration database, and to manage your account when you view, update or delete it.
• Verifying registration photos: When you upload or update a registration photo, we use the image to check that it meets our stated requirements and is not AI-generated. See, Verifying registration photos below for more information.
• Retrieve your registration details: if you ask to access your registration details, we use your identity and contact details to send you a unique access link.
• Service-related communications: we use your contact information to send you service-related emails, including notifying you when tickets go on sale.

We do this because it is necessary either:

• to perform our contract with you, or
• for our legitimate interests in ensuring fair access to tickets; preventing ticket touting, bulk purchasing and unauthorised resale; detecting and preventing fraud and fraudulent registrations; and sending essential service and transactional messages and event information (balanced against your rights and freedoms).

If your registration is rejected (for example because the photo submitted does not meet the stated requirements) we will use your contact information to notify you. Rejected registration data is kept for 30 days and then deleted.

Verifying registration photos:

When you upload or update a registration photo, we use the image to check that it meets our photo requirements and to assess whether it may have been made using AI. We carry out this check to help prevent fake accounts, ticket fraud, unauthorised ticket resale and unfair ticket buying.

We use our ticketing service provider See Tickets, and a specialist image-checking provider, Sightengine, to support this process. Before the photo is checked, file metadata is removed. Sightengine analyses the image and returns a ‘confidence score’ indicating the likelihood that the image was made or edited using AI. We record this score against your account. Sightengine deletes its copy of the image after completing the check.

We use the confidence score as a decision support tool. See Tickets personnel conduct a manual review of the submitted photograph together with the confidence score to determine whether the image meets out photo requirements. If your photo passes the verification check, it will be approved. If your photo does not pass the check, it will not be accepted and we will ask you to upload a different photo. Your registration or account update will not be completed until an acceptable photo has been provided.

The confidence score is not treated as definite proof that your photo was made or edited using AI or that your account is fraudulent. It is used to help determine whether the photo meets our account-integrity and fraud-prevention requirements. We do not use this check to identify you, verify your identity using biometrics, or compare your face against other people’s images.

If your photo is not accepted, we will explain this to you and you can upload an alternative photo.

We do this because it is necessary for our legitimate interests in preventing unauthorised ticket resale, stopping fake accounts, protecting the integrity of our registration system and helping to make ticket allocation fair.

Ticketing:

We use your identity, contact, financial and payment, transaction, and relationship information to check eligibility and the information provided in your registration, and to sell, issue and deliver ticket packages. We do this because it is necessary to perform our contract with you.

If you book accommodation or purchase a water bottle via our ticketing provider, See Tickets, your booking information will be shared with the accommodation provider or WaterAid respectively, solely to process your booking. Neither our accommodation providers nor WaterAid will use that information to contact you about anything other than your booking (though you may still hear from them if you have separate bookings or opted-in to their mailing lists independently).

Each year, we offer a small number of complimentary tickets to local villagers as a gesture of thanks for the community’s ongoing support and understanding. If you are a village ticketholder, we use your personal information for the purposes below, in addition to those described under the “All attendees” and “All ticketholder” sections.

Registration

As part of our ongoing efforts to prevent ticket touting, you must create an account on our registration site (run by our service provider, See Tickets) to be eligible for a ticket to the Festival.

We use your information as follows:

• Verify your email address and send registration links: we use your contact details to validate your email address and send you a unique link to start (or continue) the registration process.
• Create and manage your account: we use your identity and contact details to process your registration and create your account in our registration database, and to manage your account when you view, update or delete it.
• Verifying registration images: When you upload or update a registration photo, we use the image to check that it meets our stated requirements and is not AI-generated. See Verifying registration photos below.
• Retrieve your registration details: if you ask to access your registration details, we use your identity and contact details to send you a unique access link.
• Service-related communications: we use your contact information to send you service-related emails.

We do this because it is necessary either:

• to perform our contract with you, or
• for our legitimate interests in preventing ticket touting and unauthorised resale, detecting and preventing fraud and fraudulent registrations, and sending essential service and transactional messages and event information (balanced against your rights and freedoms).

If your registration is rejected (for example because the photo submitted does not meet the stated requirements) we will notify you of this fact. Rejected registration data is kept for 30 days and then deleted.

Verifying registration photos:

When you upload or update a registration photo, we use the image to check that it meets our photo requirements and to assess whether it may have been made using AI. We carry out this check to help prevent fake accounts, ticket fraud, unauthorised ticket resale and unfair ticket buying.

We use our ticketing service provider See Tickets, and a specialist image-checking provider, Sightengine, to support this process. Before the photo is checked, file metadata is removed. Sightengine analyses the image and returns a ‘confidence score’ indicating the likelihood that the image was made or edited using AI. We record this score against your account. Sightengine deletes its copy of the image after completing the check.

We use the confidence score as a decision support tool. See Tickets personnel conduct a manual review of the submitted photograph together with the confidence score to determine whether the image meets our photo requirements. If your photo passes the verification check, it will be approved. If your photo does not pass the check, it will not be accepted, and we will ask you to upload a different photo. Your registration or account update will not be completed until an acceptable photo has been provided.

The confidence score is not treated as definite proof that your photo was made or edited using AI or that your account is fraudulent. It is used to help determine whether the photo meets our account-integrity and fraud-prevention requirements. We do not use this check to identify you, verify your identity using biometrics, or compare your face against other people’s images.

If your photo is not accepted, we will explain this to you and yyou can upload a different photo.

We do this because it is necessary for our legitimate interests in preventing unauthorised ticket resale, stopping fake accounts, protecting the integrity of our registration system and helping to make ticket allocation fair.

Ticketing:

We use your information as follows:

• Notify you about eligibility: we use your identity and contact details to let you know if your household is eligible for complimentary tickets.
• Process requests and allocate tickets (or a payment in lieu of tickets if this is offered): if you submit a village ticket request, we use your identity, contact, relationship, and communications information to confirm eligibility, process your request, and allocate complimentary tickets (or payment in lieu, where offered).

We do this because it is necessary either:

• to perform our contract with you, or
• for our legitimate interests in maintaining positive community relationships and demonstrating our social responsibility and support for local residents (balanced against your rights and freedoms).

A limited number of hospitality ticket packages are available for media and music industry professionals to purchase directly from us, subject to an application process. If you are a hospitality ticketholder, we use your personal data for the purposes below, in addition those described under the “All attendees” and “All ticketholder” sections.

Ticketing:

We use your identity, contact, transaction, financial and payment, relationship, and communications information to process your application, confirm your eligibility, and sell, issue and deliver hospitality ticket packages. We do this because it is necessary to perform our contract with you.

Marketing:

We use identity, contact, marketing, communications, and supplier/partner information to market hospitality packages, in line with applicable direct marketing laws. We do this because it is necessary for our legitimate interests in promoting and selling hospitality packages and maintaining ongoing commercial relationships (balanced against your rights and freedoms).

Accreditation: We use your identity, contact, supplier/partner, and health and safety information to manage access to restricted areas. This includes issuing access credentials and checking authorisations to make sure only approved people can enter.

We do this because it is necessary for our legitimate interests in keeping access-controlled areas safe and secure, protecting assets, equipment, infrastructure and operational information, and meeting our health and safety duties, security expectations, licensing conditions, and insurance requirements (balanced against your rights and freedoms).

Site Safety and Security:

We may use your identity, contact, and relationship information to maintain emergency contact details, so we can respond quickly if there is a medical, safety or welfare incident.

We do this because it is necessary either:

• for our legitimate interests in emergency planning and incident response, including meeting health and safety expectations (balanced against your rights and freedoms), or
• to comply with a legal obligation, for example under health and safety legislation.

Event Delivery:

We may use your identity and vehicle information (including location data for the Worthy Shuttle and event control vehicles, where used) to coordinate operational transport for Accredited Personnel and respond quickly if issues arise.

We do this because it is necessary for our legitimate interests in coordinating transport, protecting people, vehicles, equipment and other assets, meeting operational and health and safety expectations, supporting drivers’ welfare, responding to breakdowns or incidents, and managing time-critical movements (balanced against your rights and freedoms).

Administration:

We may use your identity, contact, and communications information to ask for post-Festival feedback so we can improve future editions.

We do this because it is necessary for our legitimate interests in understanding satisfaction, identifying issues and opportunities to improve event design and delivery, and supporting effective planning for future Festivals (balanced against your rights and freedoms).

Compliance and risk-management:

We use identity, contact, supplier/partner and health and safety information to meet our regulatory and risk-management responsibilities when working with third parties (including due diligence such as credit checks).

We do this because it is necessary either:

• for our legitimate interests in managing legal, financial, operational and reputational risks, and demonstrating compliance with applicable regulatory, governance and contractual requirements (balanced against your rights and freedoms), or
• to comply with a legal obligation to which we are subject.

If you’re an artist or performer (or a representative of an artist or performer), we will use your personal information for the following purposes in addition to those listed under the ‘All attendees’ and “All accredited personnel” sections:

Administration:

We use identity, contact, financial and payment, transaction, performer, supplier/partner, and dietary/catering information to identify and contact artists and performers (and their representatives), enter into contracts with them, and manage the relationship.

We do this because it is necessary:

• to perform our contract with you;
• to comply with a legal obligation to which we are subject (such as verifying your right to work in the UK); or
• for our legitimate interests in identifying, approaching and selecting suitable artists/performers (and their representatives), and managing our relationship (balanced against your rights and freedoms).

Event information:

We use identity, performer, event media, and public profile information (if you have a public profile) to publish accurate Festival line-up details.

We do this because it is necessary for our legitimate interests in promoting the Festival and helping attendees plan their Festival schedule (balanced against your rights and freedoms).

Recording, broadcast, promotion and archiving of performances:

Where you perform at the Festival, we may use your identity information, performer information and event media, including photographs, audio recordings and video footage of your performance, to record, broadcast, stream, promote, document and otherwise preserve the Festival.

This may include live broadcast, on-demand availability, highlights, clips, promotional content, social media posts, website content, press and media materials, documentary or editorial content, and archival material. It may also include sharing relevant recordings and related information with our broadcast and production partners, and other third parties involved in recording, distributing, promoting or preserving Festival content.

We do this where necessary to perform our contract with you, and because it is necessary for our legitimate interests in documenting, promoting, broadcasting and preserving the Festival and its performances, maintaining an accurate cultural record of the Festival and making content available to audiences who cannot attend in person (and we have balanced these interests against your rights and freedoms).

Where specific uses of recordings or performance material are governed by your artist agreement or other contractual arrangements, those arrangements will also apply.

Our broadcast partner, the BBC, will also process recordings of your performance as an independent controller for its own broadcast, editorial, archive and distribution purposes. For more information about how the BBC uses personal information, please see the privacy information published by the BBC.

Data sharing:

Personal information you (or your representatives) provide during the artist and crew advancing process will be shared with relevant third-party area organisers and production partners (including freelance contractors) responsible for the area where you’re scheduled to perform, so that they can plan for and deliver your performance. For example, if you’re booked to perform on the West Holts Stage, we will share relevant information with the West Holts area organiser. We share only the information necessary for operational planning and delivery.

We share Festival line-up information with selected third parties, such as our media partners (BBC and The Guardian), so they can publish line-up details on their platforms. This typically includes the artist/act name and relevant performance details (such as stage and time) and may also include approved promotional materials.

If you would like your line-up information to be corrected or updated, you can request rectification as described in the “Your rights” section below. If you ask for removal, we’ll consider the request in line with data protection law, taking into account the purpose of the listings and any operational or contractual requirements.

If you’re a crew member engaged by a third-party company (i.e., not GFL or GFEL) to work at an area of the Festival, we will use your personal data for the following purposes in addition to those listed under the ‘All attendees’ and “All accredited personnel” sections:

Administration:

We use identity, contact, supplier/partner, health and safety, and medical and welfare information to manage third-party crew members safely and lawfully. This includes conducting risk management and ensuring that individuals have completed required health and safety induction training.

We do this because it is necessary:

• for our legitimate interests in meeting health and safety expectations and industry standards, and managing the operational and safety risks (balanced against your rights and freedoms);
• to comply with a legal obligation to which we are subject (for example, under health and safety legislation). Where special category data is used, we consider this is necessary to meet health and safety reporting obligations to which we are subject, or
• to establish, exercise or defend our legal rights.

Site Safety and Security:

If you work in a safety-critical role on the Festival site, we may use your identity, supplier/partner, and fitness-for-duty information to carry out routine and ad hoc breathalyser testing. Depending on the role being performed, if a breathalyser test is negative but the operative conducting the test forms a view that the individual may be under the influence of something other than alcohol, a drug swab test may be requested. This helps us confirm you’re fit to work safely and reduces the risk of incidents linked to impairment.

We do this where necessary to comply with a legal obligation to which we are subject, or otherwise because it is necessary for our legitimate interests in protecting the life, health and safety of individuals on or around the site; meeting our health and safety duties; and preventing safety incidents linked to impairment (balanced against your rights and freedoms).

Where breathalyser or drug testing involves special category (health) data (for example, test results or fitness-for-duty status), we process it only where necessary and in line with data protection law, including where necessary for reasons of substantial public interest due to the significant risk of serious harm if individuals in safety-critical roles are impaired.

If you use a vehicle on the Festival site, we use your identity, supplier/partner, driver and vehicle information to authorise, verify and monitor vehicle use for safety purposes. For example, we may verify your driving licence information, record vehicle registration numbers, confirm that a vehicle has a legitimate operational reason to be on site, and investigate incidents or deal with unsafe vehicle use.

We do this where necessary:

• to comply with a legal obligation to which we are subject, or
• because it is necessary for our legitimate interests in protecting the safety of people on site, protecting assets, infrastructure and equipment from damage, and managing and controlling vehicle movements and operations (balanced against your rights and freedoms).

If you volunteer at the Festival, we use your personal data for the following purposes in addition to those listed under the ‘All attendees’ and “All accredited personnel” sections:

Administration:

We use identity, contact, volunteer role information, health and safety, and communications information to recruit volunteers, coordinate and manage volunteer roles, and respond to enquiries.

We do this because it is necessary either:

• to perform our contract with you (including applying volunteering terms and conditions); or
• for our legitimate interests in recruiting and coordinating volunteers, responding to enquiries, maintaining an engaged pool, and ensuring volunteers can carry out their roles safely and effectively (balanced against your rights and freedoms).

Site Safety and Security:

If you carry out a safety-critical role as a volunteer (for example, if your role requires you to drive a vehicle on the Festival site), we use your identity and fitness for duty information to carry out routine and ad hoc breathalyser testing. Depending on the role being performed, if a breathalyser test is negative but the operative conducting the test forms a view that the individual may be under the influence of something other than alcohol, a drug swab test may be requested. This helps us confirm you’re fit to volunteer safely and reduces the risk of incidents linked to impairment.

We do this where necessary to comply with a legal obligation to which we are subject, or otherwise because it is necessary for our legitimate interests in protecting the life, health and safety of individuals on or around the site; meeting our health and safety duties; and preventing safety incidents linked to impairment (balanced against your rights and freedoms). Where this involves processing special category (health) data (for example, breathalyser or drug test results or fitness-for-duty status), we process it only where necessary and in line with data protection law, including where this is necessary for reasons of substantial public interest due to the significant risk of serious harm if individuals in safety-critical roles are impaired.

If you use a vehicle on the Festival site as part of your volunteer role, we use your identity, driver, and vehicle information to authorise, verify and monitor vehicle use for safety purposes. For example, we may verify your driving licence information, record vehicle registration numbers, confirm that a vehicle has a legitimate operational reason to be on site, and investigate incidents or deal with unsafe vehicle use.

We do this where necessary to comply with a legal obligation to which we are subject, or otherwise because it is necessary for our legitimate interests in protecting the safety of people on site, protecting assets, infrastructure and equipment from damage, and managing and controlling vehicle movements and operations (balanced against your rights and freedoms).

Data sharing:

Personal information you (or your volunteer organisation) provide as part of the volunteer onboarding and advancing process may be shared with relevant third-party area organisers, suppliers and service providers (including freelance contractors) who are responsible for the area you’re assigned to support, so they can plan for and manage your role at the Festival. For example, if you’re assigned to volunteer at the West Holts stage, we will share relevant information with the West Holts area organiser. We share only what is necessary for operational planning, coordination and safety.

If you’re a trader at the Festival (or work for one), we use your personal data for the following purposes in addition to those listed under the ‘All attendees’ and “All accredited personnel” sections:

Administration:

We use identity, contact, supplier/partner, health and safety, financial and payment, and transaction information to select traders, enter into contracts, and manage our relationship. This includes receiving and reviewing trader applications, notifying outcomes, and ongoing relationship administration.

We do this because it is necessary either:

• to perform our contract with you;
• to comply with a legal obligation to which we are subject; or
• for our legitimate interests in selecting suitable traders for the Festival, managing relationships, and protecting the integrity and smooth running of the Festival by working only with appropriate and reliable traders (balanced against your rights and freedoms).

Administration:

We use identity, contact, supplier/partner, and communications information to maintain business contact records and manage relationships.

We do this because it is necessary either:

• to perform our contract with you; or
• for our legitimate interests in keeping our records up to date (including key contact persons), managing day-to-day relationships, and supporting efficient business administration (balanced against your rights and freedoms).

Compliance and risk-management:

We use identity, contact, supplier/partner and health and safety information to meet our regulatory and risk-management responsibilities when working with third parties. This includes conducting appropriate due diligence (for example, credit checks and checks on data protection, information security, and health and safety).

We do this because it is necessary either:

• for our legitimate interests in managing legal, financial, operational and reputational risks, and demonstrating compliance with applicable regulatory, governance and contractual requirements (balanced against your rights and freedoms); or
• to comply with a legal obligation to which we are subject.

If you need access to the Festival site to provide the services you have been engaged for, or if Festival tickets form part of your agreement with us, we will use your personal data for the purposes stated below, in addition to those listed under the ‘All attendees’ and “All supplier and partners” sections.

Accreditation:

We use your identity, contact, supplier/partner, and health and safety information to issue and manage restricted area access credentials and check authorisations.

We do this because it is necessary for our legitimate interests in keeping access-controlled areas safe and secure, protecting equipment, infrastructure and operational information, and meeting our health and safety duties, security expectations, licensing conditions, and insurance requirements (balanced against your rights and freedoms).

Ticketing:

Where tickets form part of your agreement with us, we use your identity, contact, supplier/partner, communications, financial and payment, and transaction information to allocate and fulfil ticket packages. We do this because it is necessary to perform our contract with you.

Site safety and security:

If you work in a safety-critical role on the Festival site, we may use your identity, supplier/partner, and fitness-for-duty information to carry out routine and ad hoc breathalyser testing. Depending on the role being performed, if a breathalyser test is negative but the operative conducting the test forms a view that the individual may be under the influence of something other than alcohol, a drug swab test may be requested. This helps us confirm you’re fit to work safely and reduces the risk of incidents linked to impairment.

We do this where necessary to comply with a legal obligation to which we are subject, or otherwise because it is necessary for our legitimate interests in protecting the life, health and safety of individuals on or around the site; meeting our health and safety duties; and preventing safety incidents linked to impairment (balanced against your rights and freedoms). Where testing involves processing special category (health) data (for example, breathalyser or drug test results or fitness-for-duty status), we process it only where necessary and in line with data protection law, including where this is necessary for reasons of substantial public interest due to the significant risk of serious harm if individuals in safety-critical roles are impaired.

If you use a vehicle on the Festival site, we will use your identity, supplier/partner, and vehicle information to authorise, verify and monitor vehicle use for safety purposes. For example, we may record vehicle registration numbers, confirm that a vehicle has a legitimate operational reason to be on site, and investigate incidents or deal with unsafe vehicle use.

We do this where necessary to comply with a legal obligation to which we are subject, or otherwise because it is necessary for our legitimate interests in protecting the safety of people on site, protecting assets, infrastructure and equipment from damage, and managing and controlling vehicle movements and operations (balanced against your rights and freedoms).

When you visit our Website, we use your technical and usage information to operate, maintain and improve the site, and to understand how it is used (including site performance and security). If you complete a form on our Website, we use your contact and communications information to respond to your enquiry and manage our correspondence with you.

We do this because it is necessary for our legitimate interests in administering the Website so users can access information about the Festival; monitoring and improving usability, content relevance, performance, security and error handling; and responding to and managing enquiries from Website users (balanced against your rights and freedoms).

If you sign up for the Festival newsletter (either via the Website or during ticket registration) we use your contact details and marketing preferences (including your subscription status) to send you communications about the Festival.

We do this on the basis of your consent. You can opt-out at any time via the opt-out link in any marketing message or by contacting the Festival’s Data Protection Officer (see ‘How to contact us’).

Opting out of marketing does not opt you out of important service communications (for example, about your registration account or tickets).

If you download and use the Glastonbury App, developed and delivered by Vodafone (hereafter “the App”), Vodafone or its third-party service providers may collect information through the App to improve functionality. When you consent to the App’s use of location services, or otherwise depending on the settings on your mobile device, Vodafone or third-party service providers may collect the location information provided by your device, including data provided by your GPS (hereafter “Location Data”), to facilitate location-based push notification messaging via the App. Location Data may be collected when you’re using the App and, in the background, if your device settings permit. Vodafone or it’s third-party service providers may share limited information (e.g., which acts have been favourited) collected through the App with us in order to aid in the safe delivery of this year’s event and to assist planning of future events. For more information about how Vodafone will process personal data collected through the App, please see their privacy notice at www.vodafone.co.uk/privacy.

We use social media channels (including Facebook, X, and Instagram, the “Social Media Companies”) to publish information on the Festival. We do this because it is necessary for our legitimate interests in promoting the event and showcasing the Festival experience to audiences. If you follow or otherwise engage with our social media channels, we will collect usage information to analyse how users interact with those channels. We do this because it is necessary for our legitimate interests in monitoring and improving content. If you use social media to send us messages or posts, we may use your profile information to communicate with you. We do this because it is necessary for our legitimate interests in managing and responding to enquiries from social media users.

When you interact with our channels, the Social Media Companies also process your personal data as Joint Controllers. For more information we would encourage you to review their privacy notices.

If you enter the Emerging Talent Competition, we use identity, contact, communications, performer and event media information to run the competition. This includes reviewing entries, shortlisting, judging, selecting winners and notifying you of the outcome.

We do this because it is necessary either:

• to perform our contract with you; or
• for our legitimate interests in discovering and promoting new talent and administering the competition fairly and transparently (balanced against your rights and freedoms).

We will share submissions with a panel of music industry professionals to help create a longlist, then share longlisted submissions with a judging panel (made up of Festival personnel and music industry professionals) to select a shortlist of acts for a live final.

If you’re selected to perform at the Festival, you should also read the “All attendees” and “Accredited personnel” sections.

If you apply to the Glastonbury Arts Commission (“GAC”), we use your personal data to process and assess applications, communicate with you, and decide whether to progress you to the next stage or offer a commission.

We use your information for the following purposes:

• Managing your application and communicating with you: we use your identity and contact information to send application updates, request further information, and notify you of outcomes.
• Assessing your suitability: we use the information you submit with your application (which may include identity, contact and performer information) to review and assess your application and decide whether to invite you to the next stage.
• Background and due diligence checks: we may use information from public sources and information obtained through background searches and checks, including checks carried out by us or by third parties we engage (and, where appropriate, relevant authorities), to help us assess suitability and manage risk.
• Reviewing audio/visual material: we may use audio and/or visual recordings (for example, recordings you submit, recordings made by us, or recordings you make publicly available online) to help assess your application.
• Right to work checks: where required, we may ask for evidence of your right to work in the UK and use this information to confirm you’re legally entitled to work in the UK without restriction.

We do this because it is necessary:

• to perform our contract with you (for example, to administer your application and communicate with you about it);
• for our legitimate interests in discovering and promoting new talent, administering the GAC fairly and effectively, and protecting the Festival by carrying out proportionate checks and reviewing relevant materials (balanced against your rights and freedoms); and
• to comply with a legal obligation (for example, where we are required to verify your right to work in the UK).

If you have applied to the GAC, we may share deidentified applicant data with Arts Council England (which provides funding to the Glastonbury Arts Commission) which they will use for monitoring purposes only.

If you’re selected for a commission, you should also read the “All attendees” and “Accredited personnel” sections.

Planning and delivering a globally renowned festival involves working with a range of stakeholders, including responsible authorities and the emergency services. Where needed, we use identity, contact, and communications information relating to responsible authority and emergency services personnel to coordinate with them and to meet our legal and operational obligations.

We do this because it is necessary either:

• to comply with a legal obligation to which we are subject, or
• for our legitimate interests in planning and delivering the Festival safely and lawfully in coordination with relevant public authorities; complying with licensing conditions and other public safety, crime-prevention, health and safety, and regulatory requirements that apply to large-scale events; and managing operational risks through appropriate liaison and information sharing (balanced against your rights and freedoms).

We use CCTV cameras in locations outside the Festival site to manage access and exit and support public safety on routes to and from the Festival. We process CCTV footage and, where relevant, incident and safety information and criminal offence data relating to individuals who are within the field of view of these cameras.

We do this because it is necessary either:

• to comply with a legal obligation to which we are subject, or
• for our legitimate interests in keeping people safe on approaches to and from the Festival; managing traffic and pedestrian flows; enabling swift incident response and emergency access; and meeting health and safety expectations (balanced against your rights and freedoms).

Before, during and after the Festival, some roads and routes around the site may be temporarily closed or subject to access restrictions for safety purposes. If you need access (for example because you live or work locally, or have another legitimate reason), you can apply for a vehicle permit. We use your identity, contact, and vehicle information together with relevant information about your connection to the local area to process permit applications, assess and confirm eligibility, notify you of the outcome, issue permits, and manage access to affected roads.

We communicate with local residents, landowners and businesses about the Festival and its impact on the surrounding area. This includes receiving and responding to enquiries or complaints made through the Village Hotline or the Village Liaison team and coordinating practical action where appropriate. We use your identity and contact information, the content of your communications and, where relevant, information about incidents, safety matters, property or belongings to understand and respond to the matter, coordinate any necessary action and maintain an appropriate record.

If you contact us with another general enquiry, correspondence or telephone call, we use your identity and contact information, the content of the communication, call notes and any relevant information about your relationship with another person or organisation to receive and respond to the matter and maintain an appropriate record of how it was handled. If the matter needs to be dealt with under another process, for example ticketing, accessibility, safeguarding, incident management, complaints or legal claims, we will handle the relevant information in accordance with that process.

We use your personal information for these purposes because it is necessary for our legitimate interests in administering local permits and access arrangements; managing traffic, access and public safety; understanding and managing the Festival’s impact on the local community; maintaining constructive relationships with local residents and businesses; responding effectively to enquiries and concerns; and keeping appropriate records of our communications and actions (balanced against your rights and freedoms).

Where necessary, we may share relevant information with traffic management or security contractors, noise consultants, or our professional advisers and insurers, for example, where a matter develops into a dispute or claim.

We use generally accepted technology and operational security standards to prevent personal information from being accidentally lost, used, or accessed in an unauthorised or unlawful way. Access is limited to those with a genuine business need to know. Anyone processing your information must do so only in an authorised way and is bound by confidentiality.

We also have procedures in place to deal with any suspected data security breaches and will notify you promptly if a breach might expose you to serious risk.

Some third parties we share data with may be outside the UK (for example, some service providers are based in the United States, which involves a transfer of personal information to the USA). Whenever we transfer personal information outside the UK, we ensure that a similar level of protection is afforded to it through appropriate safeguards. This may include, where appropriate, reliance on an adequacy decision or the use of an International Data Transfer Agreement or Standard Contractual Clauses.