PRIVACY POLICY

LAST UPDATED 5 OCTOBER 2026

  1. 1. WHO WE ARE

    Powercut runs student club nights at the University of Surrey and the University of Reading and operates the website at powercutldn.co.uk. Powercut is the "controller" of the personal data described in this policy, which means we decide how and why it is used. You can contact us about anything in this policy on Instagram at @POWERCUTEVENTS.

    This policy explains what we collect, why, who we share it with, how long we keep it and the rights you have over it. It applies to the website, your Powercut account, our text messages and our events.

  2. 2. WHAT WE COLLECT

    When you create an account: your first and last name, your university, and your UK mobile number, which we verify with a one-time code. Optionally, if you give them to us: your university registration number (URN), email address and Instagram handle.

    When you use the site: the songs you request and vote for and which event they are for; your referral code and how many people have signed up with it; guestlist entries; confessions you send us (these are anonymous and are not linked to your account).

    When you attend an event: photographs and video taken at the event, which may include you.

    Technical data when you use the website: IP address, browser and device type, pages visited and timestamps, collected through standard server logs. If we add analytics tooling we will update this section before it goes live.

    We do not collect payment details. Tickets are bought through third party ticketing platforms, which have their own privacy policies.

  3. 3. HOW WE USE IT AND OUR LAWFUL BASIS

    UK data protection law requires us to have a lawful basis for each use of your data. Ours are set out below.

    • To create and run your account, verify your number, count referrals, and run song requests and guestlists: this is necessary to provide the service you have asked for (performance of a contract).
    • To text you about upcoming events, ticket links, private events and Powercut news ("exclusive access"): your consent, given when you sign up. You can withdraw it at any time (see section 7).
    • To send you one-time verification codes and messages about something you have requested, such as a guestlist confirmation: performance of a contract.
    • To show you Powercut adverts on social media platforms and to find people similar to our existing audience: our legitimate interest in promoting our events. To do this we may upload your mobile number to advertising platforms such as Meta (Instagram and Facebook) and TikTok in hashed form so they can match it to an account on their platform. You can object to this at any time (see section 7) and we will remove you from those audiences.
    • To understand our audience and plan events, for example which universities, songs and artists are popular and how many people engage with each night: our legitimate interest in running better events. Where we can, we do this with aggregated or anonymised data.
    • To publish event photography and video: our legitimate interest in documenting and promoting our events.
    • To keep the site secure, prevent fake accounts and detect manipulation of song requests, referrals or competitions: our legitimate interest in running the service fairly.
    • To comply with legal obligations, for example responding to a lawful request from a regulator or law enforcement.

    We do not make decisions about you using solely automated means that have a legal or similarly significant effect on you.

  4. 4. WHO WE SHARE IT WITH

    We do not sell your personal data. We share it only with the service providers we need to run Powercut, and only as much as they need:

    • Twilio, which sends our verification codes and text messages.
    • Amazon Web Services, Heroku and Vercel, which host our database, media and website.
    • Advertising platforms (Meta and TikTok), which receive hashed mobile numbers for audience matching as described in section 3.
    • Spotify, whose catalogue powers song search. Your personal data is not sent to Spotify; only the search term is.
    • Venues, promoters and ticketing partners, where necessary to run a specific event (for example a guestlist of names for the door).
    • Professional advisers, and public authorities where we are legally required to.

    Each of these providers is contractually required to protect your data and to use it only on our instructions, except where they are independent controllers under their own privacy policies (for example an ad platform once a match has been made).

  5. 5. WHERE IT IS STORED

    Our database is hosted in the European Union and our media and website infrastructure runs on providers that may process data in the United States. Where data leaves the UK we rely on the UK International Data Transfer Agreement or Addendum, or on the provider being covered by the UK Extension to the EU-US Data Privacy Framework, so that it receives a comparable level of protection.

  6. 6. HOW LONG WE KEEP IT

    Account data is kept for as long as you have an account. If you ask us to delete your account we remove your name, number and other identifying details within 30 days, and any song requests or votes you made are kept in anonymised form only.

    Unverified sign-ups that never complete phone verification are deleted after 12 months.

    Event photography and video is kept indefinitely as part of our archive, but you can ask for a specific image of yourself to be removed (see section 7).

    Confessions are anonymous and are not linked to any account.

  7. 7. YOUR RIGHTS AND HOW TO OPT OUT

    To stop receiving marketing texts: visit powercutldn.co.uk/opt-out and enter your number. You will still receive verification codes and messages about things you have asked for. Opting out takes effect immediately.

    Under UK data protection law you also have the right to:

    • ask for a copy of the personal data we hold about you (access);
    • ask us to correct inaccurate data (rectification);
    • ask us to delete your data (erasure), subject to any legal reason we must keep it;
    • object to our use of your data where we rely on legitimate interests, including for advertising audiences and analysis;
    • ask us to restrict how we use your data in certain circumstances;
    • ask for your data in a portable, machine-readable format;
    • withdraw consent at any time where consent is our lawful basis, without affecting what was done before you withdrew it.

    To exercise any of these rights, message us at @POWERCUTEVENTS from the Instagram account linked to your Powercut profile, or quote the mobile number on your account so we can verify it is you. We will respond within one month.

    If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it with you first.

  8. 8. COOKIES

    The website currently uses only the cookies and browser storage strictly necessary for it to work, for example to remember which step of sign-up you are on. We do not use advertising cookies on the site. If we introduce analytics cookies we will update this policy and, where the law requires it, ask for your consent first.

  9. 9. UNDER 18S

    Powercut events and accounts are for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we hold data about someone under 18, contact us and we will delete it.

  10. 10. CHANGES TO THIS POLICY

    We may update this policy from time to time. The date at the top of the page shows when it was last changed. If the change is significant, for example a new way of using your data, we will tell you by text or on the site before it takes effect.