BIBI EXPO PRIVACY POLICY

How BIBI collects, uses and protects your personal information

Website	bibiexpo.com
Data controller	BIBI COLLECTIVE LTD Company number 17179626 128 City Road, London, United Kingdom, EC1V 2NX
Privacy contact	legal@bibiexpo.com
Effective date	12 September 2026
Last updated	12 September 2026

BIBI respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect, why we use it, who we may share it with, how long we keep it and the rights you have when you visit bibiexpo.com, contact us, subscribe to updates, buy tickets, enquire about sponsorship or exhibiting, apply to a BIBI initiative, or otherwise interact with us.

1. Who we are

BIBI COLLECTIVE LTD (“BIBI”, “we”, “us” or “our”) is the controller of the personal data described in this Privacy Policy unless we tell you otherwise.

BIBI Expo is a business and community platform created to connect, champion and elevate South Asian women of every background through business, innovation, visibility, opportunity and meaningful connection.

You can contact us about privacy at legal@bibiexpo.com.

Our registered company number and registered office address should also be displayed on the Website in accordance with applicable company-law requirements.

2. What personal data we collect

The information we collect depends on how you interact with BIBI. We aim to collect only information that is relevant and reasonably necessary for the purpose concerned.

2.1 Identity and contact information

• name
• email address
• telephone number
• postal or business address
• business or organisation name
• job title or professional role

2.2 Ticketing, booking and transaction information

• ticket, registration and booking details
• billing and transaction records
• information needed to administer refunds, transfers or event access
• payment status and transaction references

Where payments are handled by a third-party payment provider, BIBI may not receive or store your complete payment-card details. The provider will process those details under its own contractual and privacy arrangements.

2.3 Exhibitor, sponsor, speaker and partner information

• business and professional contact details
• information contained in enquiries, proposals, applications and agreements
• company or brand information, biographies, logos and promotional material
• requirements relevant to event participation and delivery

2.4 Initiative and application information

If you apply to initiatives such as My First Stand or BIBI Big Pitch, we may collect information needed to assess and administer your application. This may include your business story, professional background, business or project information, supporting documents, photographs, video, pitch materials and other information you choose or are asked to provide.

2.5 Communications and marketing information

• your marketing and communication preferences
• records of correspondence with us
• newsletter subscriptions
• information about engagement with our communications, where our systems lawfully provide this

2.6 Technical and website-use information

Depending on the technology used on the Website and your cookie choices, we may collect information such as your IP address, browser and device information, operating system, approximate location derived from technical data, referring pages, pages visited and information about how the Website is used.

2.7 Photographs, video and audio

BIBI Expo is a public-facing event and photography, filming and audio recording may take place. This may include general event coverage as well as planned interviews, speaker recordings, promotional shoots or content featuring particular participants.

Where you are specifically featured, we will consider the nature and purpose of the recording and the appropriate lawful basis. Where consent is the appropriate basis, we will ask for it. General event photography or filming may in some circumstances be processed on the basis of BIBI’s legitimate interests in documenting and promoting the event, subject to appropriate consideration of individuals’ rights and reasonable privacy expectations.

2.8 Special category data

Some personal information receives additional protection under data-protection law. This includes information revealing racial or ethnic origin, religious or philosophical beliefs, health information and certain other sensitive categories.

Because BIBI exists to connect and champion South Asian women and may run inclusion, accessibility, evaluation or community-focused activities, there may be occasions when we ask for or receive information that amounts to special category data. For example, an application or optional evaluation question may ask about ethnicity, or you may tell us about a health or accessibility requirement.

We will only process special category data where it is genuinely necessary, where we have both a lawful basis under UK GDPR and an additional legal condition for processing it, and where appropriate safeguards are in place. Where information is optional, we will make that clear wherever practicable.

Please do not send us sensitive personal information that we have not requested unless it is necessary for us to deal with your enquiry or participation.

3. How we collect personal data

We may collect personal data:

• directly from you when you complete a form, buy a ticket, subscribe, contact us, make an enquiry, apply, register, exhibit, sponsor, speak at or participate in an event;
• through your interactions with the Website and, where applicable, cookies and similar technologies;
• from suppliers and service providers that help us deliver our website, ticketing, communications, event operations or other services;
• from your business, employer or another person who nominates, books or introduces you, where appropriate;
• from event partners, professional contacts or organisations where there is a legitimate reason to receive the information; and
• from publicly available professional or business sources where lawful and relevant, for example when identifying or contacting potential business partners, speakers, sponsors or collaborators.

4. How we use personal data and our lawful bases

Data-protection law requires us to have a lawful basis for using personal data. The basis will depend on the purpose and circumstances.

4.1 Enquiries and relationship management

We use information to respond to enquiries, arrange meetings, manage relationships and communicate with people and organisations engaging with BIBI.

Lawful basis: legitimate interests in operating BIBI and responding to relevant communications, or taking steps at your request before entering into a contract.

4.2 Tickets, bookings and event participation

We use information to process registrations and ticket purchases, administer event access, provide service communications, deal with changes and deliver what has been booked.

Lawful basis: performance of a contract or taking steps before entering into a contract; legal obligation where applicable.

4.3 Exhibitors, sponsors, suppliers and commercial partners

We use information to assess enquiries, negotiate and administer arrangements, deliver agreed benefits, manage invoices and communicate about event operations.

Lawful basis: contract or steps before contract, legitimate interests in managing BIBI’s business relationships, and legal obligation where applicable.

4.4 My First Stand, BIBI Big Pitch and other initiatives

We use application information to assess eligibility, shortlist and select participants, communicate decisions, administer participation, plan the event, conduct judging and, where relevant, publicise selected participants.

Lawful basis: contract or steps before contract, legitimate interests in operating and promoting the initiative, and consent where a particular use requires it. Where special category data is involved, we will also identify and rely on an appropriate additional condition.

4.5 Speakers, contributors and event programming

We use professional information, biographies, photographs, contact details and programme information to plan and promote the event, manage speaker arrangements and communicate with attendees.

Lawful basis: contract, legitimate interests, or consent where appropriate.

4.6 Service and operational communications

We may send messages necessary to administer a booking, application, agreement or event relationship. These are service communications rather than marketing and may include changes to timings, venue arrangements, access information, application outcomes, contractual information or important policy updates.

Lawful basis: contract, legitimate interests or legal obligation, depending on the communication.

4.7 Marketing and community communications

We may send newsletters, event news, opportunities, ticket information and other BIBI updates where permitted by law. Depending on the circumstances, we may rely on consent, the electronic-marketing ‘soft opt-in’ where it lawfully applies, or legitimate interests for forms of business-to-business marketing permitted by law.

You can opt out of marketing at any time. Opting out of marketing will not prevent us from sending service messages that are necessary for an existing booking, application, contract or other active relationship.

4.8 Website operation, analytics and improvement

We use appropriate technical information to operate and secure the Website, diagnose faults, understand how it is used and improve its performance and content.

Lawful basis: legitimate interests in operating a secure and effective website. Where cookies or similar technologies require consent, we will seek that consent before using them.

4.9 Safety, fraud prevention and legal compliance

We may process information where reasonably necessary to protect BIBI, participants and others, investigate suspected fraud or misuse, manage disputes, establish or defend legal claims, comply with tax and accounting duties, or respond to lawful requests from authorities.

Lawful basis: legal obligation and/or legitimate interests, depending on the circumstances.

5. Legitimate interests

Where we rely on legitimate interests, this means we have identified a genuine business, organisational or community purpose for using the information, considered whether the processing is necessary for that purpose, and balanced our interests against the rights and reasonable expectations of the people concerned.

Examples may include responding to business enquiries, managing professional relationships, improving and securing the Website, promoting BIBI Expo, documenting the event, preventing misuse and undertaking appropriate business-to-business outreach.

You may have a right to object where we rely on legitimate interests. See section 13 below.

6. Marketing

We want BIBI communications to be useful and relevant. Where required, we will ask for your permission before sending electronic direct marketing.

You can unsubscribe using the link included in marketing emails or contact us at hello@bibiexpo.com. We may retain a minimal suppression record after you opt out so that we can respect your preference and avoid adding you back to marketing unintentionally.

If you receive a personal marketing message from us because of an existing relationship or another lawful basis and do not wish to receive further marketing, you can object at any time.

7. Cookies and similar technologies

The Website may use cookies and similar technologies for essential functions, security, preferences, analytics and, if used by BIBI, marketing or advertising.

Where the law requires consent for a cookie or similar technology, it will not be activated until the required choice has been made. You should be able to reject optional cookies as well as accept them and change your preferences later.

Our separate Cookie Policy should identify the actual cookies and similar technologies in use, their providers, purposes, durations and categories. The cookie banner, consent-management platform and Cookie Policy must be kept consistent with the technology actually deployed on bibiexpo.com.

8. Who we share personal data with

We may share personal data where reasonably necessary with:

• website hosting, IT, cloud-storage and technical support providers;
• ticketing, registration and payment-service providers;
• CRM, email and communications providers;
• analytics and website-service providers, subject to your cookie choices where required;
• Olympia London and other venues, event contractors, security providers, production teams and suppliers where information is needed to deliver the event;
• judges, assessors or appropriate partners involved in BIBI initiatives, where necessary for the relevant application or programme;
• professional advisers including accountants, lawyers, insurers and auditors;
• regulators, courts, law-enforcement bodies, government authorities or other parties where disclosure is required or permitted by law; and
• a purchaser, investor or adviser involved in a genuine proposed sale, restructuring, financing or transfer of all or part of BIBI’s business, subject to appropriate confidentiality and legal safeguards.

Where another organisation processes personal data solely on our behalf, we require it to handle that information under appropriate contractual and security obligations. Some organisations, such as payment providers, venues or ticketing services, may also act as independent controllers for some of their own processing. Their privacy notices will apply to that processing.

9. International transfers

Some suppliers may store or process personal data outside the United Kingdom. Where UK data-protection law restricts an international transfer, we will use an appropriate lawful mechanism, which may include UK adequacy regulations or approved contractual safeguards, together with any additional measures required in the circumstances.

You may contact us if you would like further information about safeguards relevant to your personal data.

10. How we protect personal data

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access. Measures will vary according to the nature and sensitivity of the information and the systems involved.

Access to personal data should be limited to people and suppliers who need it for legitimate purposes. Where appropriate, we also use contractual controls, access management, secure systems and procedures for dealing with suspected personal-data breaches.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, accounting, regulatory, contractual, dispute-resolution and evidential requirements.

Our working retention periods may include:

• general enquiries and non-contractual correspondence: normally up to 24 months after the last meaningful contact, unless there is a reason to retain it longer;
• unsuccessful initiative applications: normally up to 24 months after the relevant initiative, unless a shorter or longer period is justified and communicated;
• successful participant, exhibitor, sponsor, supplier and contractual records: normally up to 6 years after the relevant relationship or contract ends where required for legal or business records;
• financial, invoice and transaction records: normally 6 years or such other period as applicable law requires;
• marketing records: while you remain subscribed or while another lawful marketing basis applies;
• marketing suppression records: for as long as reasonably necessary to ensure your opt-out continues to be respected;
• event photography, video and published promotional material: potentially for a longer period as part of BIBI’s legitimate event archive and promotional record, subject to the nature of the material, the lawful basis and individuals’ rights; and
• cookie and analytics information: according to the durations identified in the Cookie Policy and the settings of the relevant provider.

We may anonymise information so that it can no longer identify an individual. Properly anonymised information may be retained and used for statistical, evaluation, historical or planning purposes.

12. Photography, filming and event publicity

Photography, filming and audio recording may take place at BIBI Expo. We may use appropriate event imagery and recordings for reporting, editorial, archival and promotional purposes connected with BIBI and future BIBI events.

We will consider reasonable expectations and the context in which material is captured. Dedicated interviews, testimonials, promotional shoots or other content focused on an identifiable individual may involve additional information or permissions where appropriate.

If you have a particular privacy, safeguarding or accessibility concern about photography or filming, please contact us before the event where possible or speak to the BIBI team at the event. We will consider reasonable measures, although we cannot guarantee that an individual attending a large public event will never appear incidentally in crowd or background footage.

13. Your data-protection rights

Depending on the circumstances, UK data-protection law may give you the right to:

• be informed about how your personal data is used;
• request access to personal data we hold about you;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase personal data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests in certain circumstances;
• object at any time to personal data being used for direct marketing;
• receive certain personal data in a portable format where the right to data portability applies; and
• withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing carried out before withdrawal.

These rights are not absolute and legal exemptions or conditions may apply. We may need to ask for information to verify your identity before responding to a request.

You will not normally have to pay a fee to exercise your rights. We may charge a reasonable fee or refuse a request where the law permits us to do so, for example if a request is manifestly unfounded or excessive.

To exercise a privacy right, contact hello@bibiexpo.com.

14. Automated decision-making

BIBI does not currently intend to make decisions that have legal or similarly significant effects on individuals solely through automated processing. If this changes, we will provide the information and safeguards required by law.

15. Children and young people

The Website and BIBI Expo are principally directed at adults and business or professional audiences. Some family, educational or youth-related activities may involve people under 18.

Where BIBI intentionally collects personal data from or about children or young people, we will consider their age, the nature of the activity, appropriate notices, lawful bases, safeguarding requirements and whether parental or guardian involvement is appropriate.

If you believe a child has provided personal data to us in circumstances that concern you, please contact us.

16. Third-party websites and platforms

The Website may link to third-party websites, social-media services, ticketing systems, payment providers, exhibitors, sponsors or other platforms. Those organisations may collect personal data independently of BIBI and will have their own privacy practices.

We are not responsible for another organisation’s privacy notice or processing simply because we link to its website or use its service. Please review the relevant third-party privacy information where appropriate.

17. Complaints

If you are concerned about how we have handled your personal data, please contact us first at hello@bibiexpo.com so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available from the ICO.

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in BIBI’s activities, the Website, suppliers, technology or applicable law. The latest version will be published on bibiexpo.com and the ‘Last updated’ date will be changed.

Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected people where required or appropriate.

19. Contact us

For questions about this Privacy Policy, requests concerning your personal data or privacy concerns, please contact:

BIBI COLLECTIVE LTD
Email: legal@bibiexpo.com
Website: bibiexpo.com

Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
Company number: 17179626