Your information
Privacy notice
Last updated 28 August 2026
This notice explains what the current Essential Karaoke Disco website collects, why it is used, who can access it, how long it is kept and the choices you have.
Who is responsible for your information?
Lee Mills, trading as Essential Karaoke Disco (“EKD”), is the controller for the personal information described here. EKD is an entertainment business based in Exeter, Devon.
For privacy questions or requests, email essentialkaraokedisco@gmail.com.
What the website collects
- Enquiries and booking requests: your name, email address, venue or business name where relevant, location, requested date and time, event type, requested duration and anything you add about requirements or your event.
- Confirmed bookings: the enquiry information needed to arrange and deliver the event, booking status, assigned host and system, payment status, notes and related communications.
- EKD Assistant: the text you enter and any date, time or duration needed to answer your question or check apparent availability. The EKD application does not save ordinary chat as a conversation transcript. If you choose “Send enquiry to EKD”, the completed enquiry form is saved in the Control Centre.
- Music Challenge: game answers and timings, verified score and streak, the nickname you choose if you submit a result, and protected pseudonymous codes used to recognise repeat attempts and deter abuse.
- Optional analytics: only after you select “Allow analytics”, the page path, time, broad country, device category, external referrer domain and a protected pseudonymous visitor code. The EKD application does not store your raw IP address in its analytics table.
- Security and administration: limited network, browser/device and authentication information may be processed to protect forms, the challenge and private owner areas, investigate errors and keep an activity record of authorised changes.
Please do not include sensitive medical, financial, identity-document or other special-category information in a website enquiry. The website does not ask for a date of birth.
Purposes and lawful bases
| Purpose | UK GDPR lawful basis |
|---|---|
| Answering an enquiry, checking availability and taking requested steps before a booking | Steps at your request before entering a contract |
| Managing and delivering a confirmed event | Performance of the booking contract |
| Accounting, tax, insurance and responding to legal claims | Legal obligation and, where relevant, EKD's legitimate interests |
| Protecting the website, preventing spam or fraud, maintaining access and change logs, and running a fair Music Challenge | EKD's legitimate interests in operating a secure service and protecting customers and the business |
| Publishing a nickname and verified score that a player chooses to submit | EKD's legitimate interests in operating the voluntary public competition; players can ask for a name to be hidden or removed |
| Optional first-party website analytics | Your consent, which can be refused or withdrawn at any time |
The EKD Assistant can report only apparent availability. It does not confirm or refuse a booking and does not make a decision with legal or similarly significant effects; Lee or Siân reviews each enquiry.
EKD Assistant and Control Centre
Ordinary Assistant messages are processed to produce the on-screen response and are not added to the booking database. Short-lived protected abuse-prevention codes may be retained for up to 24 hours. When you actively send an enquiry, its form fields are encrypted in transit and stored in the private EKD Control Centre.
Control Centre customer records are restricted to authorised EKD owners. The public Assistant cannot search the customer database, retrieve a booking, reveal internal instructions or display another person's enquiry. A reference shown after submission is not a customer-access key.
Cookies and similar technologies
EKD does not use advertising cookies. Cloudflare may set essential security cookies before you make a choice because they protect the website from malicious and automated traffic. Optional EKD analytics stays off until you allow it. Refusing analytics does not affect the website, enquiry form, Assistant, directions or Music Challenge.
| Technology | Purpose and category | Duration |
|---|---|---|
ekd_analytics_consent | Strictly necessary preference cookie that remembers “allow” or “deny”. If allowed, it also lets the analytics endpoint verify the choice. | Up to 180 days |
__cf_bm | Strictly necessary Cloudflare bot-protection cookie. Its encrypted information helps distinguish malicious or automated traffic and is not an EKD advertising or cross-site tracking identifier. | Expires after 30 minutes of continuous inactivity |
cf_clearance and short-lived challenge cookies | Strictly necessary Cloudflare security cookies used only when a visitor is asked to pass a security challenge and to remember that it was passed. | For the security challenge period configured by Cloudflare |
ekd_mc_player | Strictly necessary, pseudonymous and HTTP-only Music Challenge cookie used to link a game to the same browser, enforce fair repeat attempts and reduce abuse. | Up to 12 months |
__Host-ekd_owner_session | Strictly necessary, secure and HTTP-only authentication cookie for the private owner Website Manager. It is not used for public visitor tracking. | Up to 30 days, or until sign-out/invalidation |
| Protected platform authentication storage | Strictly necessary storage may be used by the hosting/sign-in service on restricted administration pages to keep authorised owners signed in. | Controlled by the relevant secure session |
Analytics records use a keyed pseudonymous visitor code, not a raw IP address, and are configured for a 90-day retention window. Older records are purged when analytics is next collected or its private dashboard is accessed. Do Not Track and Global Privacy Control signals keep analytics off even if a previous choice allowed it.
Music Challenge and public leaderboard
The Challenge asks for a nickname only after a game is completed. Use a made-up nickname and do not enter a real name, age, school, contact detail or other identifying information. This is especially important for players under 18. The public leaderboard shows the nickname, score, best streak and tiebreak time; it does not expose the internal attempt ID, browser code, IP address or answer log.
Question-by-question records and pseudonymous attempt information are used to verify scores and investigate unfair play. Submitted leaderboard summaries may remain while EKD operates current, past-winner and all-time records. EKD reviews supporting technical records and should normally remove or anonymise those no longer needed after 12 months, unless a competition-integrity dispute requires longer. Contact EKD to ask for a nickname to be hidden or removed.
Children and younger visitors
The main EKD service is event entertainment arranged by adults, but younger people may visit the public website or play the Music Challenge. EKD does not ask a player for their age, real name, school or contact details. Players under 18 should use a made-up, non-identifying nickname and should ask a parent, carer or trusted adult before sending an enquiry. A parent, carer or player can contact EKD to ask for a leaderboard nickname to be hidden or removed.
Who receives information?
Customer records are available only to authorised EKD owners and, where necessary to deliver an agreed event, relevant EKD team members. EKD may also disclose information to accountants, insurers, legal advisers or public authorities where reasonably necessary or legally required. EKD does not sell personal information.
The website uses OpenAI's ChatGPT Sites service and Cloudflare infrastructure for hosting, security, databases and file delivery. These providers may process limited content and connection data to provide and protect the service. See the OpenAI privacy policy and Cloudflare privacy policy. Where processing is outside the UK, an applicable UK transfer mechanism is required, such as adequacy regulations or approved contractual safeguards.
The DevonAir live stream uses an external connection only when you activate the player. Google Maps, Facebook, email and other external links open services governed by their own privacy notices.
How long information is kept
| Record | Retention approach |
|---|---|
| Ordinary Assistant chat | No conversation transcript is stored by the EKD application. Short-lived protected rate-limit records are removed after approximately 24 hours. |
| Enquiries that do not become bookings | Reviewed at least annually and normally deleted or anonymised within 12 months after the last contact or decision, unless discussions, a complaint or a legal reason remain active. |
| Confirmed bookings and business records | Operational detail is kept while needed to deliver and follow up the event. Core transaction, payment and accounting evidence is kept for the applicable tax/legal period; for UK Self Assessment records this will commonly be at least five years after the relevant 31 January filing deadline. |
| Control Centre activity and security records | Kept only while reasonably needed for accountability, fraud prevention, access security or an investigation, then deleted or anonymised during periodic review. |
| Optional analytics | 90-day application window, with expiry enforced on the next analytics collection or dashboard access. |
| Music Challenge | Transient rate-limit codes are removed after approximately 24 hours. Technical game records are subject to the 12-month review described above; submitted winner/record summaries may be kept while the competition archive remains in use. |
The website deliberately does not automatically delete enquiry or booking records by age because that could erase legitimate business evidence. EKD applies the review periods above and may keep a specific record longer where required for tax, insurance, a complaint, a claim or another legal obligation.
Security
The website uses HTTPS, server-side authentication and authorisation for private areas, protected secrets, input checks, request-size and rate limits, pseudonymous anti-abuse identifiers, restricted cookies and non-public administration records. No internet service can guarantee absolute security, so please contact EKD promptly if you believe information has been exposed or misused.
Your rights and choices
Depending on the circumstances, you can ask to access, correct, delete or restrict the use of your personal information, object to processing based on legitimate interests, or request a portable copy. Some rights have legal exceptions, including where records must be kept for tax or legal claims. EKD may need to verify your identity and will normally respond within one month.
You can refuse analytics when first asked or use the “Privacy choices” button at any time to withdraw consent. Withdrawal stops future optional analytics and does not affect earlier lawful processing.
Contact EKD using the details above. If a concern is not resolved, you can complain to the Information Commissioner's Office.