Making a Stallholder Application Form: What to Ask

What should a stallholder application form ask?

The core of a stallholder application form is shorter than most forms in circulation suggest:

• Name, and business or stall name.
• Email address and phone number.
• What they sell, in their own words, plus a category if you curate the mix (you will use this to avoid a fair with nine candle stalls).
• Two or three photos of their stall or products.
• What pitch they need: indoors or out, what size, whether they bring their own table and gazebo or need a table provided, and access to power.
• Public liability insurance: state your required cover level on the form (£5 million is the common minimum) and ask them to confirm they hold it, with the certificate itself to follow before the event.
• Website or social media links, as an optional field.

That covers a standard craft stall. The rule for everything beyond it: know what you will do with the answer. Every question should exist because it feeds a real decision about layout, curation, or safety. If you cannot say what a question is for, it comes off the form. That is not just good form design; as the next sections explain, it is also what data protection law actually asks of you.

Which questions depend on your event?

Let the shape of your event drive the extra questions, and mark these sections "complete if this applies to you" so a jewellery maker is not wading through catering questions:

• Food and drink stalls: confirmation they are registered as a food business with their local authority, their food hygiene rating, how they handle allergen information, and whether they cook on site. If they cook with LPG gas, ask for a current gas safety certificate.
• Outdoor pitches: whether they bring their own gazebo with adequate weights, whether they need vehicle access for unloading, and whether they want to run a generator.
• Mains power requested: what equipment they intend to plug in, and PAT test records for it.
• Paid helpers on the stall: confirmation they hold employers' liability insurance.

Each of these mirrors a check you would make anyway before event day. Which documents to insist on, and how to check the certificates that come back, is its own job: see checking stallholder insurance and documents.

Every yes on this list becomes a certificate to chase and check by hand before event day. That chore is what the StallSync Event Passport exists to remove: stallholders keep their documents in one place, and organisers see at a glance who has sent what and what expires when.

What should you leave off the form?

Data protection law has one big idea for form design, and it is a helpful one: collect only what you need. (The official term is data minimisation.) In practice that means leaving off:

• Date of birth. You need to know they are an adult trader, not their birthday.
• Home address. An email address does the job at application stage; collect invoicing details from accepted stallholders only.
• Copies of passports or photo ID. No craft fair needs these.
• Bank or card details. Payment is a step for accepted applicants, not a question on the form; see taking card payments at craft fairs for the stallholder side of the same principle.
• National Insurance numbers, and any blanket health questions.

One question needs careful wording rather than removal. Asking about access requirements ("Is there anything we can do to make your pitch work for you?") is good practice, but answers about someone's health carry extra legal protection. Keep the question optional, say what you will use the answer for, and delete the answers after the event rather than filing them away.

Does UK GDPR apply to your application form?

Yes. It applies the moment you collect applicants' names, contact details, and certificates, and it makes no difference that your fair is volunteer-run, free to enter, or raising money for charity. The carve-out people half-remember ("purely personal or household" use) covers your own address book, not a public event.

Before that sounds alarming, two reassurances.

First, you do not need anyone's consent to hold their application. They sent it to you and asked you to consider it; in data protection terms, that is the lawful basis, and no tick-box is needed. The tick-box myth causes more confusion at small events than the law itself.

Second, complying costs behaviour rather than money, with one possible exception: the ICO data protection fee (the ICO is the Information Commissioner's Office, the UK's data protection regulator). Organisers running events as a business usually pay the lowest tier, £52 a year as of September 2026, or £47 by direct debit. Volunteer-run and not-for-profit fairs are usually exempt. The ICO's online self-assessment settles it in a few minutes.

Stallholders carry their own version of these duties for customer data; that side is covered in GDPR for craft businesses.

What do you owe applicants once you hold their details?

Three small things, none of which needs a policy document:

• 1. Tell them what happens to their details, at the point they apply. Two lines on the form is enough: who you are, what the details are used for, and how long you keep them. For example: "Applications are seen by the organising committee only, used to plan and allocate pitches, and deleted two months after the event."

• 2. Pick a deletion date and keep to it. The law sets no fixed retention period; it asks you to keep details no longer than you need them and to be able to say why. Delete unsuccessful applications soon after the event. Keep accepted stallholders' records for as long as you genuinely need them, and say so.

• 3. Answer requests. Anyone can ask what you hold about them (you have a month to reply, and you cannot charge) or ask you to delete it. At craft fair scale these arrive as ordinary emails, not legal letters, and the honest answer usually takes five minutes.

Can you email applicants about next year's fair?

Not automatically, and this is the mistake that turns a well-run fair into a spam complaint. Marketing emails to individuals need consent, and that includes sole traders, which is most stallholders.

There is a narrow exception for your own customers, often called the soft opt-in: you can email accepted stallholders about similar future events if you gave them a clear chance to opt out when you collected their details and in every email since. It does not stretch to unsuccessful applicants, and it does not apply to charity fundraising promotion at all, which catches out exactly the committees who assume the rules are softer for good causes.

The clean solution costs one line on the form: an unticked box saying "Email me about future events". Never pre-tick it. Anyone who ticks it is a mailing list you can use with a clear conscience; anyone who does not is a name you leave alone. The legal risk here is real but modest; the certain cost is goodwill, because your applicant pool is your local maker community, and they talk to each other.

What would the ICO ask to see?

If an applicant ever complained, the ICO would expect you to be able to produce, within a reasonable time:

• The privacy note applicants saw when they applied (the two lines from the section above satisfy the UK GDPR's right to be informed).
• Where the applications are stored and who can see them: one email account and one spreadsheet with a known list of committee members is a perfectly good answer.
• Your stated retention period, and evidence you follow it: last year's unsuccessful applications should actually be gone.
• If you send marketing emails, the consent behind each address on the list (that is the tick-box record).

The realistic picture: complaints about small community events are rare, and where the ICO does engage, its first move with a small organisation is advice rather than penalties. The point of the list is not fear; it is that if the form was set up properly, every answer above takes about thirty seconds.