Bletchley Park Privacy Policy

1. WHAT IS THIS PRIVACY NOTICE?

At Bletchley Park Trust we take privacy seriously and we are committed to protecting it. We want to maintain the trust and confidence of our visitors, participants and supporters, as well as visitors to our website, by ensuring you fully understand the way we use your data.

This policy explains when, how and why we and companies in our group (which means our subsidiaries, our ultimate holding company and its subsidiaries from time to time, as defined in section 1159 of the UK Companies Act 2006) collect personal information, detailing how this information is used, the conditions under which it may be disclosed to others and how it is kept secure and how long it is kept in accordance with the Data Protection Act (1998), the Privacy and Electronic Communications Regulations (2003) and, as of the 25th of May 2018, the EU General Data Protection Regulation (EU 2016/679).

It also explains how you can control the data we hold, including how to update your information when it changes.
This policy may change from time to time so please check this page occasionally to ensure that you’re happy with any changes.
This policy was last updated on 14 May 2021.

2. WHO WE ARE

Bletchley Park Trust group is made up of Bletchley Park Trust Limited and includes our subsidiary Bletchley Park Company Limited.

Bletchley Park Trust is an independent museum and heritage attraction, located at Bletchley Park and opens to the public 361 days a year. Our registered charity number is 1012743. We are a company limited by guarantee, company registration number 2730618.

Our Mission is to preserve and enhance Bletchley Park, to attract, engage and educate visitors from all over the world through the continuing restoration and development of the entire estate and our exhibitions. Our Mission is to highlight the codebreaking achievements of Bletchley Park in the Second World War, its role as a birthplace of computing and its importance for understanding the past and relevance for the future.

Bletchley Park Company Limited (Reg. Co. number 2723470 ) carries on a range of commercial trading activities to generate income for Bletchley Park Trust including sale of gifts and souvenirs at shops and online, income from commercial partnerships including catering activities, sponsorship, and product licensing and commercial activities that are deemed outside the charitable purposes of Bletchley Park Trust. These activities include events, intellectual property rights, and access to the property for filming rights and advertising revenues.

Where this policy refers to “we”, “our” or “us” below, unless it mentions otherwise, it’s referring to Bletchley Park Trust and its subsidiary. The data controller is Bletchley Park Trust Limited of The Mansion, Bletchley Park, Sherwood Drive, Bletchley, MK3 6EB. This means it decides how your personal data is processed and for what purposes.

3. HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information from you in the following ways:

3.1 Personal information you give to us:
This is information about you that you give to us when:

• You make a purchase with us for tickets, events, membership or products from us, either in person at Bletchley Park or via our website
• You make a gift or monetary donation to us, either in person at Bletchley Park, over the phone or via our website
• Sign up to our mailing list
• You offer, donate or loan an artefact to our collections
• You contribute an oral history to our collections
• You are listed on our Roll of Honour
• Join in an activity as a participant, such as our learning programme
• You enter information via our website, opt-in/consent forms, apps or by communicating with us by phone, post, e-mail, social media or otherwise.
• You complete surveys or provide feedback about your interaction and engagement with us.
• You become a tenant or sub-tenant of ours or a regular visitor to the site and we provide you with an access pass and/or car parking pass.

We may also ask you for information when you report a problem with our site. If you complete any surveys that we request you complete for research purposes, we will collect information in such circumstances as well.

The information you give us includes your name, address, email address and phone number, enquiry details and may include records of any correspondence and responses to any surveys.

3.2 Personal information we collect about you:
We only collect information that’s necessary to carry out our business or to deliver our charitable objectives. The more ways you engage with us as an organisation, the more data we will require in order to provide the necessary services required. There are occasions where you can choose to not provide us with the information we require, but this will then impact the service we are able to provide.

We may automatically collect information through our website or apps. In this privacy policy when we talk about our website we are referring to https://www.bletchleypark.org.uk and when we talk about apps we are referring to those as owned by Bletchley Park Trust which you would have downloaded to your mobile device.

3.3 Personal information we may receive from other sources:
We obtain certain personal information about you from sources outside of our business. The personal information we receive from third party sources is as described in the two paragraphs above. The third parties that may send us personal information about you are as follows:

Job and volunteering application data

If you apply to work or volunteer at Bletchley Park Trust, we may receive information from the following sources:
Recruitment consultants who may provide information about you to us in relation to a potential job at Bletchley Park
Employers who may provide a reference on you to us

We will use this information, and that which you supply to us directly, to process your application and to monitor recruitment statistics. If you are unsuccessful in your application we will keep your personal information for 6 months. For more information around what personal data (information) we will hold about you, how we collect it, and how we will use and may share information about you during the application process please see our Data Protection Privacy Notice for Recruitment.

If you are successful with your application, we will provide you with our privacy policy around your data whilst you are an employee or volunteer.

4. TYPE OF PERSONAL INFORMATION WE PROCESS ABOUT YOU

We may process a range of personal information about you in the course of our interactions with you. To make it easier to understand the information that we use about you, we have listed this information below and provided a short explanation of the type of information each category covers.

This information may include:

• Prefix and full name
• Gender
• Email address
• Billing address
• Phone number
• Date of birth
• Payment information such as debit/credit card details – please note we do not save these details electronically and only securely retain the last four digits of your card on our paperwork in line with our retention policy
• Bank details for direct debit instructions and information used to send/receive funds to/from you or that appears on your bills
• Purchases, membership, Gift Aid declarations, donations and gifts in your will
• Delivery address
• Details of transactions you carry-out through the website
• Visits to the site, including, but not limited to traffic data, location data, weblogs and other communications data
• Access requirements
• Dietary requirements (for fundraising and events only)
• Contact preferences
• Where you have left us a legacy, any information regarding next of kins with which you may have provided us to administer this
  Emergency contact details (for project/event participants only)
• Vehicle model and identification number and employer details (for those requiring access and car parking passes only)
• Job application information (including but not limited to your qualifications, experience, employment history, your referees details)
• Behavioural (your activities, actions and behaviours) and biographical (your life experiences)
• A record of your interactions with our emails eg opening rates and click-through responses

We may also automatically collect technical information, including anonymous data collected by the hosting server for statistical purposes, the Internet protocol (IP) address used to connect your computer or device to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. We may collect information around the use of our website or the pages of our website you have visited. This information is collected to help diagnose and manage the website, to audit the geographical makeup of users, and to establish how they arrived at the website. Please see Cookies for further information. We may also collect any personal information which you allow to be shared that is part of your public profile or third party social network, type and version, time zone setting, browser plug-in types and versions, operating system and platform.

This is not an exhaustive list and we may retain different types of information for different individuals based on the service we are providing. For information on how long we retain your data for, please refer to the retention section at the bottom of this policy.

Social Media
Depending on your settings or the privacy policies for social media services like Facebook, Instagram or Twitter, you may give us permission to access information from those accounts or services, such as your behaviour on these services and across our site. The majority of this behaviour is anonymised. For more information on how to control your privacy settings for these services, go to the following links:

• Facebook – Privacy Policy
• Instagram – Privacy Policy
• Vimeo – Privacy Policy
• Twitter – Privacy Policy
• YouTube – Privacy Policy

5. HOW WE USE YOUR PERSONAL INFORMATION

The purposes for which we use your information and the legal basis under data protection laws on which we rely to do this are explained below.

5.1 To carry out our business and to provide a service or carry out a contract with you
If you support us by visiting Bletchley Park, joining our membership schemes by becoming a friend or life member, purchasing something online, making a donation or registering for/participating in an event/activity, you may provide us with personal data that we will use for the following reasons:

• To provide you with the products or services you have requested, such as visit tickets, merchandise, event registration
• To process and acknowledge your monetary donation
• To record and manage your artefact or oral history donated to our collections
• To record and manage artefacts on loan from you to Bletchley Park Trust and to keep in touch with you with regard to the loan
• To record and manage your Roll of Honour entry and to keep in touch with you regarding your entry
• To provide membership materials and benefits such as email newsletters, magazines, membership cards and event invitations and inform you when your membership is due for renewal
• To provide sponsorship materials and benefits including event invitations
• To process your payment.
• To keep a record of your relationship and communication preferences with us
• To contact you with important information relating to your visit or purchase, such as confirming your order or letting you know about activities that may affect your visit.
• To remind you of your upcoming visit and to advise any important information relating to that visit
• To seek your feedback on your visit or experience to allow us to improve our services
• To remind you that your season ticket is coming to an end
• To provide you with access to our site

5.2 Where we have your consent

Direct email marketing

We may use and process your personal information where you have consented for us to do so for the following purposes:

• To contact you via email about what’s on, our ticket, merchandise or membership offers, and our news, if you i) register for an account with us online and indicating that you would like to receive such marketing from us; ii) sign up for our newsletter or emails via our website or other medium where available; or iii) when you refresh your marketing preferences when responding to a request from us to do so.
• To email you about a specific topic you have requested to hear more on, such as specific exhibitions, our community work or opportunities to support our work
• Advertise via digital advertising platforms about what’s on, offers and news

You may withdraw your consent for us to use your information in any of these ways at any time. Please see 12.3 Withdrawing your consent for further details.

Post / telephone marketing

We will not contact you by telephone unless it is for a legitimate interest to contact you.

If you have provided us with your postal address or telephone number we may contact you by post about our work unless you have told us that you do not want to receive this. Before making such calls we will always screen against the Telephone Preference Service (TPS) or, where sending letters, we will always screen against the Mail Preference Service (MPS).

Where you are registered with the TPS we will only make calls to you if you have specifically consented to receiving calls from Bletchley Park Trust or if we need to contact you in reference to a purchase, for example if there has been a problem in processing a payment. Likewise we will only write to you if you are registered with the Mail Preference Service if you have specifically consented to receiving letters from Bletchley Park Trust.

Image rights

When you’re on site at Bletchley Park, or at one of our events, your photograph may be taken. We will always ask for consent to photograph or video children.

If you consent to having your photo taken and used for marketing or PR purposes we will hold your name, image and age (if applicable) on file for future re-use.

Under 18s

On some occasions we may collect and manage data of under 18’s. We will manage this data in a way which is appropriate to the age of the child and will only keep this data for the purpose in which it was collected. Children’s data is usually only collected if you hold a membership or a child takes part in one of our experiences.

We will always try to seek consent from the parent or guardian of the child before collecting and processing this information.

Veterans

Bletchley Park Trust has compiled and maintains a Roll of Honour which aims to list all those worked in signals intelligence for the United Kingdom and Commonwealth countries during the Second World War.

It is compiled from information including official sources, publications and information provided by veterans, friends and families. More information about who the Roll of Honour represents and the sources about that information can be found here.

The majority of information contained within the Roll of Honour is not sufficiently detailed or structured for specific information about specific individuals to be readily accessible. Those records which include more detail about an individual’s wartime service and other relevant details will have been provided by the veterans themselves or their families. Many veterans produced written accounts of their experiences, which they or their families have sent to us, along with photos, copies of service records or other relevant documents. Where possible, Bletchley Park has interviewed the veteran and recorded their story.

Where a veteran or their family has contacted Bletchley Park with details to be recorded on the Roll of Honour, or for nomination for Freedom of Bletchley Park we record the contact details of the veteran and relevant family member on our Database. We keep in contact with our veterans to keep them updated on relevant news about Bletchley Park, including our Annual Veterans Reunion, new exhibitions and events which we think may be of interest. In addition, we ensure they receive our periodic Ultra magazine.

All veterans are entitled to Freedom of BP and receive a membership card. We may ask Veterans for further information on their wartime service, for the purpose of historical research, or if they are happy to give press or other interviews.

Bletchley Park veterans are now of an age where they may be unable to make decisions for themselves or care for themselves of protect against harm or exploitation. At all times, we remain alert to our responsibility to adults at risk, and ensure our safeguarding policy is followed when approaching veterans for information, interviews or on other matters.

Fundraising

Bletchley Park is a registered charity and we rely on charitable support and voluntary income to maintain our work to attract, engage and educate visitors from all over the world through the continued restoration, research and development of the site. This vital work is supported by individuals, trusts and foundations, companies and statutory bodies.

We target our fundraising activities to ensure that we contact donors and prospect donors appropriately. To do so, we may use simple research methods to profile supporters and to identify shared interests and connections. This could include booking patterns, individual connections, business network information and publicly available information relating to residential location, wealth and assets, family (not including information about children unless given personally or made public by the individual concerned), career, donations to other organisations (including political parties where such donations are made public by the individual) and hobbies to create a profile of their interests and preferences. This may also include Google, newspapers, articles, websites and archives, housing market websites and the electoral roll as well as official websites of companies such as trustfundraising.org, LinkedIn and 192.com, a range of charities and other heritage and arts organisations.

We may also obtain information from individuals working on our behalf such as our Development Board and from organisations that book fundraising events or who have memberships with us for their hospitality packages or corporate events (such as guest lists for specific events). We may work with trusted third-party partners such as database screening companies to provide us with further information about our supporters. This is obtained from publicly available sources or data that you have given to us.

Such information helps us better understand the interests of people who engage with us, and aids us in making appropriate fundraising approaches to those who will be most interested and most able to support Bletchley Park Trust.

If we have identified a specific company or trust and foundation through this research, we may contact the people specifically connected to these bodies via publicly available contact information, such as a relevant work email address. If we identify an individual, we may contact them via phone or by post. As a charity, we believe that this is in the legitimate interest of our fundraising needs. We will always ensure we conduct a legitimate interest assessment to ensure that we are not infringing on your rights.

We ask our supporters for permission or preference for appropriate accreditation online on our website, in our annual review and on thank you panels in our buildings. Those who support our Brick campaign are asked if they would like to provide an additional personal message for the Bletchley Park Trust digital wall, and are informed that the action of providing one gives consent for it to be posted on our website and for us to use as part of relevant social media campaigns. We also respect the rights to anonymity if the donor so requests.

We gratefully receive income from legacies. We may keep data you provide to us for as long as needed both to carry out legacy administration and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.

You can opt out of your data being used in this way by emailing [email protected]. We respect anyone’s right to withdraw their consent from this form of electronic communication and once informed of a preference change, we will cease this form of contact. We are also registered with the Fundraising Regulator and use the Fundraising Preference Service, a service which allows people to opt out of fundraising communications from charities. We receive regular updates from the Fundraising Preference Service so if you opt out that way, we will remove you from our email, phone, text, and postal communications.

We are committed to fundraising best practice and abide by the Fundraising Regulator’s key principles and behaviours of a fundraising organisation: to be legal, open, honest and respectful. We have a fundraising ethical policy which can be accessed here. We undertake to comply with relevant law and regulations, including the Proceeds of Crime Act, Data Protection, Tax and Gift Aid legislation and Charity Commission guidance.

5.3 Where it is in your vital interest 
Where we have supplied you with any products, we may use your personal information to contact you if there are any urgent safety or product recall notices to communicate to you or where we otherwise reasonably believe that the processing of your personal information will prevent or reduce any potential harm to you. It is in your vital interests for us to use your personal information in this way.

5.4 Where there is a legitimate interest
We may use and process your personal information where it is necessary for us to pursue our legitimate interests as a business, or that of a third party, for the following purposes:

• To learn about your interests and preferences so that we can contact you with information that is relevant to you.
• To help us target our marketing and development communications and adverts so that they’re more relevant to you.
• To send relevant invitations to events or other fundraising opportunities via post or phone if we believe this would be of interest.
• To use your pseudonymised details to show you advertising on such Social Media platforms as Facebook and Instagram or via other third party advertising that may appear on other websites you use. The information shared with these platforms is pseudonymised to protect your personal data.
• To classify our audience into groups or segments, using booking and publicly available information. These segments help us to understand our audience better and ensure we’re sending relevant messages to each group. We may use third party processors to help achieve this. We also submit these anonymously as part of reporting to fundraising and public funding bodies (such as DCMS and Arts Council England).
• To ensure we are maximising our ticket sales wherever possible.
• To help us run the test version of our website and CRM system that we use internally to pilot new features and ensure the smooth running of our customer services.
• To profile the frequency and behaviours of new and returning visitors to inform our business planning – the data used for these purposes will be used anonymously.
• For analysis to inform our marketing strategy, and to enhance and personalise your customer experience (including to improve the recommendations we make to you on our website).
• To correspond or communicate with you.
• To verify the accuracy of data that we hold about you and create a better understanding of you as a customer.
• For network and information security in order for us to take steps to protect your information against loss or damage, theft or unauthorised access.
• To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request).
• For the management of queries, complaints, or claims.
• For the establishment and defence of our legal rights.

We also collect information in order to better inform our teams about prospective donors, to fulfill our fundraising goals as a charity. This is to ensure we are providing appropriate opportunities for people to support our work, should this form of engagement be of interest.

5.5 Where there is a legal requirement
In some circumstances, we will use your personal information to comply with our legal obligations. Sometimes, we will need to process your data as it is part of a contract you have entered into. For instance, if you have booked a group visit with us, then we will need to contact you and take payment to enable us to provide the relevant services under the agreement with you.

Another example could be if you have allowed us to treat your ticket payment or donation as a Gift Aid donation, we will share the necessary details with HM Revenue and Customs to allow us to make our Gift Aid claim.

We will share your personal information where we are legally required to do so, or as a result of a lawful request by a government or law enforcement agency.

However, in most circumstances, we will rely on your consent when using your personal data.

6. OTHERS WHO RECEIVE OR HAVE ACCESS TO YOUR PERSONAL INFORMATION

6.1 Our suppliers and service providers
Bletchley Park will not sell your data. We will not share your data for marketing purposes unless you have actively consented to this. However, in some circumstances we may need to share your details with our third party service providers, agents, subcontractors and other organisations for the purposes of providing services to us or directly to you on our behalf.

Such third parties may include cloud service providers (such as hosting and email management), advertising agencies and administrative services.

Other circumstances could be if we run an event in partnership with another organisation and they need your details in order to fulfil your tickets or experience. For example, if you are taking part in an event with us, we may need to share your details to be able to send further information to you. We may also use a third party to process your personal details if we need to send your data to a mailing house in order to fulfil a postal mailing to you, this could include sending you our magazine or a letter about your membership.

When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

6.2 Third parties who provide products and services
We work closely with certain third parties to bring you a range ticket offers or experience packages to complement those that we provide. These third party product providers may share your information with us, which we will use in accordance with this policy. In some cases, they will be acting as a controller of your information and therefore we advise you to read their privacy policy when you provide your information to understand fully how they will process and safeguard your data.

Tickets and experiences are currently provided by:

• Acorne Limited (T/A Virgin Experience Days)
• Visit Britain
• Certain hotels

6.3 Third Parties who request information or contact details for our Veterans
We will not pass personal data of our veterans or their families without consent from those concerned. We recognise the importance of safeguarding and protecting the data of those served here.

6.4 Credit/debit card payment and direct debit processors
When you purchase any products or services online, your credit/debit card payment is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. All of your personal information is encrypted as it travels over the internet. When you make a booking online, you enter a secure internet site (indicated by the letters https:// in the address bar and / or a padlock displayed in your web browser). To protect you against credit card fraud (where someone has discovered your credit card details but do not have your card), you will be asked to enter the unique security code printed on the back of your payment card. If you have any questions regarding secure transactions, please contact us using the details at the end of this policy.

When you sign up to one of our membership schemes and agree to pay by direct debit, we will securely share the bank or building society details you pass to us with our third party direct debit service provider, via user portal and secure file upload/download. This information is retained by us securely in order to claim monthly or annual payments from your account as per your instructions. All transaction are covered by the Direct Debit Guarantee.

6.5 Customer satisfaction surveys
As customer satisfaction is important to us, we may ask a third party research company to contact you for the sole purpose of gathering general information and specific information relating to us and our products and services.

6.6 Our online safety app, Mail Maze
This is an online game designed for children to test their awareness of online safety issues and how their privacy may be at risk depending on information they share or online account settings they choose. Although the online game encourages users to enter personal information, this data is entered on a secure internet page and is not stored after the game is left.

6.7 Other ways we may share your personal information
We may transfer your personal information to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. If you are a legacy giver, we may share information with co-beneficiaries. We may also transfer your personal information if we’re under a duty to disclose or share it in order to comply with any legal obligation, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our visitors and customers. We will always take steps with the aim of ensuring that your privacy rights continue to be protected.

7. WHERE WE STORE YOUR PERSONAL INFORMATION

All information you provide to us may be transferred to countries outside the European Economic Area (EEA). By way of example, this may happen if any of our servers or those of our third party service providers are from time to time located in a country outside of the EEA. These countries may not have similar data protection laws to the UK.

If we transfer your information outside of the EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. These steps include imposing contractual obligations on the recipient of your personal information or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection. Please contact us using the details at the end of this policy for more information about the protections that we put in place and to obtain a copy of the relevant documents.

8. HOW LONG WE KEEP YOUR PERSONAL INFORMATION FOR

If we collect your personal information, the length of time we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under other laws. We do not retain personal information in an identifiable format for longer than is necessary.
For fundraising purposes

For those who have given us a donation (from Friends membership upwards), we will keep data indefinitely. For prospect donors, and people we have interacted with as part of fundraising, we may keep their data for a 7 year period, dated from the last interaction.

We’ve set these timelines because:
If someone has supported us (whether it is as an individual, corporate or trust and foundation), we believe that it is in our legitimate interest to keep a record of this gift and make sure that we are contacting the donor appropriately. This is to ensure that we have the best duty of care to all who give to us and we are providing the services expected.

For prospect donors, we will ensure that we record their data for enough time to help us inform the appropriate level of stewardship, any future asks and, most importantly, that we protect anyone from being asked again who declines interest in supporting Bletchley Park. We believe that 7 years is enough time to ensure this does not happen and to protect our business from any potential professional embarrassment.

Please note that Veterans data will be kept indefinitely regardless of whether they have donated to us, as this information is essential to our heritage and charitable objectives.

9. SECURITY AND LINKS TO OTHER SITES

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted to our website and any transmission is at your own risk. Once we have received your personal information, we put in place reasonable and appropriate controls to ensure that it remains secure against accidental or unlawful destruction, loss, alteration, or unauthorised access.

Where we have given (or where you have chosen) a password which enables you to access an account, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Our website may contain links to other websites run by other organisations. This policy does not apply to those other websites‚ so we encourage you to read their privacy statements. We cannot be responsible for the privacy policies and practices of other websites even if you access them using links that we provide. In addition, if you linked to our website from a third party website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party website and recommend that you check the policy of that third party website.

10. COOKIES

Like many other websites, our website uses cookies including Google Analytics cookies to obtain an overall view of visitor habits and visitor volumes to our website. ‘Cookies’ are small pieces of information sent to your computer or device and stored on its hard drive to allow our websites to recognise you when you visit.

It is possible to switch off cookies by setting your browser preferences. For more information on how we use cookies and how to switch them off on your device, please visit our Cookies Policy.

11. MARKETING

We may collect your preferences to receive marketing information directly from us by email in the following ways:

• If you sign up to keep in contact with us via our website, including signing up during an online purchase transaction
• If you provide your details for marketing when asked on arrival in admissions
• If you provide your details for marketing purposes as part of a Group or Learning booking
• If you tick and sign up to receive marketing on our literature or marketing collateral, eg as part of a Friends membership application

and we will only do so if you have consented to receive such marketing information directly from us. However in every marketing email we send you, we will give you the opportunity to unsubscribe from our mailings altogether.

We may contact you with targeted advertising delivered online through social media and platforms operated by other companies by using your personal information, or use your personal information to tailor marketing to improve its relevance to you, unless you object.

From time to time, we may ask you to refresh your marketing preferences by asking you to confirm that you consent to continue receiving marketing information from us.

You have the right to opt-out of our use of your personal information to provide marketing to you in any of the ways mentioned above. Please see 12.3 Withdrawing your Consent and 12.4 Objecting to our use of your personal information and automated decisions made about you below for further details on how you can do this.

12. YOUR RIGHTS

You have a number of rights in relation to your personal information under data protection law. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within one month from either (i) the date that we have confirmed your identity or (ii) where we do not need to do this because we already have this information, from the date we received your request.

12.1 Accessing your personal information
You have the right to ask for a copy of the information that we hold about you by emailing or writing to us at the address at the end of this policy. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.

12.2 Correcting and updating your personal information
The accuracy of your information is important to us and we are working on ways to make it easier for you to review and correct the information that we hold about you.

In the meantime, if you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting us in any of the details described at the end of this policy.

12.3 Withdrawing your consent
Where we rely on your consent as the legal basis for processing your personal information, as set out under 5 How we use your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this policy. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, you can do so using our unsubscribe tool. If you withdraw your consent, our use of your personal information before you withdraw is still lawful.

12.4 Objecting to our use of your personal information and automated decisions made about you
Where we rely on your legitimate business interests as the legal basis for processing your personal information for any purpose(s), as out under 5 How we use your personal information, you may object to us using your personal information for these purposes by emailing or writing to us at the address at the end of this policy. Except for the purposes for which we are sure we can continue to process your personal information, we will temporarily stop processing your personal information in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data.

You may object to us using your personal information for direct marketing purposes and we will automatically comply with your request. If you would like to do so, please use our unsubscribe tool.

12.5 Erasing your personal information or restricting its processing
In certain circumstances, you may ask for your personal information to be removed from our systems by emailing or writing to us at the address at the end of this policy. Unless there is a reason that the law allows us to use your personal information for longer, we will make reasonable efforts to comply with your request.

You may also ask us to restrict processing your personal information where you believe it is unlawful for us to do so, you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings. In these situations we may only process your personal information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.

12.6 Transferring your personal information in a structured data file
Where we rely on your consent as the legal basis for processing your personal information or need to process it in connection with your contract, as set out under 5 How we use your personal information, you may ask us to provide you with a copy of that information in a structured data file. We will provide this to you electronically in a structured, commonly used and machine readable form, such as a CSV file.

You can ask us to send your personal information directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.

12.7 Complaining to the UK data protection regulator
You have the right to complain to the Information Commissioner’s Office (ICO) if you are concerned about the way we have processed your personal information. Please visit the ICO’s website for further details.

13. CHANGES TO THIS POLICY

We may review this policy from time to time and any changes will be notified to you by posting an updated version on our website and/or by contacting you by email. Any changes will take effect 7 days after the date of our email or the date on which we post the modified terms on our website, whichever is the earlier. We recommend you regularly check for changes and review this policy whenever you visit our website. If you do not agree with any aspect of the updated policy you must immediately notify us and cease using our services.

14. CONTACT US

Our Data Protection lead is our Director of Support Services, Jennifer Milton. Please direct any queries about this policy or about the way we process your personal information to our Data Protection team at [email protected].

If you wish to write to us, please write to the address given at the start of this policy.

If you would prefer to speak to us by phone, please call 01908 640404.