INFORMATION ON WHAT DATA WE COLLECT
What is our role in relation to your personal data?
For the purposes of data protection laws, we are a “data controller” in respect of the personal data you provide us with, and are Registered as such with the UK data protection regulator, the Information Commissioner’s Office (ICO), under Registration no. ZA028541.
What is my personal data and what do you mean by process?
When we refer to personal data, we mean any information which relates to an identified or identifiable individual. Where we refer to process or processing, we mean anything which we may do with your personal data including collecting, storing, using, disclosing to third parties and erasing it.
What personal data will we collect from you and why?
We may collect personal data from and about you when you use our services, or if you are in touch with us in any way, whether this is directly or indirectly. You may, for example, request a publication from us or register for online training, register to receive our email newsletter, make a donation, or express an interest in our charitable activities. We also occasionally contact people we understand are likely to be interested in supporting our work on sustainable tourism – for instance, because of their work in our industry, because they work for a partner organisation, or because of their declared interest in sustainable tourism.
Examples of personal data which we might collect include (but are not limited to):
Who may we provide your personal data to?
Where you make a donation, appropriate personal data will be passed on to our suppliers (such as payment processors, banks and/or credit card companies) who need this information so that we can process your donation. It may also be passed to public bodies where appropriate/necessary: eg to HMRC to claim Gift Aid on your donation.
We may also make personal data available to other organisations who provide services on our behalf, such as distributing publications or delivering training, in order to fulfil your enquiry.
We only provide third parties with the personal data they require in order to deliver their services. Other than in relation to government / public authorities (over whom we have no control), we will take appropriate steps which are intended to ensure that anyone to whom we pass your personal data for any reason agrees to keep it secure, only uses it for the purposes of providing their services and does not collect any personal data from you in the course of performing their services.
Where will we process your personal data?
Your personal data may be processed within the UK and/or any other country(ies) of the European Economic Area (EEA). EEA countries are all member states of the European Union together with Norway, Iceland and Liechtenstein.
We may also process personal data outside the EEA. Data protection laws may not be as strong outside the EEA as they are in the EEA. Personal data will not be transferred to a country outside the EEA unless (1) the country to which it is transferred is one which the European Commission considers to provide an adequate level of data protection or (2) the personal data is transferred to a company which is required by our contract with them only to deal with the data in accordance with our instructions and to maintain appropriate security to protect the personal data which we are satisfied they have or (3) we are obliged to provide the personal data to a government / public authority in order to provide information or services to you.
How do we protect your personal data?
We take appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data, and against accidental loss or destruction of, or damage to, personal data, which is appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures.
Can we use your personal data to send you information about our activities or services in the future?
We will only retain and use your personal data for communications purposes where you have specifically consented to our doing so or, in relation to e-mail marketing, where we comply with the Privacy and Electronic Communications Regulations 2003 (PECR). PECR permits us to send you e-mail marketing where you have previously provided us with your e-mail address in the course of contracting services from us and we wish to e-mail you marketing material about our similar services or activities. You will of course be given the opportunity to opt out of receiving such e-mail marketing communications when you first provide us with your e-mail address and whenever we send you any e-mail marketing.
You may provide your consent by opting to receive marketing material either on-line or by telephone. You may also choose in what ways you are happy to receive communications from us. You may, for example, be happy to receive information and offers by post and e-mail but not by telephone.
Can you withdraw your consent to our processing your personal data?
Yes, you can withdraw your consent to receiving marketing material or other communications from us, at any time by e-mailing us at email@example.com or by clicking the link at the foot of any email newsletter we send you.
How can you find out what information we are holding about you?
You are entitled to ask us (by letter or e-mail) what personal data of yours is being held or processed, for what purpose and to whom it may be or has been disclosed. No fee will be charged for responding to this request unless it is obviously unfounded or excessive or we have previously provided the same information. We promise to respond to your request without delay and in any event within 1 month unless the request is complex or you have made numerous requests in which case we may be able to extend our response time by a further 2 months.
What should you do if the personal data we are holding is inaccurate, out of date or incomplete?
If you believe this is the case, please tell us by e-mail as soon as possible. We will rectify the problem within 1 month or within 3 months if the rectification request is complex.
How long can we retain and process your personal data?
We will not process your personal data in a form which enables you to be personally identified for any longer than is necessary in order to fulfil the purpose for which it was originally collected or for any other legitimate business or charitable purpose.
Where your personal data has been provided for the purpose of making a donation, we are entitled to retain this data for a period of at 6 years (for example, to comply with regulatory or reporting obligations). In certain limited circumstances, we may be able to retain it for a longer period.
If you have consented to receiving marketing communications from us, we may continue to use your personal data for this purpose until you withdraw your consent or otherwise for as long as we reasonably consider your consent remains valid and effective.
Can you ask us to delete your personal data?
Yes, you can ask us to erase your personal data in certain circumstances, for example where you have withdrawn your consent to further marketing material where the data in question has only been processed for this purpose. However, this is not always the case. Please see the previous paragraph for further information on the period of time we may retain personal data.
If you’ve used our website we may use advertising on other websites and on social media sites and apps, to remind you about the services we provide based on your browsing.
Third Party Links
What should I do if I have a complaint about the processing of my personal data?
If you have any complaint about the way in which your personal data has been dealt with, please let us know by e-mail to firstname.lastname@example.org. We will investigate and respond to you as soon as we reasonably can. If you remain dissatisfied, you may complain to the Information Commissioner’s Office. For further details, see www.ico.org.uk