This policy applies to current and former contacts (including, but not limited to, WW organisers and makers, artists and partner organisations), members of our workforce (including employees and consultants, agency workers, advisers and self- employed consultants), vendors, other third parties with whom we work and other persons.
Data Privacy Manager: Lucy Reeves Khan
Company Name: Window Wanderland CIC
Address: 35 Nevil Road, Bristol BS7 9EG
The lawful bases we rely on to process personal data
We will only use your personal data when the law allows. The law on data protection
sets out a number of different reasons (lawful bases) why a company may collect
and process personal data. Most commonly, we will use your personal data in the
- If you take a service from us, for example, make an enquiry, register or
purchase a toolkit, we’ll collect your contact details in order to deliver the
service to you.
- Where it is necessary for our legitimate interests (or those of a third party) and
your interests and fundamental rights do not override those interests. For
example, we’ll use your contact details to send you marketing information and
communications telling you about business services that we think might
- Where we have your consent to do so. For example, when you register to
receive our newsletter or it may be relevant to connect you to other
- Where there is a legal requirement. For example to assist a regulatory or
public authority or criminal investigation body.
- Where it is needed in the public interest or for official purposes. For example,
in order for our International Trade Documentation department to process and
authorise Certificates of Origin.
- Where we need to protect your interests (or someone else’s interests). For
example, in our recruitment activities.
The data we collect about you
“Personal data” is any information about a living individual from which they can be identified such as name, ID number, location data, any online identifier, or any factor specific to the physical, physiological, genetic, mental, economic or social identity of that person. It does not include data where any potential identifiers have been removed (anonymous data) or data held in an unstructured file.
There are “special categories” of sensitive personal data which are more private in nature and therefore require a higher level of protection, such as genetic data, biometric data, sexual orientation, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and health information.
When we refer to “processing,” this means such processes as collecting, using, storing, transferring, disclosing, altering, or destroying personal data.
WWCIC will only collect your personal data to ensure we can keep you informed about our work, projects, events and online shop. We will not collect or keep personal information about you unless we need it. We will not collect more information than we need and we will not keep it longer than we need to.
You can ask us to remove your personal information at any time.
The information we hold about you will fall into one or more of the following indicative categories:
- Name, title, postal address, phone number(s), email address, social media contact details;
- Cookie technology (if you provide permission when visiting our website)
- Photographs and films
We also collect, use and share aggregated data such as access to a specific website feature, statistical or demographic data for reports and funding applications to demonstrate where events have taken place and how many people have participated. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity.
How we get the personal information and why we have it
Most of the personal information we process is provided to us directly and voluntarily by you for one of the following reasons:
- To keep track of who is organising events and in which area
- To fulfil product orders placed on the website and ship items to the right address
- To fulfil registrations and send the required information
- To market our services
- To issues newsletters to which you have subscribed
- To enforce a contract and pursue client for payment if overdue/unpaid
- To monitor and understand website traffic
- To answer queries
- In cases where you are attending one of our online or physical events or workshops, it may also include other information about you or your needs (for example, information on your disabilities, carers, dietary requirements or emergency contacts).
- We sometimes take photographs and film at our sessions and events. Before taking any images we will ask for verbal consent from individuals, parents/carers, and anyone else we will be filming. Once the activity is over we then ask for written consent from the same people so that the photographs and films may be used by WWCIC for our website, flyers, publicity and social media. If you are unhappy about this, please tell us. We will make sure that we do not take any photographs/films of yourself and that you will not appear in any group photographs or films that may be used in our publicity.
All the personal data WWCIC has is only processed by our staff. No third parties have access to your personal data unless the law allows them to do so.
WWCIC will try to make sure that all the information we hold about you is accurate and up to date. WWCIC will always let you know what information we hold about you if you ask us and will always correct any mistakes in the information.
WWCIC will never share personal information with other people unless there is a safeguarding issue.
Some of our service providers may have access to your data in order to perform services on our behalf – e.g. distribution mailing companies for specific events. We make sure anyone who provides a service for us meets our standards for data security. They will not use your data for anything other than the service that they are providing.
How we store your personal information
Your information is securely stored on a secure cloud-based service and, at times, on a back-up hard drive. Physical documents containing data will be stored in a single secure location.
We keep personal information, such as name, address, email and contact numbers for 6 years from the last agreement we hold with you, or 2 years from the last date you expressed interest in our service. Exceptions include if monies were still outstanding, as contact details will remain on file until all aspects of the contract, such as payment, have been fulfilled. We will then dispose of your information by shredding physical copies and permanently deleting online files.
Your data protection rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at email@example.com if you wish to make a request.
Regulatory Contact Details
Depending on where you are resident or otherwise located, you have the right to make a complaint any time to the relevant national supervisory authority for data protection issues.
In the UK, for example, you can make a complaint at any time to the Information Commissioner’s Office (ICO) (www.ico.org.uk). We are registered with the ICO:00015028236.
We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance at Window Wanderland CIC firstname.lastname@example.org.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline number: 0303 123 1113