Introduction
New General Data Protection Regulations (“GDPR”) came in to force on 25th May 2018.
As a result, we have updated our Privacy Notice to make it easier for you to find out how we collect, use and protect your information, and what your rights are.
Here are the key things you need to know:
1. Who we are
1.1 This privacy notice (the “Privacy Notice”) applies to all personal information processing activities carried out by Ocean Conservation Trust Ltd (OCT).
1.2 OCT is a data controller in respect of personal information that we process relating to our business, including the products and services we provide, for the purposes of the UK Data Protection Act 1998, EU General Data Protection Regulation (GDPR), PCI-DSS, and European data protection legislation.
1.3 Our address is Rope Walk, Coxside, Plymouth, Devon, PL4 0LF.
1.4 OCT Ltd is a parent undertaking, incorporating National Aquarium Ltd, NMA Operations Ltd and Scylla Reef Ltd, which are all wholly-owned subsidiary companies, (the “Group”). In this policy references to “we”, “us” or “our” are references to the Group.
1.5 We respect individuals’ rights to privacy and to the protection of personal information.
The purpose of this Privacy Notice is to explain how we collect and use personal information relating to our business. “Personal information” means information about a living individual who can be identified from that information (either by itself or when it is combined with other information).
We may update our Privacy Notice from time to time. When we do we will communicate any changes to you and publish the updated Privacy Notice on our website.
We would encourage you to visit our website regularly to stay informed of the purposes for which we process your information and your rights to control how we process it.
2. The information we process
2.1 We collect and process various categories of personal information at the start of, and for the duration of, your relationship with us, to enable us to provide the specific service you require. We will limit the collection and processing of information to information necessary to achieve one or more legitimate purposes as identified in this notice.
Personal information may include:
a) basic personal information, including name and address, date of birth and contact details;
b) goods and services provided;
c) visual images and personal appearance (such as photographs or CCTV images);
d) online profile and social media information and activity, based on your interaction with us and our websites and applications.
e) Your contact and marketing preferences.
f) Information necessary for legal compliance.
2.2 We may also process certain special categories of information for specific and limited purposes.
We will only process special categories of information where we’ve obtained your explicit consent, or are otherwise lawfully permitted to do so (and then only for the purposes and activities for which the information is provided).
This may include:
a) information about racial or ethnic origin;
b) religious or philosophical beliefs;
c) trade union membership;
d) physical or psychological health details or medical conditions.
3. The basis for processing your data
We have four bases for processing your personal data:
- Processing your personal information so that we may perform our obligations under a contract with you (such as the purchase of a ticket, membership scheme, outreach activity, after-schools club, function, or event; or to buy our products and carry out any logistics for delivery or return of goods) (“Your Contract”).
- Processing for legitimate interests provided these are not overridden by your interests and fundamental rights and freedoms. For example, to fulfil our legal and regulatory and internal governance obligations; and in addition / together with the processing condition described above (“Legitimate Interests”).
- Processing which is necessary for compliance with our obligations laid down by European Union law (where relevant) and by English laws applicable to us in the United Kingdom (“Our Legal Obligations”).
- Your consent may also be a lawful reason for processing your personal data in certain cases.
(“Your Consent). This means your freely given, specific, informed and unambiguous consent which may be collected from you, for example, when you agree to receive marketing communications from us or when you agree to take part in surveys or market research.
4. Consent
Your consent will be an explicit action from 25th May 2018. Because of the need for consent we will not use defaulted opt-in checkboxes or include your personal data for communication and marketing purposes where you have not explicitly given us your consent.
We will keep your given consent on file for a period of up to 7 years from the last consent change, before checking if your consent is still valid. We will not contact you if you have withdrawn consent.
At 7 years we will contact you by email or post, depending on your preferences, with a statement of consent and your current choices. We will then send a reminder email after 30 days if no contact has been received. If this is not responded to then we will take that your granting of consent is still valid.
We will also include the opportunity to unsubscribe or withdraw consent on all marketing emails.
5. Who we share your information with
We will not share your information with anyone outside the Group except:
a) where we have your permission;
b) where required for your product or service;
c) where we are required by law, government entities, tax authorities or regulatory bodies around the world;
6. Your rights
As well as the right to access the personal information we hold about you, you have several other rights in respect of your personal information under Data Protection law. These may include (as relevant):
a) the right to access or obtain copies of your personal information that we hold;
b) the right to rectification, including to require us to correct inaccurate personal data;
c) the right to request restriction of processing concerning you or to object to processing of your personal data;
d) the right to request the erasure of your personal data where it is no longer necessary for us to retain it;
e) the right to data portability including to obtain personal data in a commonly used machine-readable format in certain circumstances such as where our processing of it is based on your consent;
f) where you have an option to provide us with your personal data or not relating to your use of our website or relating to any of our products or services, you have the right to be informed about the possible consequences of not giving it to us;
g) the right to withdraw your consent to any processing for which you have previously given that consent.
Keeping you informed:
We will keep your details on record until we have completely dealt with your request, enquiry or application and then for a reasonable period afterwards, in accordance with data protection and other applicable legislation.
We may keep your details on record for as long as is necessary for the purposes set out above and will then endeavour to delete your details in accordance with data protection and other applicable legislation.
Changes to this Notice
We keep this Notice under regular review.
We may change this Notice from time to time by updating this page to reflect changes in the law and/or our privacy practices. The date at the top of this Notice will be updated accordingly and we encourage you to check this from time to time for any updates or changes.
Where you have provided us with your email address, we may also contact you to let you know that we have updated the Notice. We may also take that opportunity to ask you if you would like to update your marketing preferences.
By using our websites, submitting your personal information to us, registering an account, registering a customer credit account or interacting with us in other ways, you consent to the use of your personal information as described in this Notice (as amended from time to time).
This Notice does not extend to your use of, provision of data to and collection of data on any website not connected to us to which you may link to by using the hypertext links within our websites.
