Data Protection & Privacy Notice
April 2021

Plymouth Waterfront Partnership BID have made some changes to our data protection and privacy notice in light of data protection legislation known as General Data Protection Regulation, or GDPR as it is more commonly known. These changes come into effect on 1st April 2021.

These changes include:

  • The data that we control
  • How we use the data
  • Why we need the data
  • Who has access to the data
  • Your rights regarding your data
  • Clear and more transparent details of who to contact regarding any queries

 

This updated notice outlines your rights under GDPR legislation.

Background

Plymouth Waterfront Partnership Business Improvement District is a Private Company Limited by Guarantee without share capital with a registered number of 07303310. The registered office is Salt Quay House 4 North East Quay, Sutton Harbour, Plymouth, PL4 0BN. Plymouth Waterfront Partnership BID is also registered with the Information Commissioner’s Office as a data controller (No. ICO:00015640767).

Plymouth Waterfront Partnership BID will be known as the “data controller” of the personal data provided by you to us, or otherwise provided or collected by us. Our data protection officer (DPO) is the CEO Diane Mansell, who is contactable via email at CEO@Waterfrontbid.co.uk

Plymouth Waterfront Partnership BID is responsible for:

  • waterfront.co.uk
  • Facebook – Plymouth Waterfront Partnership
  • Twitter – PWPBID
  • LinkedIn – Plymouth Waterfront Partnership
  • Instagram – Plymouth Waterfront Partnership

All of which are now referred to as “our websites”. Please read this notice carefully. Your use of our websites signifies your agreement and consent to this notice. If not, please discontinue your use immediately.

 

How the law protects you

Your privacy is protected by law. Data Protection law says that we are allowed to use personal data only if we have a proper reason to do so. The term “personal data” means information about an identifiable individual which includes name, address, email, telephone number and other information relating specifically to an individual.

The law says we must have one or more of these reasons:

  • To fulfil a contract we have with you, or
  • When it is our legal duty, or
  • When it is in our legitimate interest, or
  • When you consent to it, or
  • Protection of the vital interests of a data subject or another person
  • Performance of a task in the public interest

 

Any of these lawful bases could apply to a BID but the most relevant are consent and legal obligation. Processing data relating to voter/Levy Payer contacts for the purposes of communicating statutory information about Plymouth Waterfront Partnership BID, as set out in BID regulations is covered by the legal obligation lawful basis. The processing of personal data for any other purpose (e.g. general public information, crime prevention messaging, general interest notifications etc.) requires consent from the data subject. Consent is tightly defined under the GDPR and must be explicit for the data collected and the purpose for which the data is intended to be used. As the data controller, Plymouth Waterfront Partnership BID must obtain and prove consent (an opt-in process) and at any time a data subject may withdraw their consent and request their personal data is erased* (*please note this right does not apply to data held for the legal obligation lawful basis). Plymouth Waterfront Partnership BID is currently undertaking a review of its non-statutory distribution lists and will be contacting participants in order to obtain specific consent regarding the receipt of any further information from us.

Information we collect about you

Plymouth Waterfront Partnership BID shall comply with the Principles of Data Protection listed within GDPR. We will make every possible effort to comply with these principles. The Principles are:

  • Lawfulness, fairness and transparency – Data collection must be fair, for a legal purpose and we must be open and transparent as to how the data will be used.
  • Purpose limitation – Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • Data minimisation – Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
  • Accuracy – Personal data shall be accurate and, where necessary, kept up to date.
  • Storage limitation – Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
  • Integrity and confidentiality – Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
  • Accountability – The controller shall be responsible for, and be able to demonstrate compliance with the GDPR.

 

How we process your data

Plymouth Waterfront Partnership BID processes the following data about you:

  • Information you give us – Information you provide us in compliance of the lawful basis of legal obligation to enable us to communicate with you on matter relating to ballot and BID proposals required by BID regulations. We also process information you electively provide us with your consent. This includes data you provide us by filling in forms, inputting data on our websites or by corresponding with us by phone, email or otherwise. It includes information you provide when you subscribe to receive our latest news and details of our events, search our site, enter a competition, promotion or survey and when you report a problem with our site. The information you give us may include your name, address and/or postcode, job title, employer details, email address and phone number, photos and other images.
  • Information we collect about you – Plymouth Waterfront Partnership BID receives personal data from third parties, such as the Local Authority, regarding information required as part of our legal obligation to communicate with you regarding statutory BID business. With regard to the information you provide us consensually, we will automatically collect the following information each time you visit our websites:
  • Technical information – including the Internet protocol (“IP“) address used to connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
  • Information about your visit – including the full Uniform Resource Locators (“URL“), clickstream to, through and from our site (including date and time), page response times, download errors, length of visits to certain pages and page interaction information (such as scrolling, clicks, and mouse-overs).

 

If you communicate with us through any link on our websites, we may ask you for your personal data so we can respond to your questions and comments.

Generally speaking, the information you give us and/or the information we collect about you will be relative to the functions of Plymouth Waterfront Partnership BID and will be kept for no longer than is necessary for that purpose. In any event the maximum retention time scale will be the current five-year BID tenure period plus an additional year, to ensure all administrative duties can be fully discharged.

 

Cookies

Our websites uses cookies to distinguish you from other users of our websites. This helps us to provide you with a good experience when you browse our website and also allows us to improve our sites. Cookies are bits of text that are placed on your computer’s hard drive when you visit certain websites. We use cookies to tell us, for example, whether you have visited our websites before or if you are a new visitor and to help us identify site features in which you may have the greatest interest. Cookies may enhance your online experience, for example, by remembering your passwords and viewing preferences, while you are visiting a particular site.

The majority of internet browsers are initially set up to accept cookies. The toolbar on most browsers will have a feature to tell you how to stop accepting new cookies, how to receive notifications of new cookies, and how to disable any existing cookies. Please note, however, if you do disable, reject or stop cookies, you may not be able to take full advantage of all our websites’ features and services that we would like to offer you.

 

How do we use the information about you?

  • To provide you with the information and services that you request from us. For example, through newsletters or other communications. It is important to understand you can opt out at any time from receiving such communication from us by unsubscribing from our services.
  • To provide you with information about other services we offer that are similar to those that you have enquired about. For example, we may provide you with information regarding future events or workshops you previously attended or showed interest in.
  • To notify you about changes to our service.
  • To ensure that content from our site is presented in the most effective manner for you and for your computer.
  • To help us administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.
  • To improve our websites to ensure that content is presented in the most effective manner for you and for your computer.
  • To allow you to participate in interactive features of our service, when you choose to do so.
  • To assist us to ensure our websites are as safe and secure as possible.
  • To gauge and understand the effectiveness and appropriateness of the marketing we provide to you and other people.
  • To inform us about suggestions and recommendations we can make to you and our other website users about offers and services that may be of interest.
  • Information we receive from other sources.

 

Use of images

Plymouth Waterfront Partnership BID routinely uses photos and videos to promote our work via our websites, newsletters and other publicity communications. Where possible we will reasonably try to obtain your consent in advance of publication on our websites. However, if we are using an image of you, and you would like us to stop, please contact us as soon as possible. Please note, we do not pay or provide credit for use of your image in our photographs or videos.

At times, we may share your image for use by our partners in order to promote or advertise our events, projects, services and initiatives. Where possible, we will reasonably try to gain your consent in advance. However, if we are using an image of you, and you would like us to stop, please contact us as soon as possible.

 

How we share your personal data

Plymouth Waterfront Partnership BID will never sell or otherwise disclose your personal data, subject to some specific exceptions:

  • If we collect or update your personal data following an event or initiative that we deliver in partnership with another organisation, we would only share the data with that partner with your explicit consent.
  • We may share your personal data with service providers, employees or contractors that we have commissioned to perform services or work on our behalf. They are provided only with the personal data they need to perform their functions and can only use and disclose such personal data as is necessary to perform services on our behalf or to comply with legal requirements.
  • If we have agreed to conduct activity that promotes our businesses, or other services that you provide, or that highlights work or activity that you are undertaking, we may share your name, your job title, the name of your employer and your image. We may also share your professional contact details in circumstances where people will need to contact you, in order for our activity to be meaningful.
  • Plymouth Waterfront Partnership BID collects data that may assist law enforcement agencies to prevent and detect crime, and to assist in the apprehension and prosecution of offenders. This data usually consists of (but is not limited to) names, photos and video footage. Plymouth Waterfront Partnership BID may disclose this data to law enforcement agents without prior consent from you, in line with S.29(3) of the Data Protection Act 1998.
  • In addition, we may disclose your personal data

(i) if we are required to do so by law or legal process,

(ii) to law enforcement authorities or other government officials

(iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity.

 

Plymouth Waterfront Partnership BID’s crime reduction activity

 

Plymouth Waterfront Partnership BID Ambassador:

  • Plymouth Waterfront Partnership BID provides an Ambassador Patrol service for the benefit of those who live, work, visit or pass through the Plymouth Waterfront Partnership BID area. Occasionally our Ambassador Service may capture photographic or video images of people engaging in criminal and/or anti-social behaviour. Where appropriate this will be shared with the relevant law enforcement agencies for investigation and possible prosecution. If requested, we will consider sharing this data, without consent, in accordance with S.29(3) of the Data Protection Act 1998.

 

Where you’re personal data may be transferred or stored

Plymouth Waterfront Partnership BID will treat your personal data as private and confidential, but may share it outside of our organisation if:

  • Allowed by any agreement entered into by you
  • You consent
  • Needed by our agents, advisers or others involved in running accounts and services for you or collecting what you owe to other companies
  • Needed by third parties to help manage your records
  • HM Revenue and Customs or other statutory authorities who require it
  • The Law, Regulatory Bodies, or the public interest permits and requires it
  • Required by us or others to investigate or prevent crime
  • Required as part of our duty to protect your accounts

 

How we protect your personal data

Plymouth Waterfront Partnership BID maintains administrative, technical and physical safeguards to protect against loss, misuse or unauthorised access, disclosure, alteration or destruction of the personal data you provide to us.

Updates to our privacy notice

We may change this policy from time to time by updating this policy. We will also communicate changes to you via email, website, or letter. You should check this policy from time to time to ensure that you are happy with any changes.

 

What are your rights?

You have the right to ask us to provide you with access to and rectification or erasure of your personal data. Providing you with this information is free of charge, but charges may apply for excessive requests. You have the right to ask us to provide you or a third party with the personal data you have provided to us in an electronic format.

You have the right to object to certain purposes for processing, in particular direct marketing.

You have the right to update your contact details, preferences or make a complaint. Any changes need to be communicated to the DPO via an email to CEO@Waterfrontbid.co.uk  

Should you be unhappy with our processing of your personal data, you have a right to complain to the Information Commissioner’s Office, which is the regulator for data protection.

 

Breaches

In the event that we suspect there has been a serious breach to our systems or data we will inform the Information Commissioner’s Office within 72 hours, and will inform the affected individuals as soon as practicable afterwards.