The Wavell Room (Wavell Room) is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. You are being provided with a copy of this privacy notice because of your interaction with the Wavell Room.
It makes you aware of how and why your personal data will be used and how long it will usually be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) (GDPR).
- Plain English and Brevity– We’ve kept this as short and simple as possible to ensure your consent is easily conferred.
- Who We Are– The Wavell Room is a currently incorporating as a Charitable Incorporated Organisation (CIC) pending a registered charity number provided by the Charities Commission.
- Data protection principles – We will comply with data protection law and principles, which means that your data will be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
- How personal information is collected – We may collect personal information about you from you.
- Information We Collect– We collect the following personal information:
- Contact form data that you willing provide us for the purposes of correspondence or answering queries. This is held for the maximum period required in order to assist with follow on requests or future correspondence and this data is held securely.
- Mailing list data is held for the purposes of sending those who opt-in by providing their email address frequent updates and information releases from the Wavell Room in the spirit under which the email address was provided.
- Event sign up data is held for the purposes of sending those who sign up information that confirms or updates them on event information. This data will be kept for use to keep you informed of future events that you may be interested in.
- Unidentifiable website browsing data is collected in order to understand how users use the website and the services in order to enhance the user engagement. This data is not linked to personal data, but as with any website, if aggregated with a number of other collected information sources could link to personal data (we won’t be doing this, largely because we won’t be purchasing data from other suppliers).
- How We Use Your Personal Data– The Wavell Room will never disclose, share or sell your data without your consent, unless required to do so by law). We use your personal data for the reasons mentioned above.
- If you fail to provide personal information – If you fail to provide information when requested, which is necessary for us to answer your queries or add you to our mailing list, we will not be able to do so successfully.
- Change of purpose – We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
- Data Subject’s Rights – Under certain circumstances, by law you have the right to:
- Request access to your personal information (known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
- If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our data protection officer (DPO) through our contact form in writing as set out below.
- Right to withdraw consent – When you apply to join our mailing list, you provide consent to us processing your personal information for the purposes of sending you our newsletter and for the reasons that you opted in for. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact our DPO as set out below. Once we have received notification that you have withdrawn your consent, we will remove you from our mailing list and, subject to our retention policy, we will dispose of your personal data securely.
- Data sharing – We currently have no plans to share your personal data with 3rd parties. This will be updated and those under these terms will be informed and required to opt in.
The “third parties” referred to above also includes third-party service providers (including contractors and designated agents). All our third-party service providers and other entities to whom we provide your data are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
- Transfers Outside the EU– Our data is held on servers either in the UK (our primary choice) or (secondary choice) in the EU. In some circumstances, some data may be transferred and processes in the US, under Google’s GDPR compliant processes and under Privacy Shield, ISO 27001, SOC2 and SOC 3 accreditations.
- Data Security– We enforce SSL and TLS where possible to ensure that any transactional data sharing between you and The Wavell Room is conducted in a way which is recognisably secure for a site of this nature. Should users of the Wavell Room require encrypted emails for correspondence, this service can be provided upon request.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
- How Long We Keep Your Data– We will retain your personal information for a period of 1 year from the date you unsubscribe from our mailing list, however will seek to delete data once we no longer have a need for it, if this comes sooner than 1 year.
After this period, unless separately legally required to retain the information, we will securely destroy your personal information in accordance with our data retention policy and the applicable laws and regulations.
If we wish to retain your personal information on file for a period beyond the above, we will write to you separately, seeking your explicit consent to retain your personal information for a further fixed period on that basis. In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
- Automated decision-making – You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
- Marketing– We will only send marketing materials that relate to marketing the services of the Wavell Room and our partners. Through our mailing list channel, opt-out and unsubscribe options are available through hyperlinks in each email message. Users can also contact us and request removal from a mailing list.
- Lodging A Complaint– Should you have a complaint or have a query about personal data held by us about you, please submit a request through our secure contact form. There will be a requirement to authenticate your identity in order to process a request.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
- Data protection officer – We have not appointed a single data protection officer (DPO). If you have any questions about this privacy notice or how we handle your personal information, please contact frontdoor[at]wavellroom.com or through our secure contact form.
- Consent– Acceptance of this privacy notice confers consent. We’ve kept this as short and simple as possible to ensure consent is clearly conferred.
Whilst Wavell Room is a ‘data controller’ we use various services to communicate internally, externally and to manage data that we require to do so to provide the services that Wavell Room offers. Some of the services that we use are to be known as ‘data processors’. The following services are used by us and as such, use the following ‘data processors’
- Amazon Web Services. AWS provide data processor facilities such as the infrastructure for hosting the content on this website.
- Google Cloud / Workspace / Analytics. Google is used for our business applications and analytics. Google cloud workspace and analytics are GDPR compliant and as such process your personal data, that we control under the legislation that protects you. Google’s policies can be found at this link (https://cloud.google.com/security/gdpr/resource-center/contracts-and-terms)
- ActiveCampaign. These are used for the management of bulk email and the transmission of transactional emails and messaging. They are both a data controller and processor. Their privacy terms can be founder here (https://www.activecampaign.com/legal/privacy-policy)
- Stripe. Stripe are the data controller and processor for financial transactions made in connection with Wavell Room. You can find their full privacy policy here (https://stripe.com/gb/privacy)
Ultimately, Wavell Room wants to protect your personal data as best as we can afford to do so and will seek to resolve any concern you may have with the control and processing of your personal data. Please just get in touch with us.