Privacy Policy

Privacy Policy

General

Discover Boston will not use the personal information collected on this website for any purpose other than that specified. Discover Boston declares that all information will be treated confidentially and in accordance with the legal provisions concerning data protection. We are committed to safeguarding the privacy of our website visitors; this policy sets out how we will treat your personal information.

WHO ARE WE?

We are Discover Boston, a brand owned by Destination Lincolnshire Community Interest Company with its offices at Office BT1, The Terrace, Grantham Street, Lincoln, LN2 1BD. Among other things, we own and operate the following website:

https://www.boston-england.co.uk

If you have any questions about this Policy, or about how we look after your data generally, please contact hello@destinationlincolnshire.co.uk. Please note that use of our website is subject to our Website Terms.

This Policy is supplemental to our Cookies Policy.

INTRODUCTION

Discover Boston (‘we’ or ‘us’ etc), is a ‘controller’ of data. This means that, under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), we may control and process your personal data in connection with any personal information collected or received by us arising from your use of any of our products, services, applications, websites (including any e-commerce stores) and customer support communications.

We take privacy very seriously. We are committed to keeping your data secure and processing it fairly and lawfully. We ask that you read this policy very carefully because it contains important information about how we process your personal data.

This Policy explains the types of information that we may collect and hold, how that information is used and with whom the data is shared. It also sets out how you can contact us if you have any queries or concerns about this information. It is aimed at our staff, officers, volunteers, contractors, beneficiaries and any other third parties interacting with us.

We reserve the right to make changes to this Policy at any time and we may notify you of changes to this policy by posting an updated version of this policy on our website. Your continued use of our products, applications, services and websites that are subject to this Policy will signify your acceptance of any and all changes to this Policy made by us from time to time and you should check this page occasionally to ensure you are happy with any changes to this Policy.

KEEPING US INFORMED

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

PERSONAL DATA WE MAY COLLECT ABOUT YOU

Personal information means any information about you from which you can be identified, but it does not include information where your identity has been removed (‘anonymous data’).

As the ‘controller’ of personal information, we are responsible for how that data is managed. The GDPR and the DPA set out our obligations to you and your rights in respect of how we manage your personal information.

As the ‘controller’ of your personal information, we will ensure that the personal information we hold about you is:

1. used lawfully, fairly and in a transparent way.
2. collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. relevant to the purposes we have told you about and limited only to those purposes.
4. accurate and kept up to date.
5. kept only as long as necessary for the purposes we have told you about.
6. kept securely.

INFORMATION COLLECTED BY US:

We may collect, use, store and transfer information about you in several different ways and this information may be classified in different categories. Please take care when submitting information to us. Only provide us with information that you are happy for us to process in accordance with this Policy, particularly with regard to confidential or sensitive information.

In the course of providing our services, the following types of data may be collected from you:

• Identity Data includes first name, last name, username or similar identifier, title, date of birth and gender.
• Contact Data includes postal address, billing address, delivery address, email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Enquiry Data includes data you provided us with when you contact us with an enquiry. This may be through our website, using our customer services assistance, emailing us, calling us or making contact with us at a trade show or other event.
• Usage Data includes information about how you use our website and services, as well as the frequency and pattern of your service use.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

SOURCES OF DATA:

We may collect personal data about you when you make an enquiry with us; apply for a job; interact with our personnel; visit or use our website; enter a competition or promotion; give us feedback; or complete a form and submit it to us.

We may collect data about you from third parties and publicly available sources. For example, we may collect:

• Financial and Technical Data from analytics providers or search information providers
• Contact, Financial and Transactional Data from providers of technical, legal, accountancy, payment and delivery services and other specialist agencies
• Identity and Contact Data from Companies House, local sources such as the Lincolnshire Chamber of Commerce, Lincoln BIG etc and other publicly available sources
• Identity and Contact Data from social media if you (i) interact with any of our social network pages or applications; or (ii) you use one of our products or services that allow interaction with social networks, we may receive information relating to your social network accounts

REASONS WE COLLECT AND USE YOUR PERSONAL INFORMATION

When we process your personal information, for whatever reason, we rely on one or more of the following grounds within the GDPR, depending on the reason why we are processing the information:

• Article 6(1)(a) – processing is conducted with your consent to process personal data for specified purposes (‘Consent’)
• Article 6(1)(c) – processing is necessary for us to demonstrate compliance with our regulatory framework and the law (‘Compliance’)
• Article 6(1)(f) – to process your personal data in pursuit of legitimate interests (‘Legitimate Interests’)

We will only use your personal data to the extent permitted by the law. The following table sets out the types of data we may use, the reason we may use this data and the legal basis for doing so:

MARKETING AND OPTING OUT

We will not contact you for the purposes of direct marketing unless you have asked us to do so. However, if you have asked us to do so and later your change your mind, you can opt-out at any time with no hassle. To do this, just let us know. See further 'Your rights' below for details about how to contact us.

WHO HAS ACCESS TO YOUR PERSONAL INFORMATION?

We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes. We may have to share your personal data with the third parties set out below:

Third Party Service Providers working on our behalf: We may pass your information to our third-party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf. However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes.

Our website provider: to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us.

Our professional advisors and agents for the purposes of advising and representing us in any matter connected with your account or your use of our website upon which we legitimately consider that advice or representation is needed. This may include managing risks, obtaining advice and representation, or services connected with legal proceedings.

Selected third party suppliers of goods and services as are identified on our website to which you have specifically consented to share your personal data with for the purposes set out in such consent or to fulfil our contractual obligations. Each such third party will act as a data controller in relation to the data that we supply to it. Upon contacting you, each such third party will supply to you a copy of its own privacy policy, which will govern that third party's use of your personal data.

Local Government and other stakeholders which includes our strategic partner Lincoln BIG and city, county and district authorities in Lincolnshire with whom we are working, although personal information will be anonymised and purely for analytical purposes.

In general, third parties who legitimately have access to your data under this Policy are operating inside the EU, but that is not always the case, particularly with regard to large corporations and analytical service providers.

THIRD PARTY LIABILITY

We are not liable for the actions and inactions of these third parties, and it is condition of your use of our website that you agree to the Website Terms, which limit and restrict our liability in certain defined circumstances. In particular, you agree that when third parties are the controller of data (such as third party suppliers of goods and services), then they are responsible for keeping your data safe once you have provided data to them. We have no control or responsibility over this.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

KEEPING YOUR DATA SECURE

Whilst we cannot guarantee that unauthorised access to your data will never occur, we will use reasonable technical and organisational measures to safeguard your personal data, for example:

• Access to our systems is controlled by password and username which are unique to the user;
• We store your electronic personal data on secure servers;
• We store your paper records in locked fire-proof storage rooms;
• Payment details are encrypted;
• We always limit access to data about you (for example, data is shared with staff on a need-to-know basis only);
• We vet third party suppliers where they supply services to us that might involve processing your data to ensure that they also have proper technical and organisational measures to safeguard your personal data;
• Where necessary, we enter into professionally drafted data sharing and data processing agreements with third parties that focus on safeguarding personal data and comply with the GDPR;
• We take advice from experts on the GDPR and the DPA where we need it;
• We train our staff in data protection and awareness and we have policies and procedures in place for dealing with the unlikely event of data breaches

We advise you to take great care over your personal data. Do not provide personal information about yourself or anybody else unless you are satisfied you are taking proper precautions first.

Non-sensitive details (your contact details and preferences for example) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

TRANSFERRING YOUR INFORMATION OUTSIDE OF EUROPE

We may store your data temporarily on our cloud service operated by Google. This may include limited special categories of data. We have taken appropriate steps to satisfy ourselves that your data will be secure during this process; we have a contractual relationship with Google that underpins this. As part of that security, Google may store your data in one or more or its international data centres, meaning that your data may be stored temporarily outside of the European Economic Area. If you have any concerns about this, please contact us using the details below.

INFORMATION ABOUT OTHER INDIVIDUALS

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can:

• Give consent on his/her behalf to the processing of his or her personal data
• Receive on his/her behalf any data protection notices

HOW LONG DO WE KEEP YOUR DATA FOR?

As a general rule, we will not keep your data for any longer than is necessary to complete tasks or provide you with services. Usually, this is up to six years, although general enquiry data is usually kept for a maximum of two years.

We have a separate policy setting out retention periods for specific types of data. You can ask to see this policy by writing to us, using the contact details under the “Your Rights” section below. You also have the right to ask us to delete your data (sometimes known as ‘the right to be forgotten’.)