This policy describes how and why Dulas Ltd uses your personal information, how we protect your privacy when doing so, and your rights and choices regarding this information. We are committed to protecting any personal information you share with us. We aim to be clear when we collect your information about what we will do with it.
This policy is effective from 25th May 2018.
Who we are
We collect information in the following ways:
Information you provide to us directly
You may give us your information in order to sign up for digital communications from us, when you meet us at an event, purchase our products and services, or otherwise communicate with us.
In addition, in accordance with common website practice, we will receive information about the type of device you’re using to access our website or apps and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you’re using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.
Information you provide to us indirectly
Your information may be shared with us by third parties, for example:
If you appear on an event delegate list and allowed your name to be passed on.
We also may receive data about you from subcontractors acting on our behalf who provide us with technical, payment or delivery services, and from business partners, advertising networks and search/analytics providers used on our website.
Information from other sources
We also use information from the following sources:
Depending on your settings or the privacy policies for social media and messaging services like Facebook, LinkedIn and Twitter, you might give us permission to access information from those services, for example when you publicly tag us in an event photo.
Information available publicly
We supplement information on our potential customers with information from publicly available sources such as corporate websites, public social media accounts, and public sector and trade portals or directories.
We collect, store and use the following kinds of personal information:
Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of sensitive data would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information.
We only collect this type of information about job applicants to the extent that there is a clear reason for us to do so, for example asking for information regarding disability for the purpose of providing appropriate facilities or support at interview. We will also collect this type of information if you make it public or volunteer it to us.
Wherever it is practical for us to do so, we will make why we are collecting this type of information clear and what it will be used for.
When you sign up with us for an online account, register to receive marketing communications from us, enter one of our competitions, fill in one of our forms (whether online or offline) or otherwise expressly provide us with your personal information, we may collect and store any personal information that you provide to us and may use it to personalise and improve your experience on our digital platforms, provide products and services you request from us, and carry out profiling and market research.
We will use your personal information to:
Our marketing communications include information about our latest products and services, events we are holding, our attendance at industry events, industry reports that we produce and future innovations. When you submit an enquiry via a contact form on our website we will present you with options relating to the type of content that you can opt to receive.
When you have asked for details of a Dulas event, we will send you information including, where relevant, content for the day and reminders on key information about the activity.
We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing. If you don’t want to hear from us, that’s fine, and you can change your preferences at any time. Just let us know when you provide your data or contact us on email@example.com If you decide you don’t want to receive marketing communications from Dulas we will still contact you regarding ongoing work we are undertaking for you as our customer.
Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK data protection legislation.
Consent is where we ask you if we can use your information in a certain way, and you agree to this (for example when we send you marketing material via post, phone, or e-mail). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.
Performance of a contract / take steps at your request to prepare for entry into a contract
We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are buying something from us (for instance some a product or service or, in some cases, a free of charge event place).
We have a basis to use your personal information where it is necessary for us to protect life or health. For instance if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services.
We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (provided that what the information is used for is fair and does not unduly impact your rights).
We consider our legitimate interests to include all of the day-to-day activities Dulas carries out with personal information. Some examples not mentioned under the other bases above where we are relying on legitimate interests are:
We only rely on legitimate interests where we consider that any potential impact on you (positive and negative), how intrusive it is from a privacy perspective and your rights under data protection laws do not override our (or others’) interests in us using your information in this way.
When we use sensitive personal information (please see the “What personal information we collect” section above), we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent or another route available to us at law for using this type of information (for example if you have made the information manifestly public, we need to process it for employment, social security or social protection law purposes, your vital interests, or, in some cases, if it is in the public interest for us to do so).
We ensure that there are appropriate technical and organisational controls (including physical, electronic and managerial measures) in place to protect your personal details. For example our online forms are always encrypted and our network is protected and routinely monitored.
As set out in the “Sending marketing communications” section above, we will never sell or rent your information to third parties for marketing purposes. However we may disclose your information to third parties in connection with the other purposes set out in this policy. These third parties may include:
Some of our suppliers run their operations outside the European Economic Area (EEA) - this may include a country which may not be subject to the same data protection laws as companies based in the UK. In these circumstances, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law, and appropriate safeguards are in place.
We reserve the right to disclose your personal information to third parties:
Keeping your information up to date
We may contact you from time to time to ensure your contact information and preferences are up to date.
We’re committed to putting you in control of your data and you’re free at any time to opt out from this activity. To find out more, please email firstname.lastname@example.org
We really appreciate it if you let us know if your contact details change.
Under UK data protection law, you have rights over personal information that we hold about you. We’ve summarised these below:
Right to access your personal information
You have a right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply.
If you want to access your information, send a description of the information you want to see by post to Data Protection,Dulas Ltd, Unit 1, Dyfi Eco Park, Machynlleth, Powys, SY20 8AX or by email to Data.Protection@dulas.org.uk
Right to have your inaccurate personal information corrected
You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.
Right to restrict use of your personal information
You have a right to ask us to restrict the processing of some or all of your personal information in the following situations: if some information we hold on you isn’t right; we’re not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.
Right to erasure of your personal information
You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done.
Right for your personal information to be portable
If we are processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format.
Right to object to the use of your personal information
If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible.
If you want to exercise any of the above rights, please contact us on Data Protection, Dulas Ltd, Unit 1 Dyfi Eco Park, Machynlleth or by email to Data.Protection@dulas.org.uk. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO (link is external)).
If you are unhappy with any aspect of how we are using your personal information we’d like to hear about it. We appreciate the opportunity this feedback gives us to learn and improve. You also have the right to lodge a complaint about any use of your information with the Information Commissioners Office (link is external), the UK data protection regulator.
If you have any questions, comments or suggestions, please let us know by contacting Data.Protection@dulas.org.uk or by phone on 01654 705000.
Dyfi Eco Park