Privacy Notice

We are St Catherine’s Village Hall Limited, a company registered in England and Wales under company number 4558993 and registered charity number 1095139.

Registered address: St Catherine’s Village Hall Limited, St Catherines Village Hall, Chestnut Avenue, Guildford, Surrey GU2 4HF

We manage St Catherine’s Village Hall in Guildford.

You can find more about how to contact us in Section 9 below.

During our dealings with you, we will collect and process personal data about you. Personal data is any information from which you can be identified either directly or indirectly. Typically, this means your name or email address etc. but also includes descriptions or a photograph.

We are committed to protecting your privacy. We will use your personal data in accordance with all applicable laws and regulations that relate to data protection and privacy, including the EU or UK General Data Protection Regulation (GDPR) as appropriate for your nationality.

St Catherine’s Village Hall Limited is the controller for any personal data we collect unless we indicate otherwise.

This notice tells you:

• what personal information we collect;

• why we collect this information;

• how we will use it;

• how long we will keep it;

• who else will see it;

• how you can contact us;

• your rights in relation to the personal information that we hold, including your rights to change, delete and see your information.

When using our website, we will also place cookies on your device - please see our Cookies page for more information about the cookies we use and how you can change your cookie settings.

We collect the following types of information from you:

Information we collect when you enquire about availability:

• your name;

• your telephone number;

• your email address;

• some description of your planned event.

Information we collect when you make a booking:

• your name;

• your telephone number;

• your email address;

• some description of your planned event;

• your postal address;

• if you pay us by cheque, we will have access to your bank sort code and account number whilst we remain in possession of your cheque;

• if we have reason to make payment to you, we will ask for your bank details and may store them;

• your signature;

• the names, signatures and, sometimes, telephone numbers for anyone else that you wish to be able to supervise your event;

• the name and address of any other person to which invoices to your organisation should be sent.

If you are providing information about another individual, you should ensure that you have their consent to do so and inform them of this Privacy Notice.

Information we collect if you are a supplier or potential supplier to us:

• the name, address and bank details for payments to your organisation;

• the name and contact details for organisation members as required for the supply.

Information we collect if there is an accident in the hall:

• the name, address and occupation of the person affected/injured;

• the name, address and occupation of the person reporting the incident;

• a description of the incident including the cause and nature of any injury.

Information we collect if you submit a contact form on our website:

• your name;

• your email address;

• your message contents.

Information we collect about how you use our website:

• The data processor running our website will have maintenance log information about your IP address from which you connected along with some information about pages visited. We do not have access to this information.

• We do not gather any analytics data about use of our site pages.

Information we collect when you use our hall Wi-Fi.

• The MAC address of your device’s network adapter is stored temporarily within our Wi-Fi system.

We need your contact details in order to manage hall lettings and to manage the supply of services and goods to the hall. We do not use your information for marketing purposes.

The MAC address of your connecting device is required when you use our Wi-Fi to enable us to provide the service.

You do not have to give us any information or permission in order to use our website.

Our website is not intended for children and we do not knowingly collect data relating to children.

The purposes for which we use your information and the legal basis under data protection laws on which we rely to do this are as follows:

(i) Contract: It is necessary for the performance of a contract with you or to take steps to enter it. This applies to:

• enquiries before making a booking;

• any hall booking;

• car park space letting;

• your use of our Wi-Fi system;

• any supply to the hall of goods or services.

(ii) Legitimate interest: We process data because it is in our legitimate interests to do so including:

• to identify you when you contact us and to correspond and communicate with you;

(iii) Legal obligation: We are obliged to process your personal data to comply with the law.

(iv) Consent: You have specifically agreed to allow us to process your personal information.

• If you use our form to send a message to the organiser of one of our groups, you will be required to agree that you allow us to pass your message and email address to that person.

We are required by law to keep your personal information only for as long as is necessary for the purposes for which we are using it. The period for which we keep your personal information will be determined by a number of criteria, including the purposes for which we are using the information, the amount and sensitivity of the information, the potential risk from any unauthorised use or disclosure of the information, and our legal and regulatory obligations.

We may disclose your personal information to third parties, including in the following circumstances:

• We may pass personal information to our insurers if a claim is made or could be made against us.

• We may pass your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation (including in connection with a court order), or in order to enforce or apply any agreements we have with or otherwise concerning you; or to protect our rights, property or safety or those of our users, suppliers or other third parties.

• If we make an electronic payment to you, we will share your bank details with our bank. Our bank becomes the controller for your data and becomes subject to their Privacy Notice.

• Where your information is relevant to our accounts it may be passed to our accountants on documents supplied to them, so they can assess our accounts. They will not use your information for any other purpose. The accountants become the controller for this data and publish their own Privacy Notice.

Please note that third party websites and applications are not under our control. When you click through to these websites or access these applications you leave the area controlled by us. We do not accept responsibility or liability for any issues arising in connection with the third party's use of your data (including your personal information).

Processors

We use two processors to provide technical services to us. We use Microsoft for the main operation but Google for the website. Our agreements with both include the EU model contract which ensures that they keep your data confidential. Our Microsoft contract requires them to keep all the data in the UK. The Google agreement allows them to copy data abroad under conditions approved by the EU. Your data will only be within the Google system if you entered it through our website, and it will be removed from that location after a few weeks.

The law provides the following rights for individuals:

• The right to be informed. This is what this privacy notice sets out to do.

• The right of access. You have the right to ask for a copy of the information that we hold about you. There may be legal restrictions on what information we can provide.

• The right to rectification. We will correct any personal information that is inaccurate.

• The right to erasure. We will remove your personal information where there is no good reason for us to continue to hold that data. This includes the right to withdraw consent if that was the legal basis for holding some data.

• The right to restrict processing. You can ask us to stop our normal processing of your data. For instance, you might want us to keep our data about you longer than normal because you want to use it for a legal case.

• The right to data portability. You can ask us to export your personal information in an electronic form, so it can be used by another data processor. This right is restricted if the data is not held for a contract or on the basis of your consent.

• The right to object. If you are unhappy about the way we have handled your personal data, you have the right to complain to the Information Commissioner’s Office. You can make a complaint to the ICO by visiting https://ico.org.uk/make-a-complaint.

• Rights in relation to automated decision making and profiling. We do not use any automated decision making or profiling systems, so these rights are not relevant.

Before we can disclose your personal information to you, we will need you to provide us with proof of your identity.

If you have any questions, comments, concerns, grievances, or complaints about this privacy notice or the way we treat your personal data, or if you want to request any information about your personal data or believe that we are holding incorrect personal data on you, please contact us either:

• by email to dataprivacy@stcatherinesvillagehall.org.uk or;

• by writing to Data Privacy, St Catherine’s Village Hall Limited, St Catherines Village Hall, Chestnut Avenue, Guildford, Surrey GU2 4HF.

We may update this notice from time to time. The latest version of this notice will be posted on our website.