Privacy notice

Draft: needs the owner's review before publishing

This notice was drafted from the site's current set-up and has not yet been checked by GPCS. Every item in [square brackets] must be completed, and the whole notice reviewed, before it goes live. If you are reading this on the public site, please treat it as provisional.

Who we are

Great Park Community Spaces Limited (“GPCS”, “we”, “us”) is a not-for-profit company limited by guarantee, registered in England and Wales. Company number [Company number]. Registered address: [Registered address].

We are the data controller for the personal data described in this notice. You can contact us about anything in it at [privacy contact email] or by post at the address above.

This notice covers this website, greatparkspaces.org.uk, and the enquiry form on it. It does not cover the separate booking system used at the centres we run, which has its own notice.

What we collect

When you send an enquiry through our contact form, we collect what you type into it:

your name
your email address
your organisation, if you give it
the type of organisation you are (charity or trust, developer, council or parish, housing provider, other)
the services you are interested in
anything you write in the free-text message about your site

When you visit the site, our hosting provider also processes technical information such as your IP address, browser type and the pages requested. This is standard for any website and is used only to serve the pages, keep the site secure and tell people from automated bots.

We do not ask for, and do not want, any special category data (for example health or ethnicity). Please do not include it in your message.

Why we collect it

We use the details from the enquiry form for one purpose: to reply to your enquiry and, if you ask us to, to arrange a visit and prepare a proposal.

Our lawful basis under UK GDPR is:

Legitimate interests (Article 6(1)(f)): responding to people who contact us about our services, which is what you would expect when you fill in a contact form.
Steps before a contract (Article 6(1)(b)): where your enquiry leads to a proposal or agreement between your organisation and GPCS.

We do not use your details for marketing, we do not add you to a mailing list, and we do not sell or rent personal data to anyone.

We use two service providers to run this website and receive enquiries. Each acts as our processor under a written agreement, and only handles data on our instructions.

Cloudflare, Inc. hosts the website and provides Turnstile, the bot protection on our form. Cloudflare processes the technical information described above, including your IP address, to deliver the site and to check that a form submission comes from a person.
Resend, Inc. delivers the email that carries your enquiry to us. The contents of your form submission pass through Resend's systems on the way to our inbox.

Beyond these providers, we only disclose personal data where the law requires it, for example to a regulator or under a court order.

Where it is processed

Cloudflare and Resend are US companies and may process data outside the United Kingdom. Where that happens, transfers are covered by the UK's International Data Transfer Agreement or Addendum, or by UK adequacy regulations, as set out in each provider's data processing terms. [Owner to confirm the transfer mechanism for each provider and link to their DPA.]

How long we keep it

We keep enquiry details for [retention period, e.g. 12 months] after our last contact with you, then delete them. If your enquiry leads to an agreement with your organisation, the relevant details become part of our records for that relationship and are kept for as long as that relationship, and any legal retention period, requires.

Cookies and tracking

This website sets no analytics or marketing cookies and uses no advertising or tracking tools.

Turnstile (Cloudflare's bot check on the enquiry form) may store a small amount of technical data in your browser while it runs. It is used only to tell people from bots and does not track you across other sites.
Fonts on this site are currently loaded from Google Fonts, which means your browser requests the font files from Google and Google receives your IP address as part of that request. [Owner to decide: self-host the fonts and remove this line, or keep it.]

Your rights

Under UK GDPR you have the right to:

ask for a copy of the personal data we hold about you
ask us to correct anything that is wrong
ask us to delete your data
ask us to restrict how we use it
object to our processing where we rely on legitimate interests
receive the data you gave us in a portable format

To exercise any of these, email [privacy contact email]. We respond within one month, and we do not charge for a request unless it is clearly unfounded or excessive.

How to complain

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

Online: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Our ICO registration number is [ICO registration number, or delete this line if not required to register].

Changes to this notice

We will update this page if what we collect, or how we use it, changes. The date at the top of the page shows when it was last reviewed.