We are committed to safeguarding the privacy of our website visitors, prospective customers, customers and suppliers; in this policy we explain how we will handle your personal data.
Credit: This document was created using a template from SEQ Legal (http://www.seqlegal.com).
1 – What personal data we collect and how
Visiting this website (automatically collected):
We log the IP address, geographical location, browser type / version and operating system as well as a timestamp on our server log.
Our security software (third party provider) automatically collects search queries and the date and time of the request and referral URL. Depending on the settings of the device, it also automatically collects: IP address; MAC address; Device make, model and operating system version; mobile network information; internet service provider; browser type and language; country and time zone in which the Device is located; and metadata stored on the Device.
Personal data we obtain from you may include (via enquiry form, phone call, post or in person):
Name, telephone number, email address, address and postcode, signature, arrival / departure dates, make / model of the caravan or motorhome and pitch type
We use CCTV cameras on the premises in risk areas to capture video footage.
If you send us an email, the email will contain meta data (this may include name, email address along with a time stamp) and any other information you choose to share with us. It is your responsibility to make sure that your email and attachments are virus free and sent from a reputable provider.
Your telephone number will get logged on our device if you call us (unless you withheld your number). You may also choose to leave a voicemail. All call logs and voicemails are routinely deleted.
Third Party Directory Listing Website:
We have listings on some caravan / holiday park directory listing websites. The typical information that gets passed by email to us if you fill in one of their enquiry / booking forms might be; name, telephone number, email address, arrival / departure dates, pitch type and any other information you submit.
2 – How we use your personal data
2.1 We process data when you use our website (“usage data”). The source of the usage data is our website security provider and may include search queries and the date and time of the request and referral URL. Depending on the settings of the device, it also automatically collects: IP address; MAC address; Device make, model and operating system version; mobile network information; internet service provider; browser type and language; country and time zone in which the Device is located; and metadata stored on the Device. This usage data may be processed for the purposes of helping to secure our website. The legal basis for this processing is our legitimate interests, namely monitoring and protecting our website.
2.2 We process CCTV footage on key areas of our premises (“CCTV data”). The CCTV data may capture video footage such as of you or family members and car registrations when on our premises. The CCTV data is processed for the purposes of securing our premises and to detect criminal activity. The legal basis for this processing is our legitimate interests, namely to help protect and safeguard our premises.
2.3 We may process your prospect / customer account data (“account data”). The account data may include name, address, telephone number(s) and email address(es). The account data may be processed for the purposes of providing services/products, general administration, managing the account, contacting you if you are on a cancellation or waiting list for any service we provide, recovering or collecting overdue payments, ensuring the security of our services, maintaining backups of our databases, workflow management of our diary and communicating with you. The legal basis for this processing is our legitimate interests, namely the proper administration of our business and recovering debts owed to us.
2.4 We may process information relating to transactions, including purchases of services/products, that you enter into with us (“transaction data”). The transaction data may be processed for the purpose of supplying the purchased services/products and keeping proper records of those transactions. The legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract and our legitimate interests, namely our interest in the proper administration of our business.
2.5 We may process information that you provide to us for the purpose of updating you on changes to our business, products or services (“notification data”). The legal basis for this processing is our legitimate interests, namely the proper administration of our business and communications with customers.
2.6 We may process information that you provide to us in the course of a booking with us, for the purpose of sending postal marketing to previous and existing customers such as caravan rally secretaries (“marketing data”). The legal basis for this processing is our legitimate interest, namely our interest in marketing and growing our business to a relevant audience.
2.7 We may process supplier account data which may include name(s), business name, address, telephone number, email address and BACS details (“supplier data”). The supplier data may be processed so that we can purchase products/services from suppliers. The legal basis for this processing is our legitimate interests, namely to fulfil our contractual obligations and communicate with suppliers.
2.8 We may process information contained in or relating to any communication that you send to us by email, post, voicemail or any similar communications (“message data”). The message data may include the communication content and metadata associated with the communication. Our website will generate the metadata associated with communications made using the contact forms. The message data may be processed for the purposes of communicating with you (including where appropriate sending you sales or marketing materials), following up on communications and record keeping. The legal basis for this processing is our legitimate interests, namely the proper administration of our business and communications with suppliers, prospective customers and customers.
2.9 We may process any of your personal data identified in the other provisions of this policy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.
2.10 In addition to the specific purposes, we may also process any of your personal data where such processing is necessary for compliance with a legal obligation to which we are subject (for example: HMRC tax reporting), or in order to protect your vital interests or the vital interests of another natural person.
3 – If we don’t have your personal data….
Providing us with your personal data for the purposes above is a contractual requirement, as such you are obliged to provide this information.
It is your choice on whether to provide personal data, but if you decide you don’t want to provide us with your personal data, in turn we may not be able to provide more information or enter into a contract with you to provide goods and / or services.
4 – Providing your personal data to third parties
We do not authorise any third parties to access our emails without our permission.
Professional advisers or insurance:
We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes.
We may disclose personal data including name, address, email address, telephone number and invoice data to our accountant who’s acting on our behalf, insofar as reasonably necessary for completing our accounts and tax reporting obligations to HMRC.
Security Software Provider (for our website):
We disclose to our security software provider data automatically collected when using our website for the purposes of security. It automatically collects search queries and the date and time of the request and referral URL. Depending on the settings of the device, it also automatically collects: IP address; MAC address; Device make, model and operating system version; mobile network information; internet service provider; browser type and language; country and time zone in which the Device is located; and metadata stored on the Device.
Suppliers or subcontractors:
We may disclose personal data including name, address, email address, and telephone number to our suppliers or subcontractors insofar as reasonably necessary for providing a service or product on our behalf. The supplier or subcontractor is only permitted to use your data to perform the required business function necessary in providing the service or product on our behalf.
Police forces or courts of law:
We may show and / or share personal data and / or CCTV footage to the police or courts of law when / if required for the purposes of detecting criminal activity and law enforcement.
In addition to the specific disclosures of personal data set out in Section 3, we may also disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
5 – International transfers of your personal data
In this Section, we provide information about the circumstances in which your personal data may be transferred to countries outside the European Economic Area (EEA).
The hosting facilities for our website and emails are situated in United Kingdom. We have a data processing agreement in place with our third party service provider.
Our website security provider is situated in the USA. Transfers to this country will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission.
For suppliers or third party service providers that are situated in the United Kingdom or EU. The European Commission has made an “adequacy decision” with respect to the data protection laws of each of these countries. We have a data processing agreement in place with our suppliers or third party service providers.
6 – Retaining and deleting personal data
Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
Usage data is removed from our server log within 24 hours, but used and retained by our website security provider for as long as required
Message data will be retained for up to 24 months.
Account data, transaction data and supplier data – will be kept for 7 years for tax purposes
CCTV data is overwritten automatically by the system – it is kept for approximately 17-20 days, unless we require the footage for criminal proceedings in which case we will retain it for as long as required
7 – Security
We use an SSL (secure socket layer) certificate on our website (you can see this by the “green padlock” in your browser). This encrypts the link between the website server and the end user.
Our emails and enquiry form are sent using SSL connection over SMTP. However emails cannot be 100% secure, this is due to the way the internet works. We cannot accept responsibility as it’s out of our control.
We have put in place suitable technical and physical measures for any systems we use where personal data is present.
8 – Amendments to this policy
We may update this policy from time to time by publishing a new version on our website. You should check this page occasionally to ensure you are happy with any changes to this policy.
9 – Your rights
In this Section 9, we have summarised the rights that you have under data protection law.
The right to access your personal data:
You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee.
The right to rectification:
You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.
The right to erasure:
In some circumstances you have the right to the erasure of your personal data without undue delay. However, there are certain general exclusions of the right to erasure. Those general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.
The right to restrict processing:
In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful but you oppose erasure; we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.
The right to object to processing:
You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
The right to data portability:
To the extent that the legal basis for our processing of your personal data is consent or for the performance of a contract (or taking steps to enter into a contract), and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.
The right to complain to a supervisory authority:
If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority. In the UK it is the Information Commissioners Office – https://ico.org.uk/ who are responsible for data protection enforcement.
You may exercise any of your rights in relation to your personal data by written notice to us – either by our mailing address or emailing email@example.com
10 – Cookies
11 – Our details
This website is owned and operated by Steve Jones T/A Orchard Holiday Park.
You can contact our data representative, using the following details;
Mail address: Orchard Holiday Park, New House Farm, St Michaels, Tenbury Wells, Worcestershire. WR15 8TW
Phone number: 01568 750618
Email address: firstname.lastname@example.org
Data controller registration no.: ZA286619