Please see below our Privacy Notice. For the time-crunched users, a summary of the points is :
- we do collect and store some data about you.
- we don't sell it.
- we do share it, only with your permission, with academic institutions doing research on smell loss.
- where possible, any shared data is anonymised so that you are not recognisable from the data.
- we don't allow advertising on the site.
- we do use Google Analytics which does collect your use data.
- if you are purchasing products from the site, your financial information will be pass to the third party financial transaction provider (such as Worldpay) and we only receive minimal data from them so that we can find your order and confirm it has been paid. We also share your name and address with our delivery partner so they can deliver your purchases to you.
- you have various rights in respect of your data and full information can be found below.
- if you have any enquiries about your personal data please contact us on the details found below.
Please read our entire Privacy Notice below for a more detailed and accurate description of the points above.
INTRODUCTION AND DEFINITIONS
AbScent ("we", "our" and "us") is committed to protecting and respecting your privacy.
References in this Notice to "data protection law" mean (as applicable) the General Data Protection Regulation (Regulation (EU) 2016/679) and all related data protection legislation having effect in the United Kingdom from time to time (including the Data Protection Act 2018).
References in this Notice to "data or "information" include "sensitive personal data" and "special categories of data" (as defined under data protection law) where applicable.
For the purpose of this Privacy Notice, the word 'processing' or 'process' means anything that we can do with your data. This includes, but is not necessarily limited to collecting, storing and sharing with third parties (see below). We give you detailed information on this below, just keep reading.
The data controller with conduct of your personal information is AbScent, a charity registered in England and Wales under charity number 1183468 at 14 London Street, Andover, Hampshire SP10 2PA. Our company number is 11523615.
We are not required to have a data protection officer, but if you have any queries about your personal data please contact firstname.lastname@example.org.
How we use your information
The following sections explain what information we hold about you, why we are processing that information, the legal bases for the processing, the duration for which we keep your information and (if applicable) who your information will be shared with and where those recipients are based.
Which information do we process and for what purpose?
We process the following information from you:
Information you give us.
This is information about you that you give us by filling in forms on our websites, emailing us, writing to us or speaking to us by phone or in person. The information you give us may include your name, address, email address, phone number, date of birth, gender, personal description and photograph.
Information you give us might also include "special categories" of more sensitive personal information. This could include information about your health, including information relating to your smell loss or that of a family member.
We process information you give to us for the following purposes:
to enable you to benefit from the support and information available from AbScent either directly or on our website;
to enable you to take part in the Sense of Smell Project and enable further research by ourselves and our partners, into smell loss;
to supply you with the goods and/or services you have purchased/requested from us;
to publish on your story on our site, social media and elsewhere. We will only do this with your consent and we will anonymise your personal data;
to manage your account with us;
where you have consented to receive information materials, to send you are newsletter and information sheets, to keep in touch with you and tell you about events, goods and services that we offer. Remember, you can unsubscribe at any time by contacting email@example.com; and
to notify you about changes to our service.
Information we collect about you.
Like most other website operators, we use Google Analytics to collect information of the sort that web browsers and servers typically make available. This includes technical information, such as your IP address and your login information and information about your visit, such as records of how you navigate the pages on our site and how you interact with the pages.
We process information we collect about you for the following purposes:
to allow us to administer the account you hold with us and/or your membership if you become a member;
to improve our services;
to comply with our regulatory and legal obligations to process and keep a record of your data;
to ensure that content from our site is presented in the most effective manner for you and for your device; and
to measure or understand the effectiveness of advertising we serve to you and others, and possibly to deliver relevant advertising to you on our site.
Information obtained from or provided by third parties.
We process information we obtain from or are provided by third parties for the following purposes:
where you purchase goods/services from our website, the financial transaction will be dealt with a third party payment provider. We are provided with the last four digits of your card number which we will use for identification purposes should there be any issue with the transaction. Please check the terms and conditions and Privacy Notice of the third party payment provider if you have any questions.
What are the grounds for processing your information?
We are processing your data on the following grounds:
where you have specifically consented to the processing of your special category data for the purposes of participating in the Sense of Smell Project;
where you are purchasing products from our online shop or we are otherwise providing services to you - the processing is necessary for the performance of the contract between you and us. This includes where you have instructed us to take some pre-contractual steps prior to us formalising the contract;
the processing is necessary for us to comply with our legal obligations and tax or other financial regulations;
the processing is necessary for achieving our legitimate interest of conducting research into the long term effects of smell loss. In accordance with data protection law, we have carefully weighed your interests and fundamental rights and freedoms against our interest to process your information and are satisfied that we are justified in processing your information for this purpose;
the processing is carried out in the course of our legitimate activities with appropriate safeguards as a charitable association with a philosophical aim on the condition that:
the processing relates solely to our members, to former members or to persons who have regular contact with us in connection with our purposes; and
the personal data is not disclosed to third parties without your consent;
processing is necessary for the establishment, exercise or defence of legal claims;
Duration and further processing
We only keep your information for so long as it is reasonably necessary. When setting our data retention periods, we consider the amount, nature, and sensitivity of the information we hold, the potential risk of harm from unauthorised use or disclosure of the information and the purposes for which we process the information (including whether we can achieve those purposes by other means). We also take into account our other legal obligations to keep or securely dispose of personal information.
Generally speaking, we retain your information for the following periods of time:
For members - whilst your membership is active and for 6 years thereafter;
For non-members - for 6 years after your last login.
If we need to keep your information for a longer period then we will notify you of the reason and grounds for doing so. We will regularly review the duration of these longer periods of retention.
Who is your information shared with?
Except as set out in the next paragraph, your personal information is not shared with anyone except where we are required to do so to comply with the law, to protect our rights, to improve and expand our products and services or to effectively operate our charitable purposes and business.
We may share anonymised, pseudonymised and non-personal information with sub-contractors engaged by us to help us operate our site and to analytics and search engine providers that assist us in the improvement and optimisation of our site.
We may share your information with the following people or group of people:
Our Partners - third party academic and/or research institutions who are actively participating in the Sense of Smell Project. At the time of release of this Privacy Notice, they are The University of Tennessee and The University of Dresden. As and when new partners come on board, we will update this list. Please refer back to this Privacy Notice at regular intervals. Typically, we will anonymise your personal data prior to sending to these partners.
Our delivery partners, who require your information to deliver the goods you purchase from us. Our delivery partners have a contractual duty to keep your information confidential.
Our outsourced IT providers and data consultants, who may have access to your personal information on our IT systems as part of the service they provide to us. Typically, your personal information will be encrypted before it is transferred to our hosts but in certain circumstances our service providers may require access to unencrypted personal information, for example when we need to troubleshoot a technical issue. Our IT providers and data consultants are subject to strict contractual obligations to treat your personal information with the utmost sensitivity, to keep it confidential and to comply with data protection law at all times.
Professional advisers, we may share personal information with our legal, financial and other professional advisers for the purpose of obtaining advice, such as legal advice. These transfers are protected by our advisers' duties of confidentiality.
Potential purchasers, we may share personal information with potential purchasers of our business, subject to those persons entering into strict confidentiality obligations with us and being only to the extent permissible under data protection law.
Marketing agencies - We use MailChimp as our marketing automation platform. You can access MailChimp's Privacy Notice here. We also use the ticketing and registrations platform, Eventbrite to organise our workshops and online training events. You will be transferred to their website to enter your details when making a booking. You can access their Privacy Notice here. Where the transfer involves your data being moved outside of the EEA, we do so under the protection of standard contractual clauses which are approved by the EU Commission.
The University of Tennessee is based outside of the EEA but we are authorised to transfer your information to them because a) we anonymise your personal data so that no living individual is identifiable and b) we do so under standard contractual clauses which are approved by the EU Commission. If you are participating in the Sense of Smell Project, you may have given consent to the transfer in the online consent form. If you require further information, please contact firstname.lastname@example.org.
We do not make automated decisions about you based on your information. If this changes then we will let you know
Under data protection law you have the following rights:
With regard to the Sense of Smell Project, if we are processing your personal information on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by notifying us in writing. The lawfulness of our historic processing based on your consent will not be retrospectively affected by your withdrawal of consent;
the right to access a copy of your information which we hold. This is called a 'subject access request'. Additional details on how to exercise this right are set out in section 5, below;
the right to prevent us processing your information for direct marketing purposes. You can exercise your right to prevent such processing by leaving unchecked certain boxes on the consent forms we use to collect your data. You can also exercise the right at any time by writing to email@example.com;
the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing;
the right to object to us processing your personal information in certain other situations;
the right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate;
the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law; and
the right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.
You also have the general right to complain to us (in the first instance) and to the Information Commissioner's Office (if you are not satisfied by our response) if you have any concerns about how we hold and process your information. Our contact details are set out in section 9, below. The Information Commissioner's Office website is www.ico.org.uk.
For further information on your rights under data protection law and how to exercise them, you can contact Citizens Advice Bureau (www.citizensadvice.org.uk) or the Information Commissioner's Office (www.ico.org.uk).
ACCESS TO INFORMATION
Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. You must send us proof of your identity, or proof of authority if making the request on behalf of someone else, before we can supply the information to you. Requests should be sent to us using the contact details in section 9 below.
You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are entitled to refuse to comply with your request if it is particularly onerous.
In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form.
We will always store your digital information on secure servers. Unfortunately, however, the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of your information transmitted to our site or otherwise to our servers (such as by email). Any such transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Third party Sites
Our site may, from time to time, contain links to and from partners', advertisers', affiliates' and social network sites. If you follow a link to any of these websites, please note that these sites have their own privacy notices and that we do not accept any responsibility or liability for those notices. Please check their privacy notices before you submit any personal information to those websites as they may not be on the same terms as ours.
Changes to our Privacy Notice
This Notice was last updated in September 2020. Future changes we may make to our Privacy Notice will be uploaded to our website and if the change is significant we will send you the updated Notice by email. Please check back frequently to see any updates or changes to our Privacy Notice.
Questions, comments and requests regarding this Privacy Notice are welcomed and should be addressed to firstname.lastname@example.org.