General
Introduction
At Techniquest (“we”, “us”, “our”), we regularly collect and use personal data about consumers who visit us, use our services or browse our website.
Techniquest is committed to being transparent about how it handles personal information, protecting the privacy and security of that personal information, and to meeting its data protection obligations under the General Data Protection Regulation (the GDPR) and the Data Protection Act 2016.
Personal data is any information that can used to identify you as an individual. Protecting this information is very important to us, and we understand our responsibilities to handle your personal data with care, to keep it secure and to comply with legal requirements.
Techniquest has procedures in place to deal with any suspected security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of any suspected breach where we are legally required to do so.
The purpose of this privacy policy (“Policy”) is to provide a clear explanation of when, why and how we collect and use personal data. We have designed it to be as user-friendly as possible and have labelled certain sections to make it easy for you to find the information that is most relevant to you.
Please read this Policy carefully. It provides important information about how we use personal data and explains your legal rights. This Policy is not intended to override the terms of any contract that you have with us (for example through Friends or Membership terms) nor any rights you might have available under applicable data protection laws.
We will make changes to this Policy from time to time: for example, to keep it up-to-date or to comply with legal requirements or changes in the way we operate our business. We will make sure that you are aware of any significant changes by sending an email message to the email address you most recently provided to us or by posting a notice on the website so that you are aware of the impact to the data processing activities before you continue to engage.
We encourage you to regularly check back and review this policy so that you will always know what information we collect, how we use it, and who we share it with.
Policy last updated: 19 April 2023
Policy last reviewed: 19 April 2023
Data protection principles
Under the GDPR, there are six data protection principles that Techniquest must comply with. These provide that the personal information we hold must be:
- Processed lawfully, fairly and in a transparent manner.
- Collected only for legitimate purposes that have been clearly explained and not further processed in a way that is incompatible with those purposes.
- Adequate, relevant and limited to what is necessary in relation to these purposes.
- Accurate and, where necessary, kept up to date.
- Kept in a format which permits identification for no longer than is necessary for those purposes.
- Proceed in a way that ensures appropriate security of the data. Techniquest is responsible for, and must be able to demonstrate compliance, with these principles. This is called accountability
Your rights
You have a number of rights in relation to your personal data. In summary, these are as follows:
- You can ask us to access the information we hold on you at any time
- You have the right to rectify the information we hold
- You can ask us to completely remove your details from all of our systems
- You’re able to object to us using your information
- You can restrict how we use your information
- You have a right to data portability
Data Storage and Security
We take the utmost care of any personal data entrusted to us and adhere to strict technical, physical and organisational protocols.
Personal data used by Techniquest may be stored in one or more of the systems listed below:
- Microsoft Office 365: Techniquest’s central IT system
- DigiTickets: third-party ticketing provider. See the DigiTickets privacy policy. The system is only accessed by suitably trained Techniquest staff and is password-protected. There are also different levels of authorisation within the booking system to enhance protection of customer data.
- Mailchimp: third-party Customer Relationship Management system used for email delivery. See the Mailchimp privacy policy.
- Shopify: third-party provider of the online shopping platform. See the Shopify privacy policy.
- Enthuse: third-party fundraising platform. See the Enthuse privacy policy.
- Xero: Cloud-based finance management system. See the Xero privacy policy.
- BrightPay: Cloud-based payroll management system for employees. See the BrightPay privacy policy.
- xTag: Personal data supplied in order to access this resource is stored on the server at Techniquest
- SurveyMonkey: third-party provider for our electronic surveys. See the SurveyMonkey privacy policy.
- ApprovalMax: third-party accountancy software used to process orders from suppliers. See the ApprovalMax GDPR statement.
- Techniquest web server: hosting of Techniquest’s website
- Custom Computer Services Wales (CCSW) secure server: data collected in the course of offering Public Access Wi-Fi, stored for a maximum of 3 months
Technical security:
As a charity, we have achieved the Cyber Essentials accreditation. See more information about this certification.
Our IT providers, Custom Computer Services Wales (CCSW) provide a safe technical infrastructure by delivering:
- Managed firewalls to prevent unauthorised access
- Antivirus software to help prevent data loss by the use of malicious software
- Antimalware email filtering to help prevent the delivery of known malicious attachments
- Multi-factor authentication on VPN to increase security when connecting remotely
- Regular software updates to ensure the latest patches have been applied which ensure security and reliability
All staff are required to pass an online data protection course that complies with GDPR (2016) before handling any data at Techniquest. This training is renewed on an annual basis.
Team members working remotely dictates the use of company devices, which are encrypted and have firewalls installed, and which meet the company’s security requirements. Any privately owned devices which access company data meet the requirements of Techniquest’s Bring Your Own Device (BYOD) Policy.
Minors
Please note that we do not intentionally collect and store personal information from children. If you are the parent or guardian and believe your child has provided us with personal information in error, please contact us to request deletion.
Third Parties
We will never sell, rent or trade your data with third parties. Where we are required to share your personal data with any third parties, they are required to take appropriate technical and organisational security measures to protect your personal information and to treat it subject to a duty of confidentiality and in accordance with data protection law.
CCTV Monitoring
We monitor and record images using closed circuit television at Techniquest. This is done for the purposes of crime prevention and public safety. Data is stored on the systems’ hard drives and images are only accessible to Techniquest staff in secure locations within the building, or may be viewed remotely by senior staff members if required. Data is retained on the system for up to a maximum of 30 days.
Contact for complaints or concerns
The primary point of contact for all issues arising from this Policy, including requests to exercise data subject rights, is our Data Lead, Gareth McTiffin who can be contacted via [email protected].
Ticket sales & Marketing
What personal data do we collect?
From potential, historic and current customers and visitors (“consumers”) we collect the following data:
- Information that you provide by filling in forms on our website. This includes information given while subscribing to our E-newsletter or when contacting us. We will also ask you for information when you report a problem with our site
- Details of any concerns if you contact us with a query or issue.
- Information given when you complete a survey to tell us how your experience of Techniquest was and how we can improve (although you do not have to respond to them)
- When we take a photograph or make a recording that clearly features you
- Details of your visits to our website for our own billing purposes or otherwise, and the resources that you access.
- Details you provide when booking tickets, passes or memberships through the DigiTickets system, which is necessary for a booking to be made and to establish contact between ourselves and the client or customer
This may include the collection of details such as your:
- Full name / Business name / school name
- Address, including postcode
- Date of birth if applicable
- Contact telephone number, both landline and mobile if applicable
- Email address
- Payment details, for example where payment is taken directly over the phone (note that these details are fed directly into our bank’s payment portal and not retained on any systems within Techniquest)
- Engagement details, including your purchase history and Techniquest visit history
- Marketing preferences which may include interests and/or marketing list assignments
- Record of permissions or marketing objections
- Device data including, but not limited to: IP addresses and details about your browsing history in relation to the Techniquest website, browser, and session frequency. Please see our separate cookie policy for further details.
Who do we share your data with?
We will never sell, trade or rent your data to a third party, nor supply it to another company or organisation for their own marketing purposes.
We may however need to share your data with some third parties in order to fulfil our contract with you, to help manage our business and/or deliver services. These third parties may, from time to time need to have access to your personal data and include:
- Service providers, who help manage our IT and back office systems, and assist with our Customer Relationship Management activities: FlexRM Ltd and Microsoft Dynamics, Custom Computer Services Wales (CCSW) and Facebook.
- DigiTickets booking system: please read DigiTicket’s separate privacy policy
- Our regulators, which include the ICO, as well as other regulators and law enforcement agencies in the E.U. and around the world.
- Solicitors and other professional services firms (including our auditors).
- Our web development agency, Core.
- Our social media consultants, Seren Social Media
- Our printing agencies, which include but are not limited to Spectrum, Semaphore Display, KK Solutions and Lexon
Direct Marketing
We may use your personal data to send you direct marketing communications about our attraction or related services. This will be in the form of email or targeted online advertisements. Where we require explicit opt-in consent for direct marketing in accordance with the Privacy and Electronic Communications Regulations we will ask for your consent. Otherwise, for nonelectronic marketing or where we can rely on the soft opt-in exemption under the Privacy and Electronic Communications Regulations, we will be relying on our Legitimate Interests for the purposes of GDPR.
You have a right to stop receiving direct marketing at any time and you can do this either by following the opt-out (unsubscribe) links in electronic communications (such as emails), or by contacting us at [email protected].
Our marketing email delivery system is Mailchimp and their privacy policy can be reviewed here.
We may also use your personal data for customising or personalising advertisements, offers and content made available to you based on your visits to and/or usage of our attraction websites or other mobile applications, platforms or services, and analysing the performance of those advertisements, offers and content, as well as your interaction with them.
Photography & Videography
We may undertake photography, videography or other recording in Techniquest, either by our own team or an approved external partner. When this happens, there is a possibility that visitors may be captured in the background of photos or video footage.
In order to protect your rights, we will inform customers who have booked at least 48 hours in advance of their visit, via email that such filming or photography will be taking place and have clear, prominent signage at the main entrance notifying visitors. This will also inform visitors that if they do not wish to be photographed, they can request this at the entrance. We will ensure, in these instances, that the photography/videography will not include any visitors who have opted out.
Any close-up photos or videos including children will require consent forms to be signed by the parent or guardian.
Techniquest may choose to use these photos and video footage for marketing purposes, including use on social media, website inclusion, and for both print and digital advertising or editorial content.
Off-Peak Passes & Home Educator Memberships
Techniquest has an Off-Peak Pass and Home Educator scheme which allows visitors certain levels of access to the centre within a limited time period.
We process and take payments for these both online and at our front desk, Details collected would include name, address, postcode, email address, telephone number and a photograph of the customer to print on the card: this data is required in order to process these types of transaction.
This data is stored on our third-party point of sale system, DigiTickets, which is password-protected and can only be accessed by authorised staff. DigiTickets is installed on our secure Techniquest network and data is both sent and received from an offsite secure server. As with all DigiTickets transactions, this data is also then stored on our central database, utilising Microsoft Office 365.
How long do we keep your personal data?
We will retain your personal data for as long as is reasonably necessary to complete our contract with you and to enable suitable record-keeping, customer service and business processing to be fulfilled. In particular, where there has been no booking interaction from a consumer after seven years, the record will be anonymised on DigiTickets and Microsoft Dynamics and deleted from the Microsoft Dynamics database after 15 years. Anonymised records are retained for this period to enable accurate statistical analysis and good record-keeping to be maintained.
Where we are required to do so to meet legal, regulatory, tax or accounting requirements, we will retain your personal data for longer periods of time, but only where permitted to do so, including so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a possibility of legal action relating to your personal data or dealings.
We maintain a data retention policy which we apply to all records in our care. Where your personal data is no longer required and we do not have a legal requirement to retain it, we will ensure it is either securely deleted or stored in a way such that it is anonymised and the Personal Data is no longer used by the business.
Fundraising
Donors
By making an online donation to Techniquest you agree to have your information stored via a designated third-party processor, which is used to process the transaction.
Information captured will include, but may not be limited to: name, address, email, date of donation(s), amount(s) donated and marketing preferences. Techniquest does not hold, of have access to any sensitive financial information associated with the donation, such as the card of bank account details used to process payment as this is strictly handled by the designated third-party processor. We are not responsible for any data breaches which occur with any third-party processors but we will inform you of any breaches which involve your data as soon as we are made aware of such a situation occurring.
All donors have the option to remain anonymous, as well as to opt-in to receive marketing communications from Techniquest. Please refer to the Ticket Sales and Marketing section for further detail on this aspect of data usage.
Finance
The following information relates primarily to the collection and use of data within the Finance Department at Techniquest.
What types of personal information do we collect?
Techniquest collects, uses and processes a range of personal information from contractors and visitors depending on their interaction with us. This includes:
- contact details, including name, address, telephone number, and email address
- bank account details
How do we collect and use personal information?
Techniquest may collect personal information directly during the contracting process, and also from other external parties in the legal nature of due diligence.
This may be stored in different places, including in Techniquest’s cloud-based accounting System (Xero), cloud-based payroll system (BrightPay), Secure Finance Files, and electronically using Microsoft Office 365.
We will only use personal information when the law allows us to do so. These are known as the legal bases for processing. We will use personal information in one or more of the following circumstances:
- where we need to do so to perform the contract
- where we need to comply with a legal obligation
- where it is necessary for our legitimate interests (or those of a third party), and interests or fundamental rights and freedoms do not override our interests.
The purposes for which we are processing, or will process personal information, are to:
- comply with statutory and/or regulatory requirements and obligations, e.g. taxation
- administer the contract we have entered into
Who has access to this personal information?
Personal information will be processed by the Finance Department and the Contract holder (and is kept either directly in our Xero Accounting system &/or in a locked cabinets in access limited Finance Office) and may be shared internally within Techniquest, including with members of the Finance Department, line manager or other managers, and the Finance Director if access to the personal information is necessary for the performance of their roles.
Techniquest may also share personal information with third-party service providers (and their designated agents), including:
- external legal & taxation
- external auditors
Techniquest may also share personal information with other third parties in the context of a potential sale or restructuring of some or all of its business. In those circumstances, personal information will be subject to confidentiality undertakings.
We may also need to share personal information with a regulator or otherwise to comply with the law.
We may share personal information with third parties where it is necessary to administer the contract we have entered into, where we need to comply with a legal obligation, or where it is necessary for our legitimate interests (or those of a third party).
How does Techniquest protect personal information?
The Finance department will process the supplier information received in order to:
- Process contract payments.
- Providing the payment information via a secure banking portal to enable payment of monies due.
- Provide the taxation data to HMRC in terms of VAT, Gift Aid and payroll.
- Provide data to ensure legal requirements (audit etc)
Finance will normally undertake two Payment runs every calendar month processing approved contracted payments.
Techniquest also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and individuals of a suspected breach where we are legally required to do so.
For how long does Techniquest keep this personal information?
Techniquest will only retain personal information for as long as is necessary to fulfil the purposes for which it was collected and processed, including for the purposes of satisfying any legal tax, reporting or accounting requirements.
Techniquest will generally hold the supplier transaction & details records for six years after each relevant financial year end. Personal information which is no longer to be retained will be securely and effectively destroyed or permanently erased from our IT systems and we will also require third parties to destroy or erase such personal information where applicable.
Gift Aid
Techniquest may collect personal information in a variety of ways based upon either a given customer’s declaration for Gift Aid or a named donation.
It is collected during the declaration or donation process directly. The personal information may be stored in different places, including in Techniquest’s Finance System, Secure Finance Files, our third-party ticketing system (DigiTickets), electronically within our IT servers, and electronically with the HMRC Gift Aid portal (For Gift Aid only).
Personal information will be processed by the Finance Department (and is kept either directly in our in a locked cabinet with access limited Finance Office or within the HMRC Gift Aid portal) and may be shared internally within Techniquest with the front-of-house processing team and the Finance Director if access to your personal information is necessary for the performance of their roles.
The Finance department will process the Gift Aid and donation information received in order to:
- Process Gift Aid declarations.
- Provide data to ensure legal requirements (audit etc) Finance will normally undertake Gift Aid and Donations received every calendar month.
Recruitment
As part of any recruitment process, Techniquest collects and processes personal information, or personal data, relating to job applicants. This personal information may be held by Techniquest on paper or in electronic format. This privacy notice applies to all job applicants, whether they apply for a role directly or indirectly through an employment agency. It is non-contractual.
What types of personal information do we collect about you?
Personal information is any information about an individual from which that person can be directly or indirectly identified. It does not include anonymised data, ie where all identifying particulars have been removed. There are also ‘special categories’ of personal data, and personal information on criminal convictions and offences, which require a higher level of protection because it is of a more sensitive nature. The special categories comprise of information relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual orientation and genetic and biometric data.
Techniquest collects, uses and processes a range of personal information about you during the recruitment process. This includes:
- Your contact details including your name, address, telephone number and personal email address
- Personal information included in a CV, any application form, cover letter, monitoring sheets or interview notes
- References
- Information about your right to work in the UK and copies of proof of right to work documentation
- Copies of qualification certificates
- Copy of driving licence
- Other background check documentation
- Details of your skills, qualifications, experiences and work history with pervious employers
- Your professional memberships
Techniquest may also collect, use and process the following special categories of your personal information during the recruitment process:
- Whether or not you have a disability for which Techniquest needs to make a reasonable adjustment during the recruitment process
- Equality data
- Information about criminal convictions or offences
How do we collect your personal information?
Techniquest collects personal information about you during the recruitment process either directly from you or sometimes from a third party such as an employment agency. We may also collect personal information from other third parties, such as references from current or former employers, information from background check providers and criminal record checks from the Disclosure and Barring Service (DBS) on offer of employment.
Your personal information may be stored both digitally (using Microsoft Officer 365 suite) and in paper format.
Why and how do we use your personal information?
We will only use your personal information when the law allows us to. These are known as the legal bases for processing. We will use your personal information in one or more of the following circumstances:
- Where we need to do so to take steps prior to entering into a contract with you
- Where we need to comply with a legal obligation
- Where it is necessary for our legitimate interests (or those of a third party) and your interests or you fundamental rights and freedoms do not override our interests
We need these types of personal information primarily to enable us to take steps at your request to enter into a contract with you, and to enable us to comply with our legal obligations. Our legitimate interests include pursuing our business by employing employees, workers and contractors; managing the recruitment process; conducting due diligence on prospective staff and performing effective internal administration.
The purposes for which we are processing, or will process your personal information are to:
- Manage the recruitment process and assess your suitability for employment
- Decide to whom to offer a job
- Comply with statutory and/or regulatory requirements and obligations, e.g. checking your right to work in the UK
- Comply with the duty to make reasonable adjustments for disabled job applicants and with other disability discrimination obligations
- Ensure compliance with your statutory rights
- Ensure effective HT personnel management and business administration
- Monitor equal opportunities
- Enable us to establish, exercise or defend possible legal claims
Please note that we may process your personal information without your consent, in compliance with these rules, where this is required or permitted by law.
What if you fail to provide personal information?
You are under no statutory or contractual obligation to provide personal information to Techniquest during the recruitment process.
If you fail to provide certain personal information when requested, we may not be able to process your job application properly or at all, we may not be able to enter into a contract with you, or we may be prevented from complying with our legal obligations. You may also be unable to exercise your statutory rights.
Why and how do we use your sensitive personal information?
We only collect and use your sensitive personal information, which includes special categories of personal information and information about criminal convictions and offences, when the law additionally allows us to.
Some special categories of personal information, ie information about your health and information about criminal convictions and offences, is also processed so that we can perform or exercise our obligations or rights under employment law and in line with our data protection policy.
We may also process information about your health and information about any criminal convictions and offences where we have your explicit written consent. In this case, we will first provide you with full details of the personal information we would like and the reason we need it, so that you can properly consider whether you wish to consent or not. It is entirely your choice whether to consent. Your consent can be withdrawn at any time.
The purposes for which we are processing, or will process, health information and information about any convictions and offences are to:
- assess your suitability for employment or engagement
- comply with statutory and/or regulatory requirements and obligations eg carrying out criminal record checks
- comply with the duty to make reasonably adjustments for disabled job applicants and with other disability discrimination obligations
- ensure compliance with your statutory rights
- ascertain your fitness to work
- ensure effective HR, personnel management and business administration
- monitor equal opportunities
Where Techniquest processes other special categories of personal information, ie information about your racial or ethnic origin, religious or philosophical beliefs and sexual orientation, this done only for the purposes of equal opportunities monitoring in recruitment and in line with our data protection policy. Personal information that Techniquest uses for these purposes is anonymised. It is entirely your choice whether to provide such personal information.
We may also occasionally use your special categories of personal information, and information about any criminal convictions and offences, where it is needed for the establishment, exercise or defence of legal claims.
Change of Purpose
We will only use your personal information for the purposes for which we collect it, ie for the recruitment exercise for which you have applied.
However, if your job application is unsuccessful, Techniquest may wish to keep your personal information on file in case there are future suitable employment opportunities with us. We will ask for your consent before we keep you personal information on file for this purpose. Your consent can be withdrawn at any time. In any event, details from your application form will be retained for 3 months.
Who has access to your personal information?
Your personal information may be shared internally within Techniquest for the purposes of the recruitment exercise, including with members of the HR department, members of the recruitment team, and managers in the department which as the vacancy.
Techniquest will not share your personal information with third parties during the recruitment process unless your job application is successful, and we make you an offer of employment or engagement. At that stage, we may also share your personal information with third parties (and their designated agents) including:
- external organisations for the purposes of conducting pre-employment references and employment background checks
- the DBS, to obtain a criminal records check
- former employers, to obtain references
- professional advisors, such as lawyers
- pension providers
We may also need to share your personal information with a regulator or to otherwise comply with the law. We may share your personal information with third parties where it is necessary to take steps at your request to enter into a contract with you, where we need to comply with a legal obligation or where it is necessary for our legitimate interests (of those of a third party).
We only allow such third-party access to process your personal information for specified purposes and in accordance with our written instructions, and we do not allow them to use your personal information for their own purposes.
Data Retention
Techniquest will only retain your personal information for as long as is necessary to fulfil the purposes for which it was collected and processed.
If your application for employment or engagement is unsuccessful, Techniquest will generally retain your personal details for three months after the end of the relevant recruitment exercise but this is subject to: a) any minimum statutory or other legal, tax, health and safety, reporting or accounting requirements for particular data or records and b) the retention of some types of personal information for up to six years to protect against legal risk, eg if they could be relevant to a possible legal claim in a tribunal, County Court or High Court. If you have consented to Techniquest keeping your personal information on file in case of suitable employment opportunities arising in the future, Techniquest will hold your personal information for a further six months after the end of the relevant recruitment exercise, or until you withdraw your consent, whichever is earlier.
If your application is successful, personal information gathered during the recruitment process will be retained for the duration of your employment and up to one year thereafter, and in accordance with the privacy notice for employees, workers and contractors.
Personal information which is no longer to be retained will be securely and effectively destroyed or permanently erased from our IT systems: we will also require third parties to destroy or erase such personal information where applicable.
Automated decision-making
We do not envisage that any recruitment decisions will be taken about you based solely on automated decision-making, including profiling.
Education
Whilst dealing with the Education department at Techniquest, you may share personal information for a variety of reasons such as:
- to enable access to our Educational Services
- to attend CPD courses or other professional learning events for teachers
- to participate in the Nuffield Research Placement Programme
- to receive updates on our schools’ programme
This could include contact details of a named person within the school, college or university, as well as demographic information such as postcode and specific preferences or interests.
How we use your information
- To confirm arrangements in respect of participation in a programme, CPD activity or Nuffield Research Placement Programme
- To update you about any new programmes or services as they become available
We never sell, rent or trade email lists with other organisations or businesses.
We will normally collect and use personal information from you where the processing is in our legitimate interests and not overridden by your data-protection interests or fundamental rights and freedoms. Typically, as an Education Charity, our legitimate interests include providing our products and services, and for our marketing activities as they relate to educational delivery. In furtherance of this, we will contact teachers who we believe would wish to hear about and/or participate in Techniquest’s education programmes and CPD courses. Where we process your personal data for this aim, we do so with careful consideration of the impact on you and your rights under data protection law.
Techniquest has contracts with third parties to run programmes in Wales and has access to personal data collected by these third parties such as:
STEM Learning Ltd: the largest provider of education and careers support in science, technology, engineering and mathematics (STEM). Techniquest has the contract to deliver course for teachers in Wales. Data that is held centrally by STEM Learning Ltd is covered by its Privacy Policy — which also includes the Nuffield Research Placement Programme.
Techniquest will access and download personal information from STEM Learning Ltd databases in order to administer placements and courses. Access to this information will only be available to Techniquest’s:
- Head of Education
- Education Liaison Officer
All databases are password-protected.
Community Engagement
In the process of working with us on any community engagement process, we may collect personal data that enables us to facilitate the relevant project, and to communicate with you about any future projects that we believe would be of interest to you. Details may include name, address, email address, phone number, company name and specific areas of interest or community engagement type.
This data is stored as part of our central database management system on Microsoft Office 365 (Dynamics). We will retain this data indefinitely in order to ensure you are informed of any suitable projects that may be relevant to you. You may, of course, request to be removed from this database at any time.
Operations
Accident & Incident reporting
If there is an accident or incident here at Techniquest we must fill in an accident / incident form. This will include the following data: date, time of accident / incident, location, name of person affected, address, telephone, date of birth, signature (from a parent or guardian if it relates to someone under 16 years old), the name of any witnesses, the witnesses’ address and a description of what happened.
This form is completed by the first aider who administered any first aid or, if no first aid was required, straight after the incident by a member of the Techniquest team. If the accident / incident involves a school visitor, a copy is made and given to the teacher in charge.
The form is then given to the Operations Manager who checks over the area or equipment involved and any extra information is written up on the reverse of the form. Once this had been done, the form is passed to HR. The information is kept for 3 years to ensure accurate Health & Safety reporting and audits are completed satisfactorily.
Projects
The following information relates to specific aspects of collection and use of data in relation to Projects and Exhibits
Data retention
Techniquest will not collect personal data without having legitimate and relevant grounds for doing so. We will ensure transparency during data collection and provide individuals with an appropriate privacy notice when collecting their data which states our identity, provides information on how their data will be used and with whom their information may be shared.
Techniquest will collect your data in line with our GDPR strategy. Your data will be used to ensure that you, the client are kept informed about the services that we can provide and to contact you where necessary to ask for permission to share information about any projects you have commissioned with us.
You have the right to ask what information we currently hold on you and to have your information removed from our system as long as no active projects are currently commissioned between Techniquest and yourself.
In cases where an active project is in process, or where there is a legitimate business interest, your data will be stored until there is no longer a legitimate business interest, after which you can request your personal data be erased. Following the completion of a project your data will be held for a period of 10 years unless a request for removal is made.
Any personal data Techniquest may collect during business enquiries and transactions will be stored Techniquest’s Microsoft Office 365 platforms in accordance with Techniquest’s general privacy policy.
Exhibits Data Capture: The Island Saver Exhibit allows visitors, should they choose to sign up, to receive a photograph and email of their successful completion of the challenge. This data is stored temporarily on Techniquest’s Microsoft Office 365 platform in order to process the email, and is then automatically deleted after 24 hours.
Questionnaires
Where data is collected via paper questionnaires, this will input digitally within 7 working days of collection and stored securely and digitally on Techniquest’s Microsoft Office 365 platform. Following digital input, all paper copies will be destroyed in a secure manner.
Corporate Events
Enquiries
When an event enquiry is submitted, either via email or telephone, information regarding the potential event is recorded on an enquiry form along with some personal information. This information includes name, company, email, telephone number and postcode. This information is then transferred to an event management system to generate a quote. All paper enquiry forms are then securely disposed of immediately. Information from such enquiries will reside on our event management system indefinitely.
Event Confirmation
When an event is confirmed, an electronic file is produced to house the contract and all purchase orders relating to the event. Internal paperwork is completed before a contract is released to the client. This document includes the contact name, address, number and email address as well as the event package contents and cost breakdowns. This is stored in the electronic event file
Event Planning
During the planning process we liaise with our team of trusted partners to assist with our event delivery. These third-party suppliers include, but are not limited to, Epic Caterers (our catering supplier) and Orchard Media and Events (our AV supplier). Contact and event details will be passed to these third-party suppliers for organisational purposes. As the details for each event are confirmed, information will be added and stored on Techniquest’s central database and events management system, using Microsoft Office 365 (Dynamics)
Event Briefing
One week before and event takes place, the Event Manager will send and event sheet to Techniquest Management and any required third party to ensure the smooth operation of said event.
Attending Events
By confirming your attendance at an event hosted at Techniquest, you agree for us to store information on our central database and any associated third-party databases — such as the DigiTickets ticketing system — relating to your attendance and, in the case of fundraising event, any contributions that you make either to or at such events. This information may include, but is not limited to, your name, email address, postcode, phone and business address where applicable.
Techniquest may take photographs, film or otherwise record during the course of these events, subject to agreements being in place with the hirer concerned, to be used for future advertising and promotion either in print, online or via social media: your rights in connection to such image and/or voice capture can be found under the heading ‘Photography & Videography’.
Who else has access to your data you submit to the Events Team?
Third-party suppliers: We use a team of reliable, third-party suppliers to help deliver events at Techniquest. If your event requires catering or AV, then we will pass your details on to our selected suppliers for organisational purposes. Our appointed caterers are Epic Caterers and our appointed AV supplier is Orchard Media and Events. Other third-party suppliers, including photographers, event props and entertainment may also be passed your information if you book these elements through the Events Team.
Techniquest Management
When you decide to confirm your event, a dedicated Event Manager will work with you through the organisational elements of your event. That Event Manager will then brief relevant members of the Techniquest team to ensure your event runs as smoothly as possible. Your name, email and contact number will appear on the briefing sheet that is circulate via email.
Retail
Shopping on site at Techniquest
Payment card validation: all credit/debit cardholders are subject to validation checks and authorisation by the card issuer. If the issuer of your payment card refuses to, or does not for any reason authorise payment then you will be notified of this immediately at the checkout stage and there is nothing we can do to override this.
In processing your order, we may use your information for the purposes of the prevention and detection of fraud and we may disclose your address and postcode details as part of our fraud prevention checks. At all times where we disclose your information it will remain secure.
Online Retail
Information collected: When you visit the online shop, we collect certain information about your device, your interaction with the site and information necessary to process your purchases. We may also collect additional information if you contact us for customer support.
Information that may be collected in the processing of an order will include, but is not limited to:
- Your name, address, telephone number, e-mail address, and your contact preferences
- Other information you provide to us from time to time which is relevant and necessary for us to collect and process. For example, we may ask you for information about yourself when you purchase products in the shop so that we can process payment and send you receipts and communications about those services
- If you contact Techniquest, fill in a feedback form or ask for more information on part of our services, we may also keep a record of your correspondence
- With your consent, we may also collect information about your activity online when you visit our website and when we send you an email
Minors: We do not intentionally collect personal information from children. If you are the parent or guardian of a child (under 16 years old) and believe they have provided us with personal information, please contact us to request deletion.
How will your information be used?
We may use your personal information for the following purposes:
- To respond to or fulfil any requests, complaints or queries we receive from you
- To confirm that your purchase has been processed correctly
- To send you important information about your purchase
- To process your order and payment when you buy products from Techniquest
- To manage your contact preferences. (If you ever want to change the way we keep in touch, just let us know by emailing [email protected] or using the unsubscribe link in any emails you may have been sent)
- To inform our digital and social media marketing. For example, we may use your information to enable us to display relevant adverts to you
- For our internal purposes such as management, research, analytics, organisational reporting, and ways that will improve efficiencies
- To prevent and detect criminal activity and fraud
- When we have a legal obligation to use your information, for example to comply with applicable laws, regulations, court orders, government and law enforcement agencies’ requests, to operate our systems properly and to protect ourselves, young people we support, our supporters, our employed and funded staff and to solve any customer disputes.
Sharing personal information
We may share your personal information with carefully selected service providers, to help us deliver our services and fulfil our contract(s) with you. For example:
- We use Shopify to power our online store: You can read more about how Shopify uses your Personal Information here: https://www.shopify.com/legal/privacy
- Xero, provider of our purchasing, invoicing and accounting software
- Mailchimp, provider of our email communications services
- We may share your Personal Information to comply with applicable laws and regulations
- We will share your personal information with our appointed courier to deliver your ordered items
We may also share your data with a third party if:
- We have cause to believe it necessary to protect or defend our rights or the personal safety of our staff or customers
- We are legally required to do so eg law enforcement agency pursuing an investigation or enforcing a court order
Data Retention
Data collected in the process or making a purchase through our online shop will be retained only as long as is necessary to fulfil our legal and business requirements, and as referenced in https://www.shopify.com/legal/privacy
The retention of any other personal data collected in the course of your interaction with us relating to our online shop provision, will be determined by the nature of that engagement, but will only be for as long as is necessary for us to discharge our obligations to you and to ensure accurate business record-keeping is maintained.
Please read our Online Retail Terms and Conditions for more information about purchasing through our online shop.