At Techniquest (“we”, “us”, “our”), we regularly collect and use personal data about consumers who visit us, use our services or browse our website.
Techniquest is committed to being transparent about how it handles personal information, protecting the privacy and security of that personal information, and to meeting its data protection obligations under the General Data Protection Regulation (the GDPR) and the Data Protection Act 2016.
Personal data is any information that can used to identify you as an individual. Protecting this information is very important to us, and we understand our responsibilities to handle your personal data with care, to keep it secure and to comply with legal requirements.
Techniquest has procedures in place to deal with any suspected security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of any suspected breach where we are legally required to do so.
Please read this Policy carefully. It provides important information about how we use personal data and explains your legal rights. This Policy is not intended to override the terms of any contract that you have with us (for example through Friends or Membership terms) nor any rights you might have available under applicable data protection laws.
We will make changes to this Policy from time to time: for example, to keep it up-to-date or to comply with legal requirements or changes in the way we operate our business. We will make sure that you are aware of any significant changes by sending an email message to the email address you most recently provided to us or by posting a notice on the website so that you are aware of the impact to the data processing activities before you continue to engage.
We encourage you to regularly check back and review this policy so that you will always know what information we collect, how we use it, and who we share it with.
Policy last updated: 19 April 2023
Policy last reviewed: 19 April 2023
Under the GDPR, there are six data protection principles that Techniquest must comply with. These provide that the personal information we hold must be:
You have a number of rights in relation to your personal data. In summary, these are as follows:
We take the utmost care of any personal data entrusted to us and adhere to strict technical, physical and organisational protocols.
Personal data used by Techniquest may be stored in one or more of the systems listed below:
As a charity, we have achieved the Cyber Essentials accreditation. See more information about this certification.
Our IT providers, Custom Computer Services Wales (CCSW) provide a safe technical infrastructure by delivering:
All staff are required to pass an online data protection course that complies with GDPR (2016) before handling any data at Techniquest. This training is renewed on an annual basis.
Team members working remotely dictates the use of company devices, which are encrypted and have firewalls installed, and which meet the company’s security requirements. Any privately owned devices which access company data meet the requirements of Techniquest’s Bring Your Own Device (BYOD) Policy.
Please note that we do not intentionally collect and store personal information from children. If you are the parent or guardian and believe your child has provided us with personal information in error, please contact us to request deletion.
We will never sell, rent or trade your data with third parties. Where we are required to share your personal data with any third parties, they are required to take appropriate technical and organisational security measures to protect your personal information and to treat it subject to a duty of confidentiality and in accordance with data protection law.
We monitor and record images using closed circuit television at Techniquest. This is done for the purposes of crime prevention and public safety. Data is stored on the systems’ hard drives and images are only accessible to Techniquest staff in secure locations within the building, or may be viewed remotely by senior staff members if required. Data is retained on the system for up to a maximum of 30 days.
The primary point of contact for all issues arising from this Policy, including requests to exercise data subject rights, is our Data Lead, Gareth McTiffin who can be contacted via [email protected].
From potential, historic and current customers and visitors (“consumers”) we collect the following data:
This may include the collection of details such as your:
We will never sell, trade or rent your data to a third party, nor supply it to another company or organisation for their own marketing purposes.
We may however need to share your data with some third parties in order to fulfil our contract with you, to help manage our business and/or deliver services. These third parties may, from time to time need to have access to your personal data and include:
We may use your personal data to send you direct marketing communications about our attraction or related services. This will be in the form of email or targeted online advertisements. Where we require explicit opt-in consent for direct marketing in accordance with the Privacy and Electronic Communications Regulations we will ask for your consent. Otherwise, for nonelectronic marketing or where we can rely on the soft opt-in exemption under the Privacy and Electronic Communications Regulations, we will be relying on our Legitimate Interests for the purposes of GDPR.
You have a right to stop receiving direct marketing at any time and you can do this either by following the opt-out (unsubscribe) links in electronic communications (such as emails), or by contacting us at [email protected].
We may also use your personal data for customising or personalising advertisements, offers and content made available to you based on your visits to and/or usage of our attraction websites or other mobile applications, platforms or services, and analysing the performance of those advertisements, offers and content, as well as your interaction with them.
We may undertake photography, videography or other recording in Techniquest, either by our own team or an approved external partner. When this happens, there is a possibility that visitors may be captured in the background of photos or video footage.
In order to protect your rights, we will inform customers who have booked at least 48 hours in advance of their visit, via email that such filming or photography will be taking place and have clear, prominent signage at the main entrance notifying visitors. This will also inform visitors that if they do not wish to be photographed, they can request this at the entrance. We will ensure, in these instances, that the photography/videography will not include any visitors who have opted out.
Any close-up photos or videos including children will require consent forms to be signed by the parent or guardian.
Techniquest may choose to use these photos and video footage for marketing purposes, including use on social media, website inclusion, and for both print and digital advertising or editorial content.
Techniquest has an Off-Peak Pass and Home Educator scheme which allows visitors certain levels of access to the centre within a limited time period.
We process and take payments for these both online and at our front desk, Details collected would include name, address, postcode, email address, telephone number and a photograph of the customer to print on the card: this data is required in order to process these types of transaction.
This data is stored on our third-party point of sale system, DigiTickets, which is password-protected and can only be accessed by authorised staff. DigiTickets is installed on our secure Techniquest network and data is both sent and received from an offsite secure server. As with all DigiTickets transactions, this data is also then stored on our central database, utilising Microsoft Office 365.
We will retain your personal data for as long as is reasonably necessary to complete our contract with you and to enable suitable record-keeping, customer service and business processing to be fulfilled. In particular, where there has been no booking interaction from a consumer after seven years, the record will be anonymised on DigiTickets and Microsoft Dynamics and deleted from the Microsoft Dynamics database after 15 years. Anonymised records are retained for this period to enable accurate statistical analysis and good record-keeping to be maintained.
Where we are required to do so to meet legal, regulatory, tax or accounting requirements, we will retain your personal data for longer periods of time, but only where permitted to do so, including so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a possibility of legal action relating to your personal data or dealings.
We maintain a data retention policy which we apply to all records in our care. Where your personal data is no longer required and we do not have a legal requirement to retain it, we will ensure it is either securely deleted or stored in a way such that it is anonymised and the Personal Data is no longer used by the business.
By making an online donation to Techniquest you agree to have your information stored via a designated third-party processor, which is used to process the transaction.
Information captured will include, but may not be limited to: name, address, email, date of donation(s), amount(s) donated and marketing preferences. Techniquest does not hold, of have access to any sensitive financial information associated with the donation, such as the card of bank account details used to process payment as this is strictly handled by the designated third-party processor. We are not responsible for any data breaches which occur with any third-party processors but we will inform you of any breaches which involve your data as soon as we are made aware of such a situation occurring.
All donors have the option to remain anonymous, as well as to opt-in to receive marketing communications from Techniquest. Please refer to the Ticket Sales and Marketing section for further detail on this aspect of data usage.
The following information relates primarily to the collection and use of data within the Finance Department at Techniquest.
Techniquest collects, uses and processes a range of personal information from contractors and visitors depending on their interaction with us. This includes:
Techniquest may collect personal information directly during the contracting process, and also from other external parties in the legal nature of due diligence.
This may be stored in different places, including in Techniquest’s cloud-based accounting System (Xero), cloud-based payroll system (BrightPay), Secure Finance Files, and electronically using Microsoft Office 365.
We will only use personal information when the law allows us to do so. These are known as the legal bases for processing. We will use personal information in one or more of the following circumstances:
The purposes for which we are processing, or will process personal information, are to:
Personal information will be processed by the Finance Department and the Contract holder (and is kept either directly in our Xero Accounting system &/or in a locked cabinets in access limited Finance Office) and may be shared internally within Techniquest, including with members of the Finance Department, line manager or other managers, and the Finance Director if access to the personal information is necessary for the performance of their roles.
Techniquest may also share personal information with third-party service providers (and their designated agents), including:
Techniquest may also share personal information with other third parties in the context of a potential sale or restructuring of some or all of its business. In those circumstances, personal information will be subject to confidentiality undertakings.
We may also need to share personal information with a regulator or otherwise to comply with the law.
We may share personal information with third parties where it is necessary to administer the contract we have entered into, where we need to comply with a legal obligation, or where it is necessary for our legitimate interests (or those of a third party).
The Finance department will process the supplier information received in order to:
Finance will normally undertake two Payment runs every calendar month processing approved contracted payments.
Techniquest also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and individuals of a suspected breach where we are legally required to do so.
Techniquest will only retain personal information for as long as is necessary to fulfil the purposes for which it was collected and processed, including for the purposes of satisfying any legal tax, reporting or accounting requirements.
Techniquest will generally hold the supplier transaction & details records for six years after each relevant financial year end. Personal information which is no longer to be retained will be securely and effectively destroyed or permanently erased from our IT systems and we will also require third parties to destroy or erase such personal information where applicable.
Techniquest may collect personal information in a variety of ways based upon either a given customer’s declaration for Gift Aid or a named donation.
It is collected during the declaration or donation process directly. The personal information may be stored in different places, including in Techniquest’s Finance System, Secure Finance Files, our third-party ticketing system (DigiTickets), electronically within our IT servers, and electronically with the HMRC Gift Aid portal (For Gift Aid only).
Personal information will be processed by the Finance Department (and is kept either directly in our in a locked cabinet with access limited Finance Office or within the HMRC Gift Aid portal) and may be shared internally within Techniquest with the front-of-house processing team and the Finance Director if access to your personal information is necessary for the performance of their roles.
The Finance department will process the Gift Aid and donation information received in order to:
As part of any recruitment process, Techniquest collects and processes personal information, or personal data, relating to job applicants. This personal information may be held by Techniquest on paper or in electronic format. This privacy notice applies to all job applicants, whether they apply for a role directly or indirectly through an employment agency. It is non-contractual.
Personal information is any information about an individual from which that person can be directly or indirectly identified. It does not include anonymised data, ie where all identifying particulars have been removed. There are also ‘special categories’ of personal data, and personal information on criminal convictions and offences, which require a higher level of protection because it is of a more sensitive nature. The special categories comprise of information relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual orientation and genetic and biometric data.
Techniquest collects, uses and processes a range of personal information about you during the recruitment process. This includes:
Techniquest may also collect, use and process the following special categories of your personal information during the recruitment process:
Techniquest collects personal information about you during the recruitment process either directly from you or sometimes from a third party such as an employment agency. We may also collect personal information from other third parties, such as references from current or former employers, information from background check providers and criminal record checks from the Disclosure and Barring Service (DBS) on offer of employment.
Your personal information may be stored both digitally (using Microsoft Officer 365 suite) and in paper format.
We will only use your personal information when the law allows us to. These are known as the legal bases for processing. We will use your personal information in one or more of the following circumstances:
We need these types of personal information primarily to enable us to take steps at your request to enter into a contract with you, and to enable us to comply with our legal obligations. Our legitimate interests include pursuing our business by employing employees, workers and contractors; managing the recruitment process; conducting due diligence on prospective staff and performing effective internal administration.
The purposes for which we are processing, or will process your personal information are to:
Please note that we may process your personal information without your consent, in compliance with these rules, where this is required or permitted by law.
You are under no statutory or contractual obligation to provide personal information to Techniquest during the recruitment process.
If you fail to provide certain personal information when requested, we may not be able to process your job application properly or at all, we may not be able to enter into a contract with you, or we may be prevented from complying with our legal obligations. You may also be unable to exercise your statutory rights.
We only collect and use your sensitive personal information, which includes special categories of personal information and information about criminal convictions and offences, when the law additionally allows us to.
Some special categories of personal information, ie information about your health and information about criminal convictions and offences, is also processed so that we can perform or exercise our obligations or rights under employment law and in line with our data protection policy.
We may also process information about your health and information about any criminal convictions and offences where we have your explicit written consent. In this case, we will first provide you with full details of the personal information we would like and the reason we need it, so that you can properly consider whether you wish to consent or not. It is entirely your choice whether to consent. Your consent can be withdrawn at any time.
The purposes for which we are processing, or will process, health information and information about any convictions and offences are to:
Where Techniquest processes other special categories of personal information, ie information about your racial or ethnic origin, religious or philosophical beliefs and sexual orientation, this done only for the purposes of equal opportunities monitoring in recruitment and in line with our data protection policy. Personal information that Techniquest uses for these purposes is anonymised. It is entirely your choice whether to provide such personal information.
We may also occasionally use your special categories of personal information, and information about any criminal convictions and offences, where it is needed for the establishment, exercise or defence of legal claims.
We will only use your personal information for the purposes for which we collect it, ie for the recruitment exercise for which you have applied.
However, if your job application is unsuccessful, Techniquest may wish to keep your personal information on file in case there are future suitable employment opportunities with us. We will ask for your consent before we keep you personal information on file for this purpose. Your consent can be withdrawn at any time. In any event, details from your application form will be retained for 3 months.
Your personal information may be shared internally within Techniquest for the purposes of the recruitment exercise, including with members of the HR department, members of the recruitment team, and managers in the department which as the vacancy.
Techniquest will not share your personal information with third parties during the recruitment process unless your job application is successful, and we make you an offer of employment or engagement. At that stage, we may also share your personal information with third parties (and their designated agents) including:
We may also need to share your personal information with a regulator or to otherwise comply with the law. We may share your personal information with third parties where it is necessary to take steps at your request to enter into a contract with you, where we need to comply with a legal obligation or where it is necessary for our legitimate interests (of those of a third party).
We only allow such third-party access to process your personal information for specified purposes and in accordance with our written instructions, and we do not allow them to use your personal information for their own purposes.
Techniquest will only retain your personal information for as long as is necessary to fulfil the purposes for which it was collected and processed.
If your application for employment or engagement is unsuccessful, Techniquest will generally retain your personal details for three months after the end of the relevant recruitment exercise but this is subject to: a) any minimum statutory or other legal, tax, health and safety, reporting or accounting requirements for particular data or records and b) the retention of some types of personal information for up to six years to protect against legal risk, eg if they could be relevant to a possible legal claim in a tribunal, County Court or High Court. If you have consented to Techniquest keeping your personal information on file in case of suitable employment opportunities arising in the future, Techniquest will hold your personal information for a further six months after the end of the relevant recruitment exercise, or until you withdraw your consent, whichever is earlier.
If your application is successful, personal information gathered during the recruitment process will be retained for the duration of your employment and up to one year thereafter, and in accordance with the privacy notice for employees, workers and contractors.
Personal information which is no longer to be retained will be securely and effectively destroyed or permanently erased from our IT systems: we will also require third parties to destroy or erase such personal information where applicable.
We do not envisage that any recruitment decisions will be taken about you based solely on automated decision-making, including profiling.
Whilst dealing with the Education department at Techniquest, you may share personal information for a variety of reasons such as:
This could include contact details of a named person within the school, college or university, as well as demographic information such as postcode and specific preferences or interests.
We never sell, rent or trade email lists with other organisations or businesses.
We will normally collect and use personal information from you where the processing is in our legitimate interests and not overridden by your data-protection interests or fundamental rights and freedoms. Typically, as an Education Charity, our legitimate interests include providing our products and services, and for our marketing activities as they relate to educational delivery. In furtherance of this, we will contact teachers who we believe would wish to hear about and/or participate in Techniquest’s education programmes and CPD courses. Where we process your personal data for this aim, we do so with careful consideration of the impact on you and your rights under data protection law.
Techniquest has contracts with third parties to run programmes in Wales and has access to personal data collected by these third parties such as:
Techniquest will access and download personal information from STEM Learning Ltd databases in order to administer placements and courses. Access to this information will only be available to Techniquest’s:
All databases are password-protected.
In the process of working with us on any community engagement process, we may collect personal data that enables us to facilitate the relevant project, and to communicate with you about any future projects that we believe would be of interest to you. Details may include name, address, email address, phone number, company name and specific areas of interest or community engagement type.
This data is stored as part of our central database management system on Microsoft Office 365 (Dynamics). We will retain this data indefinitely in order to ensure you are informed of any suitable projects that may be relevant to you. You may, of course, request to be removed from this database at any time.
If there is an accident or incident here at Techniquest we must fill in an accident / incident form. This will include the following data: date, time of accident / incident, location, name of person affected, address, telephone, date of birth, signature (from a parent or guardian if it relates to someone under 16 years old), the name of any witnesses, the witnesses’ address and a description of what happened.
This form is completed by the first aider who administered any first aid or, if no first aid was required, straight after the incident by a member of the Techniquest team. If the accident / incident involves a school visitor, a copy is made and given to the teacher in charge.
The form is then given to the Operations Manager who checks over the area or equipment involved and any extra information is written up on the reverse of the form. Once this had been done, the form is passed to HR. The information is kept for 3 years to ensure accurate Health & Safety reporting and audits are completed satisfactorily.
The following information relates to specific aspects of collection and use of data in relation to Projects and Exhibits
Techniquest will not collect personal data without having legitimate and relevant grounds for doing so. We will ensure transparency during data collection and provide individuals with an appropriate privacy notice when collecting their data which states our identity, provides information on how their data will be used and with whom their information may be shared.
Techniquest will collect your data in line with our GDPR strategy. Your data will be used to ensure that you, the client are kept informed about the services that we can provide and to contact you where necessary to ask for permission to share information about any projects you have commissioned with us.
You have the right to ask what information we currently hold on you and to have your information removed from our system as long as no active projects are currently commissioned between Techniquest and yourself.
In cases where an active project is in process, or where there is a legitimate business interest, your data will be stored until there is no longer a legitimate business interest, after which you can request your personal data be erased. Following the completion of a project your data will be held for a period of 10 years unless a request for removal is made.
Exhibits Data Capture: The Island Saver Exhibit allows visitors, should they choose to sign up, to receive a photograph and email of their successful completion of the challenge. This data is stored temporarily on Techniquest’s Microsoft Office 365 platform in order to process the email, and is then automatically deleted after 24 hours.
Where data is collected via paper questionnaires, this will input digitally within 7 working days of collection and stored securely and digitally on Techniquest’s Microsoft Office 365 platform. Following digital input, all paper copies will be destroyed in a secure manner.
When an event enquiry is submitted, either via email or telephone, information regarding the potential event is recorded on an enquiry form along with some personal information. This information includes name, company, email, telephone number and postcode. This information is then transferred to an event management system to generate a quote. All paper enquiry forms are then securely disposed of immediately. Information from such enquiries will reside on our event management system indefinitely.
When an event is confirmed, an electronic file is produced to house the contract and all purchase orders relating to the event. Internal paperwork is completed before a contract is released to the client. This document includes the contact name, address, number and email address as well as the event package contents and cost breakdowns. This is stored in the electronic event file
During the planning process we liaise with our team of trusted partners to assist with our event delivery. These third-party suppliers include, but are not limited to, Epic Caterers (our catering supplier) and Orchard Media and Events (our AV supplier). Contact and event details will be passed to these third-party suppliers for organisational purposes. As the details for each event are confirmed, information will be added and stored on Techniquest’s central database and events management system, using Microsoft Office 365 (Dynamics)
One week before and event takes place, the Event Manager will send and event sheet to Techniquest Management and any required third party to ensure the smooth operation of said event.
By confirming your attendance at an event hosted at Techniquest, you agree for us to store information on our central database and any associated third-party databases — such as the DigiTickets ticketing system — relating to your attendance and, in the case of fundraising event, any contributions that you make either to or at such events. This information may include, but is not limited to, your name, email address, postcode, phone and business address where applicable.
Techniquest may take photographs, film or otherwise record during the course of these events, subject to agreements being in place with the hirer concerned, to be used for future advertising and promotion either in print, online or via social media: your rights in connection to such image and/or voice capture can be found under the heading ‘Photography & Videography’.
Third-party suppliers: We use a team of reliable, third-party suppliers to help deliver events at Techniquest. If your event requires catering or AV, then we will pass your details on to our selected suppliers for organisational purposes. Our appointed caterers are Epic Caterers and our appointed AV supplier is Orchard Media and Events. Other third-party suppliers, including photographers, event props and entertainment may also be passed your information if you book these elements through the Events Team.
When you decide to confirm your event, a dedicated Event Manager will work with you through the organisational elements of your event. That Event Manager will then brief relevant members of the Techniquest team to ensure your event runs as smoothly as possible. Your name, email and contact number will appear on the briefing sheet that is circulate via email.
Payment card validation: all credit/debit cardholders are subject to validation checks and authorisation by the card issuer. If the issuer of your payment card refuses to, or does not for any reason authorise payment then you will be notified of this immediately at the checkout stage and there is nothing we can do to override this.
In processing your order, we may use your information for the purposes of the prevention and detection of fraud and we may disclose your address and postcode details as part of our fraud prevention checks. At all times where we disclose your information it will remain secure.
Information collected: When you visit the online shop, we collect certain information about your device, your interaction with the site and information necessary to process your purchases. We may also collect additional information if you contact us for customer support.
Information that may be collected in the processing of an order will include, but is not limited to:
Minors: We do not intentionally collect personal information from children. If you are the parent or guardian of a child (under 16 years old) and believe they have provided us with personal information, please contact us to request deletion.
We may use your personal information for the following purposes:
We may share your personal information with carefully selected service providers, to help us deliver our services and fulfil our contract(s) with you. For example:
We may also share your data with a third party if:
Data collected in the process or making a purchase through our online shop will be retained only as long as is necessary to fulfil our legal and business requirements, and as referenced in https://www.shopify.com/legal/privacy
The retention of any other personal data collected in the course of your interaction with us relating to our online shop provision, will be determined by the nature of that engagement, but will only be for as long as is necessary for us to discharge our obligations to you and to ensure accurate business record-keeping is maintained.
Please read our Online Retail Terms and Conditions for more information about purchasing through our online shop.