Introduction

This privacy notice discloses the privacy practices in place for event customers of Techniquest in Cardiff.

This specific notice applies solely to information collected by the events team.

In this notice will find the following information:

• What personal data is collected from you through our events processes and how it is used and stored
• Who else has access to the data you submit to the events team
• The security procedures in place to protect your information
• Your rights
• How to opt out of communications from us

What personal data is collected from you through our events processes and how is it used and stored

1. Enquiries
   When an event enquiry is submitted, either via email or telephone, information regarding the potential event is collected on an enquiry form along with some personal information. This information includes name, company, email, telephone number and post code. This information is then transferred to an event management system to generate a quote. All paper enquiry forms are then disposed of immediately. Information will reside on our event management system indefinitely.
2. Event confirmation
   When an event is confirmed, an electronic and paper file is produced to house the contract and all purchase orders relating to the event. The paper version is destroyed when the event is completed — whilst the event is in planning stages it is stored in a lockable storage unit.Internal paperwork is completed before a contract is released to a client, to demonstrate to Senior Management that the event is not loss making. This document includes the contact name, address, number and email address as well as the event package contents and cost breakdowns. This is stored in the electronic event file whilst the paper copy is stored in the finance office.
3. Event planning
   During the planning process we liaise with our team of trusted partners to assist with our event delivery. These third-party suppliers include Epic Caterers (our catering supplier), and Orchard Media and Events (our AV supplier). Contact and event details will be passed to these third party suppliers for organisational purposes.As details for each event is confirmed, information will be added and stored on Catersoft, our event management system.
4. Event briefing
   1 week before an event takes place, the Event Manager will send an event sheet to Techniquest Management and any required third party to ensure a smooth operation.

Who else has access to the data you submit to the events team

1. Catersoft
   When you submit an event enquiry to us, we use the events management system Catersoft to generate your quote. The system allows us to monitor the availability of our spaces, produce quotes and manage the operational delivery of our events. The personal information you submit to us including your name, contact details and postcode will be stored on this system.
2. Third-party suppliers
   We use a team of reliable third-party suppliers to help deliver events at Techniquest. If your event requires catering or AV, then we will pass your details on to our selected suppliers for organisational purposes. Appointed Caterers – Epic Caterers. Appointed AV supplier – Orchard Media and Events.Other third-party suppliers including photographers, event props and entertainment may also be passed your information if you book these elements through the events team.
3. Techniquest Management
   When your decide to confirm your event, a dedicated Event Manager will work with you through the organisational elements of your event. That Event Manager will then brief relevant managers within Techniquest to ensure your event runs as smoothly as possible. Your name, email and contact number will appear on the briefing sheet that is circulated via email.
4. Sage
   See our Finance Privacy Policy for more information on this.

The security procedures in place to protect your information

We take the utmost care to ensure your personal information is protected. While we use encryption to protect sensitive information transmitted online, we also protect your information offline. Only employees who need the information to perform a specific job (for example, billing or customer service) are granted access to personally identifiable information. The computers/servers in which we store personally identifiable information are kept in a secure environment.

We adhere to strict technical, physical and organisational security policies, which are explained below.

Technical security

As a charity, we are about to achieved the Cyber Essentials accreditation. For more information about this certification please check here: https://www.cyberessentials.ncsc.gov.uk/

Our IT providers CCSW also work to provide a safe technical infrastructure. They do this by delivering:

• Managed firewalls — to prevent unauthorised access
• Antivirus software — to help prevent data loss by the use of malicious software
• Antimalware email filtering — to help prevent delivery of known malicious attachments
• Password renewals every 90 days — to ensure password integrity
• 2 factor authentication on VPN — to increase security when connecting remotely
• Regular software updates — to ensure that the latest patches have been applied which ensures security and reliability
• We have a remote working policy which dictates the strict use of company devices only. These devices are encrypted and firewalls are installed.

Physical Security

• Clear desk policy
  Clear desk policies are in place to ensure that no paperwork with sensitive information is left on display. Information is stored on our secure IT system or in lockable storage units.
• Paperwork destruction
  Paperwork relating to your event, including purchase orders contracts and event sheets are kept in an event file as a backup copy to the electronic file. After the event has finished, the paperwork is shredded but the electronic event file is archived in our IT system for 3 years for reference.

Organisational Security

All staff are required to pass an online data protection course (that complies with the GDPR, 2016) before handling any personal data on behalf of Techniquest Cardiff. This training is renewed on an annual basis.

If you feel that we are not abiding by this Privacy Policy, you should contact us immediately via email at events@techniquest.org.

Your rights

You can ask us to access the information we hold on you at any time

You have the right to rectify the information we hold

You can ask us to completely remove your details from all of our systems

You’re able to object to us using your information

You can restrict how we use your information

You have a right to data portability

How to opt out of communications from us

Any communications we send you will be via Technotice if you have opted in to our corporate database — if this is not the case please report this to events@techniquest.org. If you wish to stop receiving this newsletter, you are able to do so by unsubscribing directly using the links at the bottom of each email, or by contacting a member of the Techniquest team to request your removal manually.

You are also able to request the removal all of your personal data from any Techniquest system. Providing no other laws supersede your request we will action your request in a timely manner.

Other

• We do not sell or rent your personal information to other entities.
• We will use your information to respond to you, regarding the reason you contacted us.

Contact and complaints

The primary point of contact for all issues arising from this Policy, including requests to exercise data subject rights, is our Data Protection Officer. The Data Protection Officer can be contacted in the following way:

info@techniquest.org

If you have a complaint or concern about how we use your personal data, please contact us in the first instance and we will attempt to resolve the issue as soon as possible. You also have a right to lodge a complaint with your national data protection supervisory authority at any time. In the UK, the supervisory authority for data protection is the ICO (https://ico.org.uk/). We do ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.