Privacy Notice

The Haven > Privacy Notice

Last updated: 15 October 2026

This notice explains how Crawley Down Community Centre CIO and CDCCA Trading Limited collect and use personal information when you visit The Haven website or centre, contact us, book a space, buy from the Lounge & Bar, use online ordering or guest Wi-Fi, join our mailing list or loyalty scheme, or appear on our CCTV.

It also covers staff, volunteers, trustees and contractors when they use these services or are captured by CCTV. It does not describe every aspect of managing employment or volunteer relationships.

Who we are

Crawley Down Community Centre CIO is a Charitable Incorporated Organisation registered in England and Wales, charity number 1173791. The charity is responsible for personal information used to operate the centre, website, room bookings, guest Wi-Fi, mailing list and CCTV.

CDCCA Trading Limited, company number 10886075, operates the Lounge & Bar. It is responsible for personal information used for Lounge & Bar sales, remote ordering and the loyalty scheme.

Each organisation is a data controller for the activities for which it determines how and why personal information is used. Unless an activity is clearly attributed to one organisation in this notice, references to “The Haven”, “we”, “us” and “our” mean Crawley Down Community Centre CIO and CDCCA Trading Limited. Where an activity is clearly attributed to the charity or the trading company, those references mean the organisation responsible for that activity.

You can contact either organisation about privacy using these shared details:

Please mark privacy correspondence Privacy enquiry and, where possible, identify the service or activity concerned.

Website visits and enquiries

When you visit our website or contact us, we may collect:

  • your name and contact details;
  • the organisation you represent;
  • your message, attachments and our response;
  • technical information such as your IP address, browser, device, access time and security logs; and
  • your cookie choices and information associated with optional services you choose to use.

We use this information to answer enquiries, provide requested information, administer the website, prevent misuse and maintain security.

Our lawful basis is our legitimate interests in communicating with people and operating a secure, effective community-centre website. Where an enquiry concerns a possible booking or agreement, we may also use information to take steps at your request before entering into a contract.

Please provide only the personal information needed for your enquiry. If your message concerns safeguarding, an accident, an access need or another sensitive matter, we restrict access to those who need to deal with it.

Room bookings and venue hire

We use LemonBooking to manage room availability, booking requests, hirer records, communications, invoices and payments.

Booking information may include:

  • your name, address and contact details;
  • your organisation or group;
  • the date, time, room and purpose of the booking;
  • information needed to assess the booking and meet safety or insurance requirements;
  • charges, invoices, payments, refunds and deposits; and
  • communications, approvals, cancellations and changes.

We use this information to assess and administer bookings, manage hire agreements, collect payments, maintain financial records, protect the centre and resolve queries or disputes.

Our lawful bases are:

  • contract, where you are entering into a hire agreement with us;
  • legitimate interests, including administering bookings made for an organisation and managing the centre safely; and
  • legal obligation, where records are required for accounting, tax or other legal requirements.

If you do not provide information necessary for a booking, we may be unable to assess or confirm it.

LemonBooking processes booking information on our behalf. Payments to the charity are processed through SumUp and GoCardless. These providers process payment and related information and may also act as independent controllers for payment security, fraud prevention and regulatory compliance.

We receive transaction references, amounts, payment status and related accounting information. We do not normally receive complete card details or online-banking credentials.

Further information is available in SumUp’s privacy notice and GoCardless’s privacy information for payers.

Our Hiring Guidelines explain hirers’ responsibilities. The terms applicable to a booking are provided through the booking process.

Public events and website listings

Where an organiser identifies a booking as public and confirms that information is suitable for publication, we may display selected details on our website and public calendar.

These may include the event name and description, date, time, venue, organiser or group name, website and public contact details.

Organisers should provide business or event contact details wherever possible and must have authority to supply information about other people for publication.

We use this information in our legitimate interests in publicising activities at The Haven. Organisers can ask us to correct or remove published personal information. We may still need to retain a private booking record for contractual, accounting or legal purposes.

Guest Wi-Fi

The charity provides guest Wi-Fi through Social WiFi.

Depending on the login method and information you provide or authorise a login provider to share, we may collect:

  • your name and email address;
  • your telephone number, date of birth and language;
  • profile information supplied through a social-media login, which may include gender;
  • device identifiers and technical information needed to manage your connection and recognise a returning device;
  • login and visit information, including first and most recent visits and visit counts; and
  • records of your privacy choices, marketing consent and withdrawal.

Our login page offers email and supported social-media login methods. If you choose a social-media login, the provider also processes information under its own privacy terms.

Providing and managing Wi-Fi

We use the information necessary to authenticate connections, provide internet access, recognise returning devices, troubleshoot problems and protect the network against misuse.

Our lawful basis for necessary technical and security processing is our legitimate interests in providing and maintaining a reliable, secure guest Wi-Fi service.

Automatic re-login can recognise a device used previously and simplify connecting on a later visit. Associated login records may indicate repeat visits to the centre.

Optional guest-profile information and its use for marketing are subject to the choices presented during login.

Marketing and the connection to Brevo

Where you consent to receive marketing, we use the details collected through Social WiFi to send news, events, offers and other updates from The Haven. Relevant guest details are transferred automatically to Brevo, our mailing-list and email provider.

Connecting to Wi-Fi or verifying an email address does not, by itself, constitute consent to marketing. Marketing consent is optional, and declining or withdrawing it does not prevent you from using the guest Wi-Fi.

You can withdraw marketing consent using the unsubscribe link in our emails or by contacting us. Marketing refusal and withdrawal are respected across Social WiFi and Brevo.

If you previously unsubscribed, you will be added back to the mailing list only if you subsequently give fresh, affirmative consent, including through a marketing choice at a later Wi-Fi login. Simply reconnecting, using automatic re-login or verifying an email address does not renew marketing consent.

We retain records of consent and withdrawal so that we can respect your choices and demonstrate compliance.

The News and event emails section explains our use of Brevo, email engagement tracking and the choices available to you. Consent to receive marketing does not automatically include consent to individual-level email tracking.

Providers and retention

Social WiFi processes guest information for us. Brevo processes the information transferred to it for our mailing-list and email activities. Further information is available in Social WiFi’s privacy policy and Brevo’s privacy policy.

We retain identifiable Wi-Fi records only while needed to administer access, recognise returning users, resolve technical or security issues and manage relevant consent records. We review their continued necessity and delete or anonymise information when it is no longer needed.

Marketing information is retained in accordance with the mailing-list retention arrangements below. Withdrawing marketing consent does not necessarily require immediate deletion of a separate record still needed for network security or another lawful purpose.

News and event emails

We use Brevo to manage our mailing list and send news, events, offers and community updates.

You can subscribe through our website or by making an appropriate marketing choice through our guest Wi-Fi service.

We collect your email address, the name you provide, subscription details, preferences and consent record. You may also choose to provide your birthday so that we can send a birthday message or treat. Providing a birthday is optional.

We rely on your consent to send our subscription emails. You can withdraw consent at any time using the unsubscribe link or by contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal.

We do not automatically subscribe people merely because they have made a booking, bought something, joined the loyalty scheme or connected to guest Wi-Fi.

Email delivery and engagement tracking

Brevo records delivery information, including unsuccessful deliveries and unsubscribes. Its tracking features also allow us to record email opens and link clicks, with associated dates, times and technical information supplied by the service.

We use this information to understand how our emails are received and improve their content and usefulness. Individual-level open and click tracking operates only where you have given the required consent. You can withdraw that consent by contacting us without having to withdraw your subscription to the newsletter itself.

Email engagement tracking is separate from monitoring general browsing activity on our website.

Brevo processes mailing-list information for us. Further information is available in Brevo’s privacy policy.

Browser notifications

Our website uses WonderPush to provide optional browser notifications.

If you subscribe, the service processes information needed to register your browser and deliver notifications. This can include an installation identifier, notification-subscription details, browser and device information, language, time zone and records of notification activity.

We rely on your consent for these optional notifications and associated non-essential technologies. You can withdraw permission through your browser’s notification settings.

Browser notifications are separate from email subscriptions and website cookie choices. Further information about browser storage and controls is available in our Cookie Notice and WonderPush’s data documentation.

Lounge & Bar purchases, online ordering and loyalty

CDCCA Trading Limited uses Epos Now to manage Lounge & Bar sales, payments and loyalty accounts.

Sales records may include the items purchased, amount, time, payment method, refunds and information needed to provide a receipt, reconcile accounts, prevent fraud or resolve a query.

The Lounge & Bar also uses Epos Now Order & Pay, provided through Yoello, for remote and at-table ordering. Depending on the order and choices made, information may include your name and contact details, items ordered, table or collection information, payment details, order status, tips and technical information.

We use this information to accept and fulfil orders, process payments and refunds, maintain financial records and resolve queries. Our lawful bases are contract, legal obligation and our legitimate interests in operating the Lounge & Bar and preventing misuse.

Loyalty accounts

If you join the loyalty scheme, we process the information you supply when registering, together with your member identifier, relevant purchase history, points, rewards and redemptions.

We use this information to administer your account, award and redeem points, provide rewards, answer queries and prevent misuse. Our lawful bases are contract and our legitimate interests in administering and protecting the scheme.

Joining the loyalty scheme does not automatically subscribe you to marketing emails. Electronic marketing is subject to the applicable consent and marketing rules.

You can contact us to ask about your loyalty information or request closure of your account.

Epos Now, Yoello and their payment providers may also process information as independent controllers for payment security, fraud prevention and legal compliance. See Epos Now’s privacy policy and Yoello’s privacy policy.

CCTV, audio recording and AI-assisted security alerts

Why we use CCTV

We use CCTV in and around The Haven to:

  • protect visitors, staff and volunteers;
  • safeguard children and adults at risk;
  • support health and safety and the investigation of accidents;
  • protect the building, equipment and other assets;
  • prevent or detect crime and unauthorised access; and
  • investigate relevant incidents, complaints and legal claims.

Where necessary and proportionate, authorised people may review relevant recordings to investigate a specific safeguarding or security concern, accident, complaint or suspected serious misconduct. This includes concerns raised through whistleblowing.

Recordings may provide evidence in safeguarding, disciplinary, insurance or legal proceedings where their use is lawful and consistent with these purposes.

CCTV is not used for routine monitoring of staff productivity, timekeeping or ordinary work performance. It is not used to identify or disadvantage someone because they have raised a concern or made a protected disclosure.

Our usual lawful basis is our legitimate interests in keeping people and property safe, protecting the centre and investigating relevant incidents. Additional legal conditions apply where we process special-category or criminal-offence information, as explained below.

What the system records

Our CCTV operates through UniFi Protect. It records images and associated information such as dates, times, camera locations and security events.

Where supported and enabled, the system uses smart detections of people, vehicles and relevant sounds. It also uses licence-plate recognition to read vehicle registration marks and help authorised people locate relevant vehicle recordings.

We do not use facial recognition to identify individuals or track their movements.

Cameras are not placed in toilets, changing rooms or other places where people reasonably expect privacy. Signs identify monitored areas and explain how to obtain further information.

Continuous audio recording

Audio is recorded continuously by designated CCTV cameras in communal areas, including corridors and the Lounge & Bar, external areas and back of house areas. Audio is not recorded in bookable spaces.

We use audio to help investigate specific allegations of verbal abuse, harassment, threats and other safeguarding or security incidents. Video alone may not establish what was said or the context of an interaction. Incidents can develop too quickly for recording to be activated, and complaints may be received only afterwards.

This is particularly relevant in the Lounge & Bar, where incidents may involve people affected by alcohol, and in the connected publicly accessible corridors and external areas through which people enter, leave or move during an incident.

Designated cameras also cover the back of house areas for health, safety and security purposes. These areas involve activities such as heavy lifting, handling stock, preparing food and drinks, and working with glassware and equipment. Relevant recordings may be reviewed to investigate accidents, calls for assistance, threatening behaviour and other incidents.

These feeds are excluded from accounts providing general live-only access. Access to live video, live audio and recordings is restricted according to the person’s specifically authorised responsibilities.

Audio must not be used for general listening to conversations, personal curiosity or routine staff performance monitoring. Signs identify the areas where audio and video recording takes place.

AI-assisted alerts

Our CCTV system uses AI-assisted detections to notify designated staff of potentially relevant activity, including activity outside expected hours of use. This helps us identify and respond to possible unauthorised access, intrusions and other security incidents.

An alert does not establish that wrongdoing has occurred. Authorised staff review the relevant information and consider legitimate bookings, staff access and other circumstances before deciding what response is appropriate.

Automated detections and licence-plate readings can be inaccurate. Relevant results are checked against the underlying recordings and other available evidence.

Live viewing and access to recordings

Access to CCTV is controlled according to each person’s role and responsibilities.

Authorised staff can view live video and, where their permissions allow, listen to live audio during their shifts where reasonably necessary to monitor safety and security, assess incidents and coordinate an appropriate response. Designated staff may also access relevant live feeds when responding to out-of-hours alerts or incidents.

Access to back of house camera feeds requires specific authorisation and is not included in general live-only access.

Access to recordings is authorised by designated staff at Co-ordinator level and specifically appointed charity trustees. Internal access is limited to individuals authorised to investigate incidents, complaints, safeguarding concerns, suspected serious misconduct, insurance matters or legal claims, or to handle lawful requests for information.

Permission to view live video or listen to live audio does not automatically include permission to replay recordings. Reviewing, downloading or exporting recorded video and audio requires specific authorisation. Reviews are limited to the cameras, periods and information reasonably relevant to the matter.

Account sign-ins to CCTV systems are logged for security and accountability. These logs record sign-ins rather than each individual viewing, playback, download or export.

CCTV must not be used for personal curiosity, routine staff performance monitoring or any other unauthorised purpose.

Disclosure and retention

We may disclose relevant recordings where lawful and necessary, including to the police, safeguarding authorities, insurers, legal advisers, regulators or a person exercising an information right. We take steps to protect the privacy of other people recorded.

Video and audio recordings are normally retained for up to 180 days from capture. This period allows for incidents and safeguarding concerns that may be reported some time after they occur.

Specific recordings may be preserved for longer where necessary for an identified incident, complaint, safeguarding matter, insurance claim, legal claim or law-enforcement request. Preserved material is reviewed and deleted when it is no longer needed.

If you wish to request a recording involving you, please contact us promptly and provide the approximate date, time and location so that we can identify it before routine deletion.

Complaints, incidents, safeguarding and access needs

If you make a complaint or report an accident, incident or safeguarding concern, we may collect:

  • identification and contact details;
  • an account of what happened;
  • witness information and relevant evidence, including CCTV;
  • information about other people involved; and
  • health, safeguarding or alleged-offence information where necessary.

We use this information to investigate, protect people, respond appropriately, meet applicable legal duties, deal with insurance matters and establish, exercise or defend legal claims.

Our lawful bases are our legitimate interests in operating a safe centre and handling concerns fairly, legal obligation where an applicable duty requires processing, and vital interests where necessary to protect someone’s life.

Sensitive information has additional protection. Depending on the circumstances, the additional conditions we use include:

  • substantial public interest for safeguarding children or individuals at risk, or preventing or detecting unlawful acts, where the relevant Data Protection Act 2018 Schedule 1 requirements are met;
  • establishing, exercising or defending legal claims;
  • employment and related legal obligations, where applicable; or
  • explicit consent, including where appropriate for health or disability information supplied to arrange support.

Information about criminal allegations or offences is processed only where an applicable legal condition permits it. We maintain the additional safeguards and policy documentation required for the processing concerned.

Access is limited to those who need the information. We consider confidentiality and the safety of everyone involved when deciding what to share. Where the law permits or requires safeguarding information to be shared without consent, we may do so.

Our Safeguarding policy explains how to raise safeguarding concerns. Our Complaints procedure explains how to raise general complaints. Our Accessibility Information explains access arrangements and how to request support.

Event photography and community publicity

We may take photographs or video at public events to document and promote The Haven’s charitable activities.

We provide appropriate information at the event and consider the setting, people’s reasonable expectations and the intended use. For general event or crowd images, we may rely on our legitimate interests in reporting on and promoting our activities. We seek consent where the circumstances require it.

We take extra care with images of children and people who may be vulnerable. Please tell a member of the team if you do not want to appear in photographs so that we can discuss suitable arrangements.

Event photography is separate from security CCTV.

Cookies and external services

Our Cookie Notice explains the public website’s cookies, browser storage and similar technologies. You can reopen the consent panel using Cookie settings in the website footer.

We use Google Analytics 4 to understand how people find and use the website and to improve its content and performance. Google Analytics may collect information about pages viewed, interactions, approximate location, referring websites, and browser and device type. It uses identifiers such as the _ga cookie to distinguish users and sessions. For visitors in the UK, Google states that individual IP addresses are not logged or stored; an IP address is used briefly to derive coarse location information and is then discarded.

Google Analytics is disabled until you consent to analytics cookies. Our lawful basis for storing or accessing analytics information on your device and processing the resulting personal information is your consent. You can accept or reject analytics cookies, and withdraw consent at any time, through Cookie settings in the website footer. Refusing analytics cookies does not prevent you from using the website.

We use the resulting reports to understand website usage and do not use Google Analytics for behavioural advertising. We do not use Meta Pixel or Brevo’s website-tracking service to monitor general browsing activity. Google may process analytics information as described in Google’s privacy policy.

The guest Wi-Fi login portal is a separate service. Its login, privacy and technology choices are separate from the cookie settings on our public website.

Our website and Wi-Fi login portal may link to or offer services provided by other organisations, including social-media platforms, Google and external booking providers. Their own privacy and cookie information applies to their processing when you use those services.

Children’s information

The Haven hosts activities for children and families. General enquiries, bookings, mailing-list subscriptions and loyalty registrations should normally be completed by an adult.

Where we need information about a child for an activity, accident or safeguarding purpose, we collect only what is necessary and provide appropriate information to the child, parent or guardian.

We take particular care with children’s information. Use of guest Wi-Fi does not, by itself, give consent to direct marketing. We do not knowingly use children’s contact details for direct marketing without an appropriate lawful basis and safeguards.

Where information comes from

We usually collect information directly from you. We may also receive it from:

  • someone making a booking on behalf of a group or attendee;
  • a parent, guardian, carer or authorised representative;
  • staff, volunteers, trustees, event organisers or witnesses;
  • our booking, payment, ordering, loyalty, email, notification and guest Wi-Fi providers;
  • a social-media provider you choose for Wi-Fi login;
  • CCTV and website or network security systems;
  • public authorities, emergency services, insurers and professional advisers; or
  • publicly available sources where relevant and lawful.

If you supply information about another person, please make sure you are entitled to do so and, where appropriate, tell them about this notice. This does not prevent you from reporting a safeguarding concern or suspected wrongdoing.

Who we share information with

We share personal information only where necessary and lawful. Recipients may include:

  • authorised trustees, staff and volunteers;
  • the charity or trading company, where sharing between them is necessary for the relevant activity or incident;
  • website, email, IT, hosting, network and security providers;
  • LemonBooking for booking administration;
  • Social WiFi for guest Wi-Fi access and associated guest records;
  • Brevo for mailing-list management and email communications;
  • WonderPush for optional browser notifications;
  • SumUp and GoCardless for payments to the charity;
  • Epos Now, Yoello and connected payment providers for Lounge & Bar sales, ordering, payments and loyalty;
  • Google for consent-based website analytics;
  • CCTV suppliers or maintenance providers where access is necessary and authorised;
  • accountants, auditors, insurers, banks and legal advisers;
  • organisers or contractors where needed to deliver an activity;
  • members of the public, through event information confirmed as suitable for publication;
  • local authorities, safeguarding bodies, the Charity Commission, HMRC, the ICO and other regulators; and
  • the police, courts and emergency services.

Access to CCTV recordings is subject to the more specific restrictions described in the CCTV section above.

Providers acting as processors must handle information under our instructions and appropriate contractual, confidentiality and security requirements. Independent controllers are responsible for their own processing under their privacy notices.

We do not sell personal information.

International transfers

Some suppliers and their group companies or subprocessors may process personal information outside the UK.

Where we make a restricted international transfer, we use a safeguard permitted by UK data-protection law. Depending on the destination and circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any necessary additional measures.

You can contact us for information about the safeguards relevant to your personal information and how to obtain a copy or details of them.

How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including applicable accounting, insurance, safeguarding and legal requirements.

Information Retention period or criteria
General enquiries Until the enquiry and necessary follow-up are complete, unless a record is needed for a complaint, agreement or legal matter.
Booking agreements and operational records For the booking and its administration, followed by the period needed for related accounting, insurance, disputes and legal claims.
Public event listings While needed to advertise or report on the event. Personal contact details are removed when they are no longer needed for that purpose.
Invoices and financial records Up to seven years, unless a longer period is required for an ongoing legal matter or other legal requirement.
Guest Wi-Fi records While needed to administer access, recognise returning users, resolve technical or security issues and maintain relevant consent records. Marketing information follows the mailing-list arrangements below.
Mailing-list information While subscribed. After unsubscribe, we retain only the information needed to respect that preference, demonstrate compliance or deal with an outstanding matter.
Email engagement information While needed to assess relevant campaigns and maintain the mailing list, subject to consent and withdrawal. Information no longer needed for these purposes is deleted or anonymised.
Browser-notification information While needed to operate the subscription. Inactive and withdrawn subscriptions are removed in accordance with the service’s retention arrangements, subject to any information needed to respect withdrawal.
Google Analytics information User-level and event-level data is configured for deletion after 14 months. Aggregated reports that no longer identify an individual may be kept for longer.
Loyalty accounts and history While the account is active and while needed to resolve points, rewards, refunds or disputes. After closure, only information needed for accounting, legal or compliance purposes is retained.
Lounge & Bar and online-order records For fulfilling the order, handling refunds and queries, and meeting applicable financial and legal record requirements.
CCTV video and audio Normally up to 180 days from capture, allowing for delayed reporting of incidents. Specific recordings may be preserved longer where necessary for an identified investigation, claim or lawful requirement.
Security logs, CCTV account sign-in logs and alert records While needed to detect, investigate and resolve relevant security or access issues, taking account of the risk and any continuing investigation.
Complaints, accidents and incident records Until the matter is resolved and for the further period justified by applicable insurance requirements, legal claims and continuing risks.
Safeguarding records According to the nature and seriousness of the concern, the age and circumstances of those involved, continuing safeguarding needs and applicable legal or professional requirements.
Event photographs and video While relevant to the stated publicity or reporting purpose, subject to periodic review and any applicable consent withdrawal or objection.

When deciding retention, we consider the purpose, sensitivity and volume of the information, applicable legal requirements, potential claims, continuing risks and whether the purpose can be achieved with less information.

When information is no longer needed, we securely delete or anonymise it.

How we protect information

We use proportionate organisational and technical measures to protect personal information. These include access restrictions, secure accounts, multi-factor authentication where available, staff and volunteer guidance, appropriate supplier arrangements, backups and procedures for handling security incidents.

Access to sensitive records and CCTV is limited according to role and need. Any authorised remote access must be subject to appropriate security controls.

Please avoid sending unnecessary sensitive information through a general contact form. Contact us if you need to discuss a suitable way to provide it.

Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on people.

Our CCTV system generates detections and alerts, but relevant information is reviewed by an authorised person before action is taken.

Independent payment providers may use automated systems for payment verification, security or fraud prevention. Their privacy notices explain their processing and the rights available.

Your information rights

Depending on the circumstances and lawful basis, you may have the right to:

  • ask for access to your personal information;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase information;
  • ask us to restrict its use;
  • object to its use;
  • receive certain information in a portable format;
  • withdraw consent where we rely on it; and
  • request applicable safeguards for significant automated decisions.

These rights are subject to legal conditions and exemptions. We may need proportionate information to confirm your identity or understand your request.

Your right to object: You have an absolute right to object to the use of your personal information for direct marketing, including related profiling. Where we rely on legitimate interests for other purposes, you can object on grounds relating to your situation. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims.

To exercise a right, contact us using the details at the beginning of this notice.

We respond without undue delay and normally within one month, subject to any extension or pause permitted by law. We will explain if additional time is needed.

Withdrawing consent does not affect processing that was lawful before withdrawal.

Privacy questions and complaints

Please contact us if you have a question or complaint about our handling of personal information. You can use the shared contact details at the beginning of this notice and mark your correspondence Data-protection complaint.

In line with our Complaints procedure, we aim to provide a response or progress update within 14 days. We will acknowledge a data-protection complaint within 30 days at the latest, investigate without undue delay, keep you informed and communicate the outcome.

You also have the right to complain to the Information Commissioner’s Office:

Changes to this notice

We review this notice when our services, suppliers or information practices change. The latest version will be published on this page with its revision date.

Where a change significantly affects how we use your personal information, we will take appropriate steps to bring it to your attention and obtain fresh consent where required.