Privacy Policy

Organisation: The Bunkum Tap
Website: www.thebunkumtap.com
Effective date: 19 August 2016

1. Who we are

This privacy policy explains how The Bunkum Tap (also referred to as "we", "us" or "our") collects, uses and protects personal information when you use www.thebunkumtap.com to become a Founding Member or Founding Friend, join our mailing list, attend or register for an event, contact us, or otherwise interact with us.

Data controller: The Bunkum Tap, 3, The Parade, Lansdowne Rd, Bayston Hill, Shrewsbury SY3 0HT

Privacy contact: rhea@thebunkumtap.com

For UK data protection law, we are the controller of the personal information described in this policy. Stripe and certain other providers may also act as independent controllers for some processing they undertake under their own privacy notices.

2. The information we collect

We may collect the following categories of personal information:

• Identity and contact details, such as your name, email address, telephone number and postal address.
• Membership and supporter details, including whether you are a Founding Member or Founding Friend, the date you joined, your membership status, preferences and communications with us.
• Payment and transaction information, including the amount, currency, payment status, transaction reference and limited payment details supplied to us by Stripe. We do not ordinarily receive or store your full card number or security code.
• Newsletter and communications information, such as your subscription status, consent record, email delivery status, event interests and whether you open or interact with our emails, where permitted and enabled.
• Event information, including registrations, ticket purchases, attendance, access requirements you choose to provide and communications about an event.
• Website and device information, such as IP address, browser and device type, and technical security or diagnostic records generated when you use the website.
• Enquiry and correspondence information, including the content of messages you send to us.

Please do not send us sensitive or special category information unless we specifically ask for it and explain why it is needed. If event accessibility information reveals health information such as dietary requirements, we will use it only to make appropriate arrangements and will restrict access to it.

3. How we collect information

• Directly from you when you complete a form, purchase a membership or supporter option, subscribe, register for an event, buy a ticket, or contact us.
• Automatically through essential website technology and technical server records when needed to deliver, secure and troubleshoot the website.
• From service providers, including Stripe, our email marketing platform, website host, analytics provider and event or ticketing providers.

4. How and why we use your information

Where we rely on legitimate interests, we consider the nature and impact of the processing and your reasonable expectations. You can ask us for more information about our assessment.

5. Founder and newsletter emails

Essential membership messages

If you become a Founding Member or Founding Friend, we may send messages that are necessary to administer the relationship or deliver the benefits you requested. These may include payment confirmations, changes affecting your membership, operational event information and notices about how to access membership benefits. You cannot opt out of essential service messages while the relevant relationship continues, but we will keep them focused on service and administration.

Promotional founder communications

Newsletters, promotional event invitations, first-access ticket announcements and similar content may be direct marketing even when offered as a founder benefit. We will send these only where the law permits. Where we rely on the customer soft opt-in, we will have obtained your contact details in connection with a sale or genuine negotiation for our products or services, market only our own similar products or services, and give you a simple opportunity to opt out when we collect the details and in every later message.

General newsletter

If you sign up to our general newsletter, we use your email address and subscription preferences on the basis of your consent. Every marketing email will identify us and contain an unsubscribe option. You may also unsubscribe by contacting rhea@thebunkumtap.com. Withdrawing consent or opting out will not affect essential service communications.

We may retain a minimal suppression record, such as your email address and opt-out date, so that we can respect your preference and avoid sending marketing to you again.

6. Payments through Stripe

Payments are processed by Stripe. When you pay, Stripe collects payment and related information directly, which may include card or bank details, billing information, device information and fraud-prevention data. We ordinarily receive confirmation of the transaction and limited details needed to administer your purchase. Stripe handles information under its own terms and privacy documentation as applicable. You should read Stripe’s privacy information at stripe.com/gb/privacy.

We do not sell personal information to Stripe. We share or receive information only as needed to process payments, prevent fraud, deal with refunds and disputes, maintain records, and comply with law.

7. Cookies and analytics

We do not currently use non-essential analytics or advertising cookies. The website may use strictly necessary technology where required to deliver pages, maintain security or remember a choice you make. This technology does not require opt-in consent under UK law, but we will describe it here if it is introduced.

If we add analytics, advertising or other non-essential technologies in the future, we will update this information and provide consent controls before those technologies are used where UK law requires them.

8. Who we share information with

We may share personal information with carefully selected recipients where necessary for the purposes above, including:

• Stripe and other payment, fraud-prevention, banking and accounting providers;
• Mailchimp (Intuit Mailchimp), our email marketing and communications platform;
• our website host, content-management, database, security and technical support providers;
• event, venue and ticketing providers where needed to fulfil a registration or ticket purchase;
• professional advisers, auditors, insurers, regulators, law-enforcement bodies and courts where required or appropriate; and
• a buyer, investor or successor if we reorganise, sell or transfer all or part of our organisation, subject to appropriate safeguards.

Email platform: Gmail, provided by Google LLC. Google’s privacy information is available at policies.google.com/privacy.

We require processors acting on our behalf to use personal information only on our instructions, protect it appropriately and comply with applicable data protection law.

9. International transfers

Some service providers may store or access personal information outside the United Kingdom. Where UK data protection law requires safeguards, we will use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. We will also carry out any required risk assessment and apply supplementary protections where appropriate. Contact us if you would like more information about relevant safeguards.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, reporting and dispute-resolution requirements. We generally apply the following periods:

• Founding Member and Founding Friend records: for the duration of the relationship and six years afterward. Postal addresses collected only for correspondence are normally deleted within six months after that correspondence is sent, unless the address is still required for membership administration.
• Transaction, invoice and accounting records: six years after the end of the relevant accounting period.
• Newsletter and promotional-marketing records: until you unsubscribe, object or have been inactive for 24 months. We may retain a minimal suppression record after an opt-out so that we can respect your preference.
• Marketing consent records: while marketing continues and for six years afterward where necessary to demonstrate compliance.
• Event registration records: 12 months after the event. Payment records are retained for six years, while accessibility or health information is normally deleted within 30 days after the event.
• General enquiries: 24 months after the enquiry is closed, unless it becomes part of an ongoing membership, transaction, complaint or legal matter.
• Analytics information: if analytics are introduced in the future, the applicable retention period will be added to this policy before collection begins.
• Security logs: normally 12 months.

We may anonymise information so that it can no longer identify you and use the anonymised information for statistical or planning purposes.

11. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, misuse, alteration, disclosure or access. Measures may include access controls, secure service providers, encryption in transit, staff confidentiality, backups and incident procedures. No internet service can guarantee absolute security.

12. Your rights

Depending on the circumstances, UK data protection law may give you the right to:

• ask for access to your personal information and a copy of it;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how we use information;
• object to processing based on legitimate interests;
• receive certain information in a portable format or ask us to transmit it to another organisation;
• withdraw consent at any time where we rely on consent; and
• not be subject to certain decisions based solely on automated processing that have legal or similarly significant effects.

YOUR RIGHT TO OBJECT TO DIRECT MARKETING: You have an absolute right to object to our use of your personal information for direct marketing. Use the unsubscribe link in an email or contact us at rhea@thebunkumtap.com.

These rights are not absolute and exemptions may apply. We may ask for information needed to verify your identity. We do not normally charge a fee, but the law permits one in limited circumstances. We aim to respond within the period required by law.

13. Complaints

Please contact us first at rhea@thebunkumtap.com so we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

14. Children

Our website, memberships and mailing lists are not intended for children under 18 and we do not knowingly collect their personal information through these services. If you believe a child has provided information to us, please contact us on rhea@thebunkumtap.com.

15. Third-party links

Our website may link to third-party websites or services. Their handling of personal information is governed by their own privacy notices, not this policy. We encourage you to read those notices.

16. Changes to this policy

We may update this policy to reflect changes in our activities, providers or legal obligations. We will post the current version on the website and update the date at the top. If a change materially affects how we use information, we will take reasonable steps to bring it to your attention and obtain consent where required.

For all questions or queries contact rhea@thebunkumtap.com.