Privacy Policy
Last updated: [INSERT DATE]
Who we are
TanksALot is operated by “AARON HOILETT TRADING AS TANKSALOT”, referred to in this policy as “TanksALot”, “we”, “us” or “our”.
For the purposes of UK data protection law, we are the data controller for the personal information described in this policy.
- Website: https://tanksalot.co.uk
- Contact email: privacy@tanksalot.co.uk
- Postal address: [INSERT BUSINESS OR REGISTERED ADDRESS]
- Company or CIC number: [INSERT NUMBER WHEN APPLICABLE]
What this policy covers
This policy explains how we collect, use, store and share personal information when you:
- visit our website or social-media pages;
- contact us, join a mailing list or complete a survey;
- make an enquiry, booking or payment;
- attend or take part in an activity, event, pilot or demonstration;
- act as a parent, carer, emergency contact, volunteer, worker, partner, supplier or referrer;
- appear in photographs, video, audio, feedback or a case study;
- apply for work, volunteering, collaboration, funding or another opportunity; or
- otherwise interact with TanksALot.
Where another organisation collects information for its own purposes, its own privacy policy may also apply.
The information we may collect
Depending on your relationship with us, we may collect:
- Identity information: name, title, date of birth, age range and, where genuinely necessary, proof of age or identity.
- Contact information: address, email address, telephone number and preferred contact method.
- Booking information: activity selected, dates, group details, attendance, cancellations, preferences and booking history.
- Parent, carer and emergency information: names, contact details, relationship to the participant, collection arrangements and emergency contacts.
- Payment and transaction information: amounts, dates, payment status, refunds, discounts and limited payment references. Full card details are normally handled by our payment provider rather than stored by us.
- Health, disability and accessibility information: medical conditions, allergies, medication information, communication needs, mobility requirements, reasonable adjustments and other information needed to support safe and inclusive participation.
- Safety and safeguarding information: risk information, incident and accident reports, first-aid records, behavioural or welfare concerns, safeguarding records and relevant communications.
- Participation information: activities undertaken, equipment allocated, session results, achievements, awards and operational records.
- Technical information: IP address, device type, browser, approximate location, operating system, cookie identifiers, website activity and security logs.
- Communications: emails, messages, telephone notes, enquiries, complaints, feedback and social-media interactions.
- Marketing preferences: whether and how you want to hear from us, the messages you open or interact with, and your interests where you choose to provide them.
- Research and evaluation information: survey answers, feedback, demographic information, outcomes, accessibility experiences and evidence showing the reach or impact of our work.
- Media: photographs, video, audio, testimonials and case-study material where an appropriate lawful basis and any required permissions are in place.
- Professional information: organisation, role, work contact details and information connected with partnerships, suppliers, referrals, funding or business relationships.
- Recruitment and volunteering information: applications, employment history, qualifications, references, availability, right-to-work information and relevant checks.
- Information you choose to provide: any other information included in a form, survey, message, conversation or document sent to us.
Information about children and young people
Some TanksALot services may be designed for, or attended by, children and young people. Their personal information deserves particular protection.
We will usually collect booking, health, accessibility and emergency information from a parent, carer, school, youth organisation or other responsible adult. We may also collect age-appropriate feedback directly from a young person.
We will explain relevant data use in clear, age-appropriate language. We will not knowingly use a child’s information for behavioural advertising, sell it, or ask for more information than we reasonably need. Marketing will normally be directed to the responsible adult rather than directly to a child.
A parent or carer’s permission does not remove a young person’s own privacy interests. Where appropriate, we will consider the young person’s age, understanding and wishes, particularly for photographs, video, testimonials and case studies.
How we obtain information
We may receive information:
- directly from you;
- from a parent, carer, emergency contact or group organiser;
- from a school, youth organisation, community group, support service or referral partner;
- through booking, payment, registration, survey and consent forms;
- through our website, cookies and analytics tools;
- from social-media platforms when you interact with our pages or adverts;
- from publicly available business sources;
- from event, venue, insurance, safety or emergency-service records where appropriate; and
- from partners where information sharing is lawful, fair and reasonably expected.
If you provide information about another person, you should have authority to do so and, where appropriate, make them aware of this policy.
How and why we use personal information
We only use personal information where we have a lawful basis. Different purposes may rely on different lawful bases.
| Purpose | Typical lawful basis |
|---|---|
| Answering enquiries and taking steps towards a booking or agreement | Contract or steps requested before entering a contract |
| Managing bookings, attendance, payments, refunds and customer service | Contract and legitimate interests |
| Providing safe, accessible and appropriate activities | Contract, legitimate interests, consent or another lawful basis appropriate to the circumstances |
| Managing incidents, emergencies, insurance claims, complaints and legal matters | Legal obligation, vital interests and legitimate interests |
| Safeguarding children and adults at risk | Legal obligation, vital interests, legitimate interests or substantial public interest where the legal conditions are met |
| Operating and securing our website, systems, equipment and premises | Legitimate interests and legal obligation |
| Preventing fraud, misuse, unsafe behaviour and cyber incidents | Legitimate interests and legal obligation |
| Improving our activities, equipment, accessibility and customer experience | Legitimate interests or consent, depending on the information and proposed use |
| Producing statistics, measuring outcomes and demonstrating community impact | Legitimate interests, with information anonymised or aggregated wherever reasonably possible |
| Supporting funding applications, reports, partnerships and service development | Legitimate interests or consent; identifiable case studies and sensitive information will require additional safeguards |
| Sending requested updates and electronic marketing | Consent or the limited soft opt-in where legally available |
| Relevant business-to-business contact and partnership development | Legitimate interests, subject to the right to object and applicable marketing rules |
| Publishing photographs, video, testimonials or identifiable case studies | Usually consent; another basis may occasionally apply where clearly explained in advance |
| Meeting tax, accounting, insurance, health and safety and other legal duties | Legal obligation |
| Recruiting and managing workers and volunteers | Contract, steps before contract, legal obligation and legitimate interests |
Our legitimate interests include operating and developing TanksALot, understanding demand, improving safety and accessibility, protecting our organisation and users, building appropriate partnerships, securing funding and demonstrating the reach and impact of our work. Before relying on legitimate interests, we will consider whether the use is necessary, proportionate and compatible with your reasonable expectations.
We will not reuse identifiable personal information for a new and incompatible purpose without first considering whether another lawful basis, further notice or fresh consent is required.
Health, disability and other sensitive information
Health, disability, ethnicity, religion and certain other information may be “special category data” under UK data protection law. We will only process this information where we have both a lawful basis and an additional legal condition.
For routine accessibility and participation information, this will often be your explicit consent or the explicit consent of the person authorised to provide it. In emergencies, vital interests may apply. Safeguarding and other substantial-public-interest processing will only be used where the relevant Data Protection Act 2018 conditions and safeguards are satisfied.
We will limit access to sensitive information to people who reasonably need it for safety, inclusion, safeguarding, insurance or legal purposes. We will not use health or disability information to target unrelated advertising.
Research, statistics and development
We may analyse booking patterns, attendance, feedback, accessibility needs, outcomes and service use to:
- understand who our activities reach and who may be under-represented;
- improve activities, equipment, pricing, locations and accessibility;
- test and develop new services;
- measure social and community impact;
- support funding applications and reports;
- identify trends and plan future provision; and
- produce reports, presentations and promotional evidence.
Where reasonably possible, we will use anonymous or aggregated information for these purposes. Information that has been effectively anonymised so that no person can be identified is no longer personal data. We will not attempt to re-identify it.
If we want to use an identifiable story, quotation, photograph or detailed case study, we will explain the intended use and obtain any consent or permission required.
Photography, video, audio and case studies
We may invite participants, parents or carers to consent to photographs, video, audio, quotations or case studies being used for specified purposes such as our website, social media, publicity, press coverage, reports or funding applications.
Media consent will be optional and separate from essential booking and safety requirements wherever practicable. Refusing promotional media consent will not normally prevent someone from participating.
Before giving consent, you will be told the proposed uses. You may withdraw consent for future use by contacting us. Withdrawal will not make earlier lawful use invalid, and we may be unable to remove material already printed, independently shared or lawfully published by third parties.
Marketing
With appropriate permission, we may send information about TanksALot activities, launches, offers, events, fundraising, surveys, volunteering and related opportunities.
You can unsubscribe from marketing at any time by using the unsubscribe option in a message or contacting us. We may retain a minimal suppression record so that we remember not to contact you again for marketing.
We will not sell your contact details. We will not share them with another organisation for that organisation’s independent marketing unless you have been clearly informed and an appropriate lawful basis exists.
Profiling and automated decisions
We may use limited information such as previous bookings, expressed interests, broad location, age group or engagement with our communications to understand our audience and make our communications or services more relevant.
We will not use solely automated decision-making that produces legal or similarly significant effects unless we have a lawful basis, appropriate safeguards and have clearly told the affected person. We will not profile children for behavioural advertising.
Cookies and website analytics
Our website may use cookies and similar technologies. Some are necessary for security, navigation, forms, bookings, account functions or remembering privacy choices. Others may help us understand website use, measure campaigns or provide embedded services.
Non-essential cookies will not be set before any consent required by law has been obtained. You can accept, reject or change your cookie choices using our cookie controls. More detailed and current information about the cookies in use should be provided through our cookie banner or separate Cookie Policy.
If you log in, the website may use cookies to remember login and display preferences. If you leave a comment, cookies may remember the details you choose to save.
Comments, forms and spam prevention
If comments are enabled, we may collect the information entered in the comments form together with technical information such as the visitor’s IP address and browser details to help detect spam, abuse and security threats.
Information submitted through website forms will be used for the purpose explained on the form and for related administration, safety, service improvement and record keeping as described in this policy.
Embedded content and external links
Our website may contain embedded maps, videos, social-media content, booking tools, payment services or links to other websites. Those providers may collect information under their own privacy policies and may use cookies or similar technologies. We do not control independent third-party websites.
Who we may share information with
Where necessary and lawful, we may share relevant information with:
- staff, volunteers and authorised contractors;
- venues, activity partners and group organisers;
- website, hosting, email, booking, customer-management, analytics and IT providers;
- payment processors, banks and accounting providers;
- insurers, professional advisers and claims handlers;
- funders, commissioners, researchers and evaluation partners, normally using anonymous or aggregated information;
- schools, youth organisations, community groups, carers or referral partners where appropriate;
- safeguarding bodies, social-care services, health services, emergency services or regulators where necessary;
- government bodies, courts, law-enforcement agencies or other authorities where required or permitted by law; and
- a successor organisation if TanksALot is reorganised, incorporated, merged, transferred or sold, subject to appropriate protection of personal information.
Service providers acting on our instructions must only use personal information for authorised purposes and must protect it appropriately. Where another organisation decides independently how information will be used, it may be a separate controller and should provide its own privacy information.
International transfers
Some technology providers may store or access information outside the United Kingdom. Where personal information is transferred internationally, we will use an approved legal safeguard where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses.
You may contact us for further information about the safeguards relevant to your information.
How long we retain information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, safety, insurance and accounting requirements. Our typical approach is:
| Record | Typical retention |
|---|---|
| Unsuccessful general enquiries | Up to 24 months after the last meaningful contact |
| Booking, attendance and customer-service records | Normally up to 6 years after the relevant transaction or relationship |
| Financial and tax records | Normally 6 years after the end of the relevant financial period |
| Routine health and accessibility information | Reviewed after the activity or relationship and retained only where still needed for safety, claims, repeat bookings or legal reasons |
| Incident, accident, insurance and safeguarding records | According to the seriousness of the matter, applicable limitation periods, insurance requirements and safeguarding guidance; records involving children may need to be kept for longer |
| Marketing records | Until consent is withdrawn, an objection is made, the information becomes inaccurate, or continued use is no longer justified |
| Suppression records | As long as reasonably necessary to honour the request not to receive marketing |
| Survey and evaluation data | Identifiable information kept only as long as necessary; anonymous statistics may be retained indefinitely |
| Photographs, video and published material | Reviewed periodically and retained while relevant to the stated purpose, unless consent is withdrawn or continued use is no longer appropriate |
| Website security logs | Normally up to 12 months unless needed to investigate an incident |
| Recruitment records for unsuccessful applicants | Normally 6–12 months after the process ends |
These periods may be extended where information is needed for an active complaint, safeguarding matter, legal claim, regulatory requirement or investigation. We may retain anonymous information indefinitely because it no longer identifies an individual.
How we protect information
We use proportionate organisational and technical measures designed to protect information against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, secure accounts, appropriate encryption, backups, staff guidance, confidentiality requirements and review of service providers.
No internet or storage system can be guaranteed to be completely secure. If a personal-data breach creates a risk to people, we will assess it and notify the Information Commissioner’s Office and affected individuals where legally required.
Your data-protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict its use;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain information in a portable format;
- withdraw consent without affecting earlier lawful processing; and
- challenge certain solely automated decisions.
These rights are not absolute, and exemptions may apply. We may need to confirm your identity before responding. We will normally respond within one month.
To exercise a right, contact privacy@tanksalot.co.uk.
Complaints
Please contact us first if you have a concern so that we can try to resolve it.
You also have the right to complain to the Information Commissioner’s Office:
- Website: https://ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this policy
We may update this policy when our activities, systems, partners or legal obligations change. The current version will be published on this page with its latest revision date.
If a change would materially affect how we use existing personal information, we will take reasonable steps to bring it to the attention of affected people and obtain fresh consent where required.
Contact us
Questions, requests and concerns about this policy or the use of personal information should be sent to:
[INSERT FULL LEGAL NAME]
[INSERT POSTAL ADDRESS]
Email: privacy@tanksalot.co.uk