PRIVACY STATEMENT
Sharon Lande trading as 5 STAR HOSPITALITY TRAINING and having her principal place of business at 23 Sycamore Avenue, Lenzie, Glasgow G66 4PA (hereafter referred to as “5 STAR” or “we”, “our” or “us”) is committed to protecting the security and privacy of all personal information or data collected from you. We therefore conduct our business in compliance with applicable laws on data privacy protection and data security. This privacy statement tells you what to expect when we collect and process your personal information.
We try to meet the highest standards when processing your personal information. The data controller who is responsible for how we handle your personal information is 5 Star Hospitality Training. Any queries you have in relation to the same should be directed to sharon.lande@5starhospitalitytraining.com.
Information We May Collect from You & How We Use It
We may ask you to provide certain information about yourself when you use our website or are in contact with us about the services and activities we provide (whether it is by telephone, email, via the forms on our website or even face to face).
There are two distinct groups we have dealings with. These are:
clients and/or service users; and
suppliers and professional advisors.
You are a client or service user if you enquire about or participate in any of our training or simply view our website or make an enquiry about any aspect of our services. It also includes individuals who do not fall into the previous descriptions but who may, for example, choose to subscribe to our newsletter or who browse our website. Personal information collected about this group may include:
Details in relation to your identity such as your name and contact details including your postal/e-mail address and phone number
Transaction details about services you specifically request from us;
Financial details in relation to any services you request including addresses for invoices and payment details;
Profile details from documents you complete on-line or otherwise such as your user name, interests and your transaction history;
Information that you provide to us in relation to participating in any of our training and which will include contact and identity details including gender and date of birth where appropriate as well as qualifications, your employer’s name/details and special requirements you may have;
Information that you provide to us for the purpose of subscribing to our email notifications and/or newsletters;
Information from surveys and feedback forms in respect of any of our services you may have used;
Details of your visits to our website including but not limited to traffic data, location data, weblogs and other communication data and the resources that you access or use.
The personal information we hold about customers and service users will be held solely for the following purposes:
To communicate with you regarding any bookings you have made for any training we organise and to invite you to presentations and events (and to organise meetings with you where necessary);
To advise you of the outcomes of your training and to supply you with any certification in relation thereto;
To make suggestions that may be of interest to you keeping you uptodate regarding our activities whether by newsletter, email, or otherwise;
To administer your booking and payments related thereto;
To comply with our regulatory and legal obligations;
For credit and identity verification and fraud detection;
To administer of our website and business (including webhosting and support) and improve our services.
Our legal basis under GDPR for doing so is either performance of a contract with you, legal obligation or that such processing is in our legitimate interests in respect of running our business including developing our services, ensuring security and performance of our website and informing our overall marketing strategy.
In respect of suppliers and professional advisers personal information collected may include:
Details in relation to your identity such as your name and contact details including your work postal/e-mail address and work phone number, job title and qualifications.
The personal information we hold about suppliers and professional advisers will be held solely for the following purposes:
To administer or maintain records of the services or advice we receive from you including transaction and financial details about services we have requested or received from you and payments which are due in respect of those services;
Transaction details about services you specifically provide us with;
Financial details in relation to the provision of any services by you to us.
Our legal basis under GDPR for doing so is that such processing is required in connection with fulfilling our legal obligations and is in our legitimate interests in respect of running our business including developing our services, ensuring security and performance of our website and informing our overall marketing strategy
Given the nature of the services we provide it is extremely unlikely that we will require to collect any sensitive data about any individuals within any of the groups we have dealings. Sensitive data is personal information which includes your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic or bio-metric data, or information concerning your health or mental well-being or sexual orientation. Where we do require to process such sensitive data to provide services to you we will notify you in advance and will request your express consent in writing to process such sensitive data unless there is some other legal reason which allows us to hold such data. For example, we may request dietary requirements where any event you attend is a catered event but in that case we will try to ensure where possible that we take details of numbers with special dietary requirements rather than names.
If you do not wish us to collect any of the personal information stated above, you should discuss this with us. We can explain the reasons for collection and discuss the consequences of not providing the information or of providing partial or incomplete information and the effect this may have on our ability to provide our services.
Sharing Your Information
We will not sell the personal information that we collect from you and will only use it for the purposes set out in this privacy statement. We may share your personal information with the following parties: -
Service providers who provide us with IT and administration services such as our IT Support and back up provider, our CRM and marketing provider and webhosting company;
Other third-party service providers and suppliers such as venue owners and organisers we use in relation to training that we plan on your behalf (but only in relation to the specific training event you are participating in;
HMRC and other regulatory authorities who require reporting of our activities by law such as the SQA for certification purposes;
Professional advisers such as our lawyers, accountants, bankers, insurers, financial intermediaries or other consultants; and
Third parties to whom we sell, transfer or merge our business or any part of it;
All third parties with whom we share your data are required to protect your personal data, treat it confidentially and to process it in accordance with the law. Where we use third parties we will take all reasonable steps to ensure that they are GDPR compliant and in particular that: -
they have adequate technical and other measures in place to ensure the security of your personal information;
that they only use it for specified purposes;
That any employees or contractors who have access to the information are adequately trained and deal with it on a need to know basis only;
and that they act only in accordance with our instructions.
How Long Do We Keep Your Information?
We will only retain your personal information for as long as is necessary in line with the purposes for which it was originally requested or collected or where we are required to do so for some legal or reporting purpose.
In working out how long we retain personal data we look the type of personal data involved, the purpose of processing, how sensitive or confidential the data is and at legal and commercial considerations including any legal obligations we have. By way of example by law we are required to keep accounting records for six years after end of the year in which the last transaction occurred. This means that we will be required to keep some basic details for that purpose even although our relationship with you may be at an end. However, it should be noted that the requirement is basic details and therefore it is not legitimate to also keep information such as your preferences for that period of time.
If you have any questions relating to either retention periods or more require more detail on the purposes of processing or the specific reason or legal grounds, we are relying on for that processing then please contact us for additional information.
IP Addresses and Cookies
We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about our users' browsing actions and patterns and does not identify any individual. Where we use third party providers such as Google Analytics although these third-party services record data such as your geographical location, device, browser and operation system none of this information identifies you to us. We do not make and do not allow these third-party services to make any attempt to find out the identities of anyone who visits our website.
We also use tracking technology to understand how you interact with content in our emails. This tracking technology allows us to know if the email has been opened and if so how many times which links have been clicked on and whether or not you have shared our content to social media.
Marketing Information
We may provide you with information on services that we may provide. This is regarded as marketing activity. We will only market to you where you have: -
specifically requested marketing information from us; or
Previously acquired similar services/goods from us; or
Consented by way of ticking a box or opting in to receiving marketing from us.
If you have opted out of marketing, we will not send you any future marketing without your consent.
Each time we market to you we will always give you the right to opt out of any future marketing but would point out that you have the right at any time to ask us not to market to you at any time by emailing us at sharon.lande@5starhospitalitytraining.com rather than waiting on a specific opt out.
Security of Personal Data
We take information security very seriously. Your information and records will be stored securely to ensure privacy of your personal data. We take all reasonable steps to ensure that there are technical and organisational measures of security in place to protect your personal data from unauthorised access to or disclosure of it, and against loss or accidental damage or unauthorised alteration of it. Staff handling your personal data are also adequately trained in relation to the legal requirements for handling personal data. These include robust procedures for dealing with breaches including incident reporting and notifying the Information Commissioner, and where appropriate you, of any breaches, the consequences of the same and the remedial action taken.
Where possible the information you provide us with will be held within the European Economic Area (“EEA”) or within the UK.
Overseas Transfers
Countries outside of the EEA do not always have similar levels of protection for personal data as those inside the EEA. The law provides that transfers of personal data outside of the EEA is only permitted where that country has adequate safeguards in place for the protection of personal data. Some types of processing may use cloud solutions which can mean information may sometimes be held on servers which are located outside of the EEA or may use processors who are based overseas.
Where we use cloud-based services or third-party providers of such services and in either or both circumstances the data is processed outside of the EEA that will be regarded as an overseas transfer. Before instigating an overseas transfer, we will ensure that the recipient country and/or processor has security standards at least equivalent to our own and in particular one of the following permitted safeguards applies: -
The country in question is deemed to have adequate safeguards in place as determined by the European Commission; or
There is a contract or code of conduct in place which has been approved by the European Commission which gives your personal information the same protection it would have had if it was retained within the EEA; or
If the overseas transfer is to the United States, then the transferee is a signatory to the EU-US privacy Shield as all Privacy Shield signatories are obliged to give your personal information the same degree of protection it would have had if it was retained within the EEA.
If none of these safeguards exist, then we may seek your explicit consent for an overseas transfer. In line with your rights as an individual you are free to withdraw this consent at any time.
Your Rights
You have rights as an individual which you can exercise in relation to the information we hold about you. These rights are:
the right to restrict processing of your personal data;
the right to rectification or correction of your personal data;
the right to object to processing of your personal data;
the right of erasure of personal data (also referred to the right to be forgotten);
the right not to be subject to a decision based solely on automated processing or profiling;
the right to transfer your personal data (also referred to as the right of portability)
the right to withdraw your consent to processing your personal data; and
the right of access to your personal data.
Additional information about these rights can be found on the Information Commissioner’s website at www.ico.org.uk/for-organisation/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you have provided consent and we are relying on that as the legal ground of processing your personal information and wish to exercise your right to withdraw that consent you can do so at any time by contacting us at sharon.lande@5starhospitalitytraining.com
Access to Personal Information
We try to be as open as we can in giving people access to their personal information. You can make a subject access request at any time about the personal information we process about you. Any request requires to be in writing and is not subject to any charges or fees. If we do hold any personal information about you, we will:
give you a description of it;
tell you why we are holding it;
tell you who it has or will be disclosed to;
the source of the information (if not you);
where possible, the period for which it will be stored; and
let you have a copy of the information in an intelligible form
We will respond to a subject access request within 30 days. On occasion we may need additional information from you to determine your identity or help us find the information more quickly. Where the information you have requested is complex we may take longer than this but shall keep you advised as to progress should this be the case.
If you believe that any information we hold about you is incorrect or incomplete you should email us at sharon.lande@5starhospitalitytraining.com. Any information which is found to be incorrect will be corrected as soon as possible.
Complaints
We would prefer to resolve any issues or concerns you may have direct with you. If you feel you are unable to resolve matters by contacting us direct or are you are unhappy or dissatisfied with how we collect or process your personal information you have the right to complain about it to the Information Commissioner who is the statutory body which overseas data protection law. They can be contacted through www.ico.org.uk/concerns.
Contact
Questions, comments and requests regarding this privacy statement are welcomed and should be addressed to sharon.lande@5starhospitalitytraining.com.
Changes to this Privacy Statement
We keep our privacy notice under regular review. This privacy notice was last updated on 22nd November 2018.
PRIVACY STATEMENT
Sharon Lande trading as 5 STAR HOSPITALITY TRAINING and having her principal place of business at 23 Sycamore Avenue, Lenzie, Glasgow G66 4PA (hereafter referred to as “5 STAR” or “we”, “our” or “us”) is committed to protecting the security and privacy of all personal information or data collected from you. We therefore conduct our business in compliance with applicable laws on data privacy protection and data security. This privacy statement tells you what to expect when we collect and process your personal information.
We try to meet the highest standards when processing your personal information. The data controller who is responsible for how we handle your personal information is 5 Star Hospitality Training. Any queries you have in relation to the same should be directed to sharon.lande@5starhospitalitytraining.com.
Information We May Collect from You & How We Use It
We may ask you to provide certain information about yourself when you use our website or are in contact with us about the services and activities we provide (whether it is by telephone, email, via the forms on our website or even face to face).
There are two distinct groups we have dealings with. These are:
clients and/or service users; and
suppliers and professional advisors.
You are a client or service user if you enquire about or participate in any of our training or simply view our website or make an enquiry about any aspect of our services. It also includes individuals who do not fall into the previous descriptions but who may, for example, choose to subscribe to our newsletter or who browse our website. Personal information collected about this group may include:
Details in relation to your identity such as your name and contact details including your postal/e-mail address and phone number
Transaction details about services you specifically request from us;
Financial details in relation to any services you request including addresses for invoices and payment details;
Profile details from documents you complete on-line or otherwise such as your user name, interests and your transaction history;
Information that you provide to us in relation to participating in any of our training and which will include contact and identity details including gender and date of birth where appropriate as well as qualifications, your employer’s name/details and special requirements you may have;
Information that you provide to us for the purpose of subscribing to our email notifications and/or newsletters;
Information from surveys and feedback forms in respect of any of our services you may have used;
Details of your visits to our website including but not limited to traffic data, location data, weblogs and other communication data and the resources that you access or use.
The personal information we hold about customers and service users will be held solely for the following purposes:
To communicate with you regarding any bookings you have made for any training we organise and to invite you to presentations and events (and to organise meetings with you where necessary);
To advise you of the outcomes of your training and to supply you with any certification in relation thereto;
To make suggestions that may be of interest to you keeping you uptodate regarding our activities whether by newsletter, email, or otherwise;
To administer your booking and payments related thereto;
To comply with our regulatory and legal obligations;
For credit and identity verification and fraud detection;
To administer of our website and business (including webhosting and support) and improve our services.
Our legal basis under GDPR for doing so is either performance of a contract with you, legal obligation or that such processing is in our legitimate interests in respect of running our business including developing our services, ensuring security and performance of our website and informing our overall marketing strategy.
In respect of suppliers and professional advisers personal information collected may include:
Details in relation to your identity such as your name and contact details including your work postal/e-mail address and work phone number, job title and qualifications.
The personal information we hold about suppliers and professional advisers will be held solely for the following purposes:
To administer or maintain records of the services or advice we receive from you including transaction and financial details about services we have requested or received from you and payments which are due in respect of those services;
Transaction details about services you specifically provide us with;
Financial details in relation to the provision of any services by you to us.
Our legal basis under GDPR for doing so is that such processing is required in connection with fulfilling our legal obligations and is in our legitimate interests in respect of running our business including developing our services, ensuring security and performance of our website and informing our overall marketing strategy
Given the nature of the services we provide it is extremely unlikely that we will require to collect any sensitive data about any individuals within any of the groups we have dealings. Sensitive data is personal information which includes your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic or bio-metric data, or information concerning your health or mental well-being or sexual orientation. Where we do require to process such sensitive data to provide services to you we will notify you in advance and will request your express consent in writing to process such sensitive data unless there is some other legal reason which allows us to hold such data. For example, we may request dietary requirements where any event you attend is a catered event but in that case we will try to ensure where possible that we take details of numbers with special dietary requirements rather than names.
If you do not wish us to collect any of the personal information stated above, you should discuss this with us. We can explain the reasons for collection and discuss the consequences of not providing the information or of providing partial or incomplete information and the effect this may have on our ability to provide our services.
Sharing Your Information
We will not sell the personal information that we collect from you and will only use it for the purposes set out in this privacy statement. We may share your personal information with the following parties: -
Service providers who provide us with IT and administration services such as our IT Support and back up provider, our CRM and marketing provider and webhosting company;
Other third-party service providers and suppliers such as venue owners and organisers we use in relation to training that we plan on your behalf (but only in relation to the specific training event you are participating in;
HMRC and other regulatory authorities who require reporting of our activities by law such as the SQA for certification purposes;
Professional advisers such as our lawyers, accountants, bankers, insurers, financial intermediaries or other consultants; and
Third parties to whom we sell, transfer or merge our business or any part of it;
All third parties with whom we share your data are required to protect your personal data, treat it confidentially and to process it in accordance with the law. Where we use third parties we will take all reasonable steps to ensure that they are GDPR compliant and in particular that: -
they have adequate technical and other measures in place to ensure the security of your personal information;
that they only use it for specified purposes;
That any employees or contractors who have access to the information are adequately trained and deal with it on a need to know basis only;
and that they act only in accordance with our instructions.
How Long Do We Keep Your Information?
We will only retain your personal information for as long as is necessary in line with the purposes for which it was originally requested or collected or where we are required to do so for some legal or reporting purpose.
In working out how long we retain personal data we look the type of personal data involved, the purpose of processing, how sensitive or confidential the data is and at legal and commercial considerations including any legal obligations we have. By way of example by law we are required to keep accounting records for six years after end of the year in which the last transaction occurred. This means that we will be required to keep some basic details for that purpose even although our relationship with you may be at an end. However, it should be noted that the requirement is basic details and therefore it is not legitimate to also keep information such as your preferences for that period of time.
If you have any questions relating to either retention periods or more require more detail on the purposes of processing or the specific reason or legal grounds, we are relying on for that processing then please contact us for additional information.
IP Addresses and Cookies
We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about our users' browsing actions and patterns and does not identify any individual. Where we use third party providers such as Google Analytics although these third-party services record data such as your geographical location, device, browser and operation system none of this information identifies you to us. We do not make and do not allow these third-party services to make any attempt to find out the identities of anyone who visits our website.
We also use tracking technology to understand how you interact with content in our emails. This tracking technology allows us to know if the email has been opened and if so how many times which links have been clicked on and whether or not you have shared our content to social media.
Marketing Information
We may provide you with information on services that we may provide. This is regarded as marketing activity. We will only market to you where you have: -
specifically requested marketing information from us; or
Previously acquired similar services/goods from us; or
Consented by way of ticking a box or opting in to receiving marketing from us.
If you have opted out of marketing, we will not send you any future marketing without your consent.
Each time we market to you we will always give you the right to opt out of any future marketing but would point out that you have the right at any time to ask us not to market to you at any time by emailing us at sharon.lande@5starhospitalitytraining.com rather than waiting on a specific opt out.
Security of Personal Data
We take information security very seriously. Your information and records will be stored securely to ensure privacy of your personal data. We take all reasonable steps to ensure that there are technical and organisational measures of security in place to protect your personal data from unauthorised access to or disclosure of it, and against loss or accidental damage or unauthorised alteration of it. Staff handling your personal data are also adequately trained in relation to the legal requirements for handling personal data. These include robust procedures for dealing with breaches including incident reporting and notifying the Information Commissioner, and where appropriate you, of any breaches, the consequences of the same and the remedial action taken.
Where possible the information you provide us with will be held within the European Economic Area (“EEA”) or within the UK.
Overseas Transfers
Countries outside of the EEA do not always have similar levels of protection for personal data as those inside the EEA. The law provides that transfers of personal data outside of the EEA is only permitted where that country has adequate safeguards in place for the protection of personal data. Some types of processing may use cloud solutions which can mean information may sometimes be held on servers which are located outside of the EEA or may use processors who are based overseas.
Where we use cloud-based services or third-party providers of such services and in either or both circumstances the data is processed outside of the EEA that will be regarded as an overseas transfer. Before instigating an overseas transfer, we will ensure that the recipient country and/or processor has security standards at least equivalent to our own and in particular one of the following permitted safeguards applies: -
The country in question is deemed to have adequate safeguards in place as determined by the European Commission; or
There is a contract or code of conduct in place which has been approved by the European Commission which gives your personal information the same protection it would have had if it was retained within the EEA; or
If the overseas transfer is to the United States, then the transferee is a signatory to the EU-US privacy Shield as all Privacy Shield signatories are obliged to give your personal information the same degree of protection it would have had if it was retained within the EEA.
If none of these safeguards exist, then we may seek your explicit consent for an overseas transfer. In line with your rights as an individual you are free to withdraw this consent at any time.
Your Rights
You have rights as an individual which you can exercise in relation to the information we hold about you. These rights are:
the right to restrict processing of your personal data;
the right to rectification or correction of your personal data;
the right to object to processing of your personal data;
the right of erasure of personal data (also referred to the right to be forgotten);
the right not to be subject to a decision based solely on automated processing or profiling;
the right to transfer your personal data (also referred to as the right of portability)
the right to withdraw your consent to processing your personal data; and
the right of access to your personal data.
Additional information about these rights can be found on the Information Commissioner’s website at www.ico.org.uk/for-organisation/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you have provided consent and we are relying on that as the legal ground of processing your personal information and wish to exercise your right to withdraw that consent you can do so at any time by contacting us at sharon.lande@5starhospitalitytraining.com
Access to Personal Information
We try to be as open as we can in giving people access to their personal information. You can make a subject access request at any time about the personal information we process about you. Any request requires to be in writing and is not subject to any charges or fees. If we do hold any personal information about you, we will:
give you a description of it;
tell you why we are holding it;
tell you who it has or will be disclosed to;
the source of the information (if not you);
where possible, the period for which it will be stored; and
let you have a copy of the information in an intelligible form
We will respond to a subject access request within 30 days. On occasion we may need additional information from you to determine your identity or help us find the information more quickly. Where the information you have requested is complex we may take longer than this but shall keep you advised as to progress should this be the case.
If you believe that any information we hold about you is incorrect or incomplete you should email us at sharon.lande@5starhospitalitytraining.com. Any information which is found to be incorrect will be corrected as soon as possible.
Complaints
We would prefer to resolve any issues or concerns you may have direct with you. If you feel you are unable to resolve matters by contacting us direct or are you are unhappy or dissatisfied with how we collect or process your personal information you have the right to complain about it to the Information Commissioner who is the statutory body which overseas data protection law. They can be contacted through www.ico.org.uk/concerns.
Contact
Questions, comments and requests regarding this privacy statement are welcomed and should be addressed to sharon.lande@5starhospitalitytraining.com.
Changes to this Privacy Statement
We keep our privacy notice under regular review. This privacy notice was last updated on 22nd November 2018.