When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.
Media
If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.
Cookies
If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.
Embedded content from other websites
Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Who we share your data with
If you request a password reset, your IP address will be included in the reset email.
How long we retain your data
If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
What rights you have over your data
The GDPR provides the following rights for individuals:
1 The right to be informed (Article 13 and 14)
You have the right to be informed about the collection and use of your personal data. A privacy notice will be provided to you at the time your personal data is collected and will explain simply and clearly how and why we intend to process your data. This information will be on the website or will accompany the form you complete.
2 The right of access (Article 15)
Individuals have the right to access their personal data. This is commonly referred to as subject access. Individuals can make a subject access request verbally or in writing. The CNC have one month to respond to a request and cannot charge a fee to deal with a request in most circumstances.
3 The right to rectification (Article 16)
You have a right to rectification of inaccurate personal information and to update incomplete personal information.
If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information.
Rectification can be achieved by adding to the record or creating a supplementary record. Even if we decide that the information is correct, we will place a statement from you on the record with the data you believe to be correct or stating your dispute.
4 The right to erasure (Article 17)
You may request that we delete your personal information if you believe that:
we no longer need to process your information for the purposes for which it was provided
we have requested your permission to process your personal information and
you wish to withdraw your consent; or
we are not using your information in a lawful manner
5 The right to restrict processing (Article 18)
You have a right to request to restrict the processing of your personal information. You may request to restrict processing your personal information if you believe that:
any of the information that we hold about you is inaccurate
we no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims
we are not using your information in a lawful manner
6 The right to data portability (Article 20)
Where we have requested your permission to process your personal information, you have a right to receive the personal information you provided to us in a portable format.
You may also request to provide it directly to a third party, if technically feasible. We’re not responsible for any such third party’s use of your information, which will be governed by their agreement with you and any privacy statement they provide to you.
Please note that this right only applies to data that is being processed electronically.
7 The right to object (Article 21)
You must tell us your circumstances justifying your objection to processing. Please be aware that we can still process personal information where there are compelling grounds, or it is necessary for legal claims.
8 Rights in relation to automated decision making and profiling. (Article 22)
You have three rights in relation to automated decision taking, including profiling, where the result will have legal or other significant effects on you.
The first is the right to prevent such a decision being taken. You can give written notice asking us not to take an automated decision.
The second right applies where no such notice has been given. You must be informed, as soon as is practicable in the circumstances, that an automated decision has been made.
The third right relates to the options available to you on receiving notification of an automated decision. If you are unhappy that an automated decision has been taken, you have 21 days to ask the CNC to reconsider the decision or to take a new decision on a different basis.
If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
Where your data is
Visitor comments may be checked through an automated spam detection service.
‘XYZ’ Organisation Privacy Notice
Our contact details
Name:
Address:
Phone Number:
E-mail:
What type of information we have
We currently collect and process the following information:
Personal identifiers, contacts and characteristics (for example, name and contact details)
[Add to this list as appropriate]
How we get the information and why we have it
Most of the personal information we process is provided to us directly by you for one of the following reasons:
[Add the reasons you collected personal information]
[If applicable] We also receive personal information indirectly, from the following sources in the following scenarios:
[Add the source of any data collected indirectly and why you collected the information]
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are: [delete as appropriate]
(a) Your consent. You are able to remove your consent at any time. You can do this by contacting [contact details]
(b) We have a contractual obligation.
(c) We have a legal obligation.
(d) We have a vital interest.
(e) We need it to perform a public task.
(f) We have a legitimate interest.
What we do with the information we have
We use the information that you have given us in order to [list how you use the personal information].
We may share this information with [enter organisations or individuals]
How we store your information
Your information is securely stored [enter location].
We keep [type of personal information] for [time period]. We will then dispose your information by [explain how you will delete their data]
Your data protection rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing – You have the the right to object to the processing of your personal data in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at [insert email address, phone number and or postal address] if you wish to make a request.
How to complain
You can also complain to the ICO if you are unhappy with how we have used your data.