Privacy Policy

1. Who We Are

Data Observatory Community Interest Company (Data Observatory CIC) is a UK-registered Community Interest Company (Company Number 16571877), registered at 167–169 Great Portland Street, London, W1W 5PF.

We are the data controller for the personal information collected through this website (dataobservatory.org.uk).

If you have any questions about this policy or how we handle your data, please contact us:

2. What Personal Data We Collect

We collect personal data in the following ways:

2.1 Contact Form

When you submit an enquiry through our contact form, we collect your name, email address, type of enquiry, and the message you provide. This data is transmitted via FormSubmit to our organisational email address and is used solely to respond to your enquiry.

2.2 Newsletter Sign-Up

If you subscribe to our newsletter via the footer of our website, we collect your email address for the purpose of sending you updates about our work, publications, and events.

2.3 Website Analytics

With your consent, we use Google Analytics 4 to collect anonymised data about how visitors use our website. This may include pages visited, time spent on the site, approximate geographic location (country or region level only), device type, and browser type. IP addresses are anonymised and we do not collect any personally identifiable information through analytics.

Analytics cookies are only set if you click "Accept" on our cookie consent banner. If you click "Reject", no analytics data is collected.

2.4 Publicly Available Professional Information

Our website displays the names, job titles, professional biographies, photographs, and LinkedIn profile links of our board members, council members, advisors, and fellows. This information is published in the public interest and in the course of our legitimate activities as a professional membership and advisory organisation. Much of this information is publicly available through professional networks and other public sources.

If you are an individual whose information appears on our website and you wish to request amendment or removal, please contact us at office@dataobservatory.org.uk.

3. Our Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

4. How We Use Your Personal Data

We use the personal data we collect to:

• Respond to your enquiries and provide the information or services you have requested
• Send you our newsletter and updates about our work (where you have subscribed)
• Understand how our website is used and improve the user experience (where you have consented to analytics)
• Promote our organisation, its members, and their professional achievements
• Comply with our legal and regulatory obligations

We will never sell your personal data to third parties, use it for unsolicited marketing beyond what you have consented to, or share it with any party not listed in this policy.

5. Third-Party Services and Data Processors

We use a small number of trusted third-party services to operate our website. Each acts as a data processor on our behalf:

All third-party processors are required to handle your data securely and in accordance with applicable data protection law. Where services are based outside the UK or European Economic Area, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

6. Cookies

Our website uses cookies and similar technologies. We categorise these as follows:

You can withdraw your consent to analytics cookies at any time by clearing your browser's local storage or by contacting us. Essential cookies cannot be disabled as they are necessary for the website to function correctly.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary:

• Contact form enquiries: retained for up to 12 months, then securely deleted
• Newsletter subscriptions: retained until you unsubscribe
• Analytics data: retained by Google Analytics for up to 14 months (configured at minimum retention)
• Professional profiles (board, council, fellows): retained while the individual holds their role or until a removal request is received
• Server logs: retained by Hostinger in accordance with their data retention policy (typically 30 days)

8. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your personal data in certain circumstances
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a structured, machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at office@dataobservatory.org.uk. We will respond within 30 days. There is no charge for making a request.

9. Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's supervisory authority:

We would, however, always appreciate the opportunity to address your concerns directly before you approach the ICO. Please contact us first at office@dataobservatory.org.uk.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website is served over HTTPS, access to data is restricted to those who need it, and we review our security practices regularly.

While we take every reasonable precaution, no method of transmission over the internet is completely secure. If you have concerns about the security of your data, please contact us.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page shows when the policy was last updated. We encourage you to review this page periodically.

Continued use of our website after any changes constitutes your acceptance of the updated policy.