This policy explains:
- What personal information we collect and why we collect it.
- How we use that information.
- Sharing your information.
- How to get a copy of your information.
- How to update or delete your information.
- How to object or complain.
The Trustees of CSBT is a data controller registered with the Information Commissioner’s Office. Our registration number is Z8958240. We are also occasionally referred to as the Clifton Suspension Bridge.
We are a registered charity and our number is: 205658.
Our contact details are at the end of this policy. If you would like to speak to someone about our use of your personal data, please ask to speak to the Bridge Master.
Information about you
We collect different types of personal information in the day-to-day running of the Bridge and the Visitor Centre. When you visit the Visitor Centre, cross over the Bridge, or visit our website, we may collect the following information about you:
- your name and contact details if you make a tour booking
- your payment card information, if you pay by credit or debit card for a bridge crossing card
- your name and address, and in some cases proof of concession, for delivering and administering your bridge crossing card
- your image may be picked up on our CCTV
- your email address if you join our mailing list
- your name and address if you are making a donation to the Visitor Centre and making a declaration for Gift Aid.
We are committed to keeping your personal information safe. Your information will only be used for a specific purpose – such as monitoring the use of the bridge, administering your crossing card, communicating news you have subscribed to, or booking you on a tour. Your personal details will not be used for unauthorised marketing or sold to any other organisations.
When we use your information in this way, we do so on the basis that it is necessary for the performance of a contract between you and us (for example, when you make a booking or purchase a bridge crossing card), that is it in our legitimate interests to do so (please see ‘CCTV’ below for more details) or, where applicable, because you have consented to the use of your data in the manner for which we have informed you.
Your information is kept and processed securely. This processing is either carried out by our office employees or, if given online, externally by trusted third parties.
We keep your personal information for as long as necessary and then it is securely destroyed. In general, this means that information is no longer kept if you no longer have contact with us; however, some information may be kept for longer – usually 7 years – for health and safety, or audit purposes.
For more detailed information about how long different types of data is stored, please contact us for a copy of our Retention Schedule. Our contact details are at the end of this policy.
Your personal contact information: NHS Test and Trace
Please note that if someone tests positive for Covid-19 Virus within 21 days of your visit to the Visitor Centre your personal contact information may be shared with the NHS Test and Trace service.
Your personal information will be used only to share with NHS Test and Trace service and will not be used for other purposes, including marketing, profiling, analysis or other purposes unrelated to contact tracing. After 21 days your personal contact information will be securely destroyed.
‘Cookies’ are text-only pieces of information that are sent to your browser. A cookie typically contains the domain name of the website where the cookie has come from, the ‘lifetime’ of the cookie and a randomly generated unique code.
It is usual for most internet browsers to automatically accept cookies. However, by editing your browser options, you can delete existing cookies from your browser and choose not to receive cookies in the future.
If you do not want your web-browsing activity being monitored by Google Analytics, you can opt out by installing the ‘Google Analytics opt-out browser add-on’ which can be found here.
Our mailing list is processed securely on our behalf by Mail Chimp.
Mail Chimp are based in the USA and so if you would like to sign up to our mailing list please bear in mind that we will transfer your data outside of the European Economic Area (EEA) to the USA. If you are not happy for us to do this, please do not sign up to our mailing list.
Mail Chimp annually self-certifies with the EU-US Privacy Shield. This is a standard framework that was written by the European Commission and the US Department of Commerce to protect the fundamental rights of anyone in the EU whose personal data is transferred to the United States.
If you sign up to our mailing list, we will not pass on your email address and personal details to any other organisation or person. You can unsubscribe at any time, at which point your information will be deleted.
Booking a Tour online
When booking a tour online, your personal details will be securely processed on our behalf through your account with Eventbrite.
Eventbrite is a company that is based in the USA and so if you would like to book a tour online please bear in mind that we will transfer your data outside of the European Economic Area to the USA.
If you do not want to create an account with Eventbrite, please contact us via the phone to make your booking.
Paying for a crossing card online
We do not directly store or collect your payment card information on our IT systems. We use a trusted third party – World Pay – to process payments online. This company has an active PCI-DSS compliance programme in place. This is the international standard for safe card payment processes and is designed to keep your personal information secure.
Clifton Suspension Bridge Trust is committed to making sure that the Bridge is looked after and that everybody who uses the Bridge and Visitor Centre is safe. For this purpose, CCTV cameras are fitted. Unless an incident is recorded, video footage is kept for 28 days and then routinely and securely destroyed. Access to all footage is strictly controlled and no facial recognition or car registration recognition software is used.
Very occasionally CCTV footage is kept longer than 28 days for research purposes – for instance when analysing the performance of the bridge under specific traffic and weather conditions. Before using any footage, we make sure that any personal information is anonymised first.
Sharing your information
We will only share your personal information with authorised third parties, (e.g. the police, insurance companies), if there is an incident, or if it is in the public interest to do so. Any sharing of your personal information with authorised third parties will only be done where we have established that such sharing complies with data protection legislation.
Accessing your information
You have a right to ask for any personal information that we hold about you. This includes video footage and an application for it and any other personal information can be made through a Subject Access Request Form (click to download from the bottom of this page) or by writing to us at the address below.
Please note that we can only provide personal information that relates to you if it does not risk the privacy of others. Occasionally we may reject requests that are unreasonably repetitive. There may also be a charge for cases that require a disproportionate effort.
Updating or deleting your information
Please let us know if any of your details are out-of-date, not correct, or if you would like to unsubscribe from the mailing list and we will change your details as soon as possible.
Clifton Suspension Bridge Trust
Bridge Master’s Office
Tel: 0117 9731579
A right to object
If you have any objections or questions about how your personal information is used, please email the Bridge Master.
If you wish to follow-up the complaint further then please contact the Information Commissioner. More information about your right to privacy can be found on the Information Commissioner’s Office website.
This page will be looked at regularly and updated with any changes. This Privacy and Cookies Policy was last changed on: 01 September 2020.