1. Who we are
Mansfield Forward BID (“we”, “us”, “our”) is the data controller for personal data collected through this website unless stated otherwise. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
2. What personal data we collect
Depending on how you use our website, we may collect:
- Identity & contact data: name, email address, telephone number, business name and address.
- Form submission data: information you provide when completing enquiries, membership applications, event registrations, or other online forms.
- Technical data: IP address (hashed where possible), browser type, device information, and pages visited.
- Communication data: emails you send us and records of correspondence.
- Marketing preferences: where you opt in to newsletters or updates.
We do not intentionally collect special category data (e.g. health, ethnicity, religion) unless a specific form clearly requires it and explains why.
3. Lawful bases for processing
We process personal data only where we have a lawful basis:
- Consent — e.g. optional marketing emails, non-essential cookies.
- Contract — to perform services you request or prepare to enter a contract (e.g. membership, bookings).
- Legal obligation — where we must comply with law (e.g. accounting records).
- Legitimate interests — to operate and improve our website, prevent fraud, and communicate about BID activities, balanced against your rights.
5. Email communications & privacy by design
When we send emails from this website:
- Automated emails use a consistent Mansfield Forward BID branded template.
- Confirmation emails sent to you contain only your own submission details — personal data belonging to other individuals is redacted.
- Outgoing mail is logged for delivery monitoring, duplicate detection, and GDPR compliance. Logs store metadata (recipient, subject, status) — not full message bodies — and are retained in line with our retention policy.
- We monitor for send failures and bounces to maintain accurate contact records.
You may unsubscribe from marketing emails at any time using the link in the email or by contacting us.
6. Sharing data & processors
We do not sell your personal data. We may share it with:
- Hosting and IT providers who operate our website and email infrastructure.
- Form, booking, or payment processors where necessary to deliver a service you request.
- Professional advisers or authorities where required by law.
All processors are bound by data processing agreements and must protect your data to UK GDPR standards.
7. How long we keep data
We retain personal data only as long as necessary:
- Form submissions: for the duration of the business relationship plus a reasonable period for enquiries and legal claims (typically up to 6 years where relevant).
- Email delivery logs: typically up to 12 months unless needed for security investigations.
- Marketing records: until you withdraw consent or object.
- Cookie consent records: as required to demonstrate compliance.
Data is securely deleted or anonymised when no longer needed.
8. Your rights
Under UK GDPR you have the right to:
- Access a copy of your personal data.
- Rectify inaccurate data.
- Erase data in certain circumstances (“right to be forgotten”).
- Restrict or object to processing.
- Data portability where processing is automated and based on consent or contract.
- Withdraw consent at any time (without affecting prior lawful processing).
- Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
We will respond to valid requests within one month. We may need to verify your identity before releasing data.
9. Security measures
We implement appropriate technical and organisational measures including:
- HTTPS encryption for data in transit.
- Access controls limiting staff access to personal data.
- PII redaction in outbound emails to prevent disclosure to unintended recipients.
- Regular software updates and monitoring for suspicious activity.
- Staff training on data protection and incident reporting.
No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we work continuously to reduce risk.
10. Personal data breach procedure
A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Our internal response
- Contain: immediately limit further exposure (e.g. disable affected accounts, revoke credentials, isolate systems).
- Assess: determine what data was affected, how many individuals are impacted, and the likely risk to their rights and freedoms.
- Document: record the nature of the breach, categories of data, approximate number of people affected, likely consequences, and remedial actions taken.
- Notify the ICO within 72 hours where the breach is likely to result in a risk to individuals (unless the breach is unlikely to pose such a risk).
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (unless exceptions apply, e.g. data was encrypted).
- Review: conduct a post-incident review and implement measures to prevent recurrence.
What we would tell you
If you are affected by a notifiable breach, we will explain in clear language:
- What happened and when we became aware.
- What types of personal data were involved.
- What we are doing to address the breach and mitigate harm.
- Steps you can take to protect yourself (e.g. change passwords, monitor accounts).
- How to contact us for further information.
If you believe your data may have been compromised, please contact us immediately at info@mansfieldforward.bid.
11. Children
Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it promptly.
12. Contact us
For any questions about this notice, cookies, your personal data, or to exercise your rights, contact us at:
Mansfield Forward BID
Email: info@mansfieldforward.bid
Website: www.mansfieldforward.bid
