Data privacy notice

General principles

Personal data – what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the ‘GDPR’).

Who are we?

The Honourable Society of Gray’s Inn (herein after referred to as ‘the Inn’) is the data controller (contact details below), which means it decides how personal data is processed and for what purposes. Searcys provides catering services as a partner at The Honourable Society of Gray’s Inn. Searcys is the data processor for the Venue, The Honourable Society of Gray’s Inn remains the data controller.

How do we process personal data?

The Inn complies with its obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining unnecessary amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

Processing

The Inn will only process data where it has a lawful reason for doing so. GDPR defines six lawful reasons for processing personal data, three of which are relevant to the Inn. These are:

Where there is a Legitimate Interest of the Inn or a third party for the processing to take place
Where the Inn has the consent of the individual
Where there is a contract between the Inn and the individual which enables or requires the Inn to undertake processing

The Inn actively manages the processing of personal data and does not rely on automated processes.

Further processing

If the Inn wishes to use your personal data for a new purpose, not covered by this Data Privacy Notice, then it will provide individuals with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where necessary, we will seek prior consent to the new processing.

Individual’s rights and personal data

Unless subject to an exemption under the GDPR, individuals have the following rights with respect to their personal data:

The right to request a copy
The right to request that the Inn corrects any personal data if it is found to be inaccurate or out of date
The right to request that personal data is erased where it is no longer necessary for the Inn to retain such data
The right to withdraw consent to the processing at any time (only applicable where ‘consent’ is detailed as the basis for Lawfulness of Processing)
The right, where there is a dispute in relation to the accuracy or processing of personal data, to request a restriction is placed on further processing
The right to object to the processing of personal data, (where ‘Legitimate Interest’ is the basis of Lawfulness of Processing)
The right to lodge a complaint with the Information Commissioners Office

Contact Details

For all enquiries or to exercise any of the above rights, individuals should contact The Director of Finance, The Honourable Society of Gray’s Inn, 8 South Square, Gray’s Inn, London, WC1R 5ET.

You can contact the Information Commissioners Office on 0303 123 1113, via email or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Personal data which we collect

Personal data provided by you

We only collect personal information that we know we will genuinely use and in accordance with the relevant Data Protection Legislation.

We collect personal data about you when you:

book an event or catering service at Gray’s Inn
contact us through our website
sign up to receive our newsletter
complete customer feedback or surveys
participate in competitions or prize draws

The personal data collected in the above manner may include:

full name;
postal address;
email address;
telephone number;
Personal data provided by 3rd parties
We may receive information about you from other sources (such as online table and event reservation providers), which we will add to the information we already hold about you in order to help us improve how we provide our services to you.

Special categories of personal data

We do not proactively collect special category personal data via our website such as health information. However, our website does include text boxes which are designed for you to provide us with further information, and you should be aware that information you freely submit may reveal to us certain information that may be considered special category personal information such as information relating to your allergens.

Personal data about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can: give consent on his/her behalf to the processing of his/her personal data; receive on his/her behalf any data protection notices;

give consent to the transfer of his/her personal data outside the United Kingdom (“UK”) and European Economic Area (“EEA”); and

How and why we use your personal data

Under data protection law, we can only use your personal data if we have a legal basis, e.g.:

a. where you have given consent;

b. to comply with our legal and regulatory obligations;

c. for the performance of a contract with you or to take steps at your request before entering into a contract; or

d. for our legitimate interests or those of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests. When relying on this legal basis, we will carry out an assessment to balance our interests against yours.

The table below explains what we use your personal data for and why:

What we use your personal data for	Our legal basis
Process any orders for goods and/or services which you make with us	Performance of a contract with you or to take steps to enter into a contract at your request
Assist you with your queries in relation to our business and/or venues	Performance of a contract with you or to take steps at your request before entering into a contract
Detect and prevent fraud	Compliance with our legal and regulatory obligations
Customise our website and its content to your particular preferences	Consent (where we are not required to obtain your consent and do not do so, for our legitimate interests i.e. to provide you with information (as a prospect or existing customer) we consider may be useful to you))
Notify you of any changes to our website or to our services that may affect you	Compliance with our legal and regulatory obligations
Provide you with marketing materials and information about our business and services	Consent (where we are not required to obtain your consent and do not do so, for our legitimate interests i.e. to provide you with information (as a prospect or existing customer) we consider may be useful to you))
Develop and improve our website, business and services	Consent (where we are not required to obtain your consent and do not do so, for our legitimate interests i.e. to provide you with information (as a prospect or existing customer) we consider may be useful to you))

Sharing your personal data

Your personal data will be treated as strictly confidential, and will be shared only with Inn employees or members whose responsibilities require that they have access to the data. We will only share your data with third parties, outside of the Inn, with your consent or acting under instruction from appropriate legal or regulatory authority.

How long we keep your personal data for

We shall only retain your information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.