Privacy Notice

This Privacy Notice sets out the details of how The Sound Bothy ("we", "us", "our") as data controller, collects and processes your personal data obtained directly from you, or through our website located at www.thesoundbothy.com or our other online platforms and social media channels which, for the purposes of this privacy notice, shall be collectively referred to as ("the Website").

For the purposes of this Privacy Notice, personal data shall mean any information that can be used to identify an individual whether directly or indirectly ("Personal Data").

Please read through the content of this Privacy Notice carefully and ensure that you understand it. If you do not understand the content of this Privacy Notice or do not accept or agree with it then you must stop using the Website and/or accessing our other online platforms, social media groups and any other associated groups or pages immediately. If you have already provided us with any Personal Data then you must contact us immediately.

By accessing the Website and providing us with your Personal Data you are warranting that you are over 18 years of age.

If you have any questions about this Privacy Notice or require more information concerning our privacy and data protection practices please contact us at hello@thesoundbothy.com.

What personal data do we process, why do we process it, and how do we collect it

We may process Personal Data that you provide to us by subscribing to a newsletter or email list, requesting information through a contact form, or by any other communication via email, text, social media, or through our Website.

We may also process your personal data through the use of cookies or other tracking software on our Website. Please refer to our separate cookie policy for further information.

We may also process Personal Data received from third parties such as Facebook (Meta), Google, Instagram (Meta), SubStack, Zoho Mail, Messenger (Meta), WhatsApp (Meta), Zcal, Zoom, AWS (Part of Amazon), Royal Mail, Stripe, Amazon Pay, Rybbit and M4trix Dev Ltd or other information, analytic, advertising, search or payment processing providers or services.

When we process your Personal Data we will comply with the relevant data protection laws and principles in the United Kingdom, specifically the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 (as amended). This means that your data will be used lawfully, fairly, and in a transparent way, kept securely, and only for as long as necessary for the purposes we have told you about.

We shall only collect and process your Personal Data for purposes that are clearly outlined prior to you providing us with your data, or for a legitimate reason.

Whenever we process your Personal Data we do so on the basis of a lawful condition. This will either be because you have given your consent for us to process your data, where we are under a contractual or legal obligation, or where it is in our legitimate interests to do so.

We do not carry out automated decision-making, including profiling, in relation to your personal data.

The types of Personal Data which we process will vary depending on your own specific circumstances but typically can include:

• Personal Information: this may include your name, date of birth, email address, phone number, business contact details, correspondence address, and IP address. We shall process this data for the purposes of communicating with you and keeping our records on the lawful grounds of legitimate interest.
• Customer or Client Information: should you purchase goods and/or services from us then we may process information in connection with your purchase, and the supply of that purchase, as well as keeping appropriate records. Such information may include your Personal Information, billing address, delivery address, credit card or other payment details, and we shall process it on contractual grounds.
• User Information: this may include comments or statements that you may make or post via our Website, online platforms, or social media channels; images, documents, or videos that you share on or through our Website or through any of our pages or other online platforms; and information concerning your use of our Website or other online platforms such as your browser information, pixel ID, page views, pages visited, number of visits, and where appropriate, log-in details. We shall process this information to analyse and monitor usage and content of our Website and other platforms and channels to ensure the content is relevant to you, to support our administration and record-keeping requirements, and to maintain the security of our systems on legitimate interest grounds.
• Promotional Information: this may include information you provide in connection with any promotions, marketing, or advertising from us or our third parties. We shall use this information to provide relevant offers and advertisements, competitions and promotions, and other free resources, and to monitor our promotional activity, keep records, and compile analytics on legitimate interest grounds.
• Review and Testimonial Information: this includes feedback and information you provide via email or text message in connection with any goods and/or services you have purchased or experienced from us. Such information may include your personal experience and your preferred display name (such as your first name or initials). We shall use this information to display customer testimonials and promote our business on our website, social media pages, or other online platforms on the grounds of your consent.

We may also process your Personal Data to deliver or send relevant advertisements to you through our Website and to analyse the success and effectiveness of such adverts for our legitimate interest purposes of promoting and growing our business.

In accordance with the Privacy and Electronic Communications Regulations (PECR) we may also send you relevant advertisements or marketing information if you:

• have ever purchased or enquired about our products or services; and
• at the time of your purchase or enquiry, you agreed to receive advertising or marketing information from us and you have not opted out from receiving that information.

Where we contact you through email, we shall ensure that our communications strictly comply with the Privacy and Electronic Communications Regulations (PECR), ensuring that our emails clearly display the identity and location of the sender and include clear, functional options for you to opt-out or unsubscribe from receiving future marketing contact from us.

Special Category Data

We do not collect any special category data about you. Special category data includes data relating to your health, race or ethnicity, political opinion, religious or philosophical beliefs, trade union membership, genetics, biometrics, sex life or sexual orientation. We do not process any data relating to criminal offences and convictions.

Disclosure of Personal Data

We may use any of the following external service providers to support our business and may share your personal data with those third parties:

1. Facebook (Meta);
2. Google;
3. Amazon Pay;
4. Stripe;
5. Instagram (Meta);
6. WhatsApp (Meta);
7. Zcal;
8. Zoho Mail;
9. SubStack;
10. AWS (Part of Amazon);
11. Messenger (Meta);
12. Zoom;
13. Royal Mail;
14. Rybbit;
15. M4trix Dev Ltd.

We understand that all of these third parties have appropriate technical and security processes in place to protect your data.

Where the third party is based outside of the EEA then we shall transfer your data as set out below.

We may also share your personal data as follows:

• where it is necessary for external service providers who have been engaged by us to assist in the provision of services to our clients and customers;
• where it is required by our professional support teams;
• where we are required by a government body or legal obligation, or to protect our rights;
• where it is required in connection with the sale or purchase of any business or assets.

Where we have outsourced a function or activity to an external service provider, we will only disclose Personal Data that the service provider needs to undertake that function or activity, and we require external service providers to agree to keep your Personal Data secure in accordance with the relevant law.

We agree not to share your Personal Data with any third party for that third party's marketing purposes unless we have obtained your explicit consent to do so.

Transfer of Personal Data

Our Website is hosted within the United Kingdom and your data will primarily be processed in the United Kingdom. We comply with all applicable data protection laws of the United Kingdom.

We may transfer your Personal Data to a third-party service provider which requires your Personal Data to be transferred outside of the United Kingdom. Where your Personal Data is transferred outside of the United Kingdom by our third-party service providers, we ensure that a similar degree of protection is afforded to it by ensuring they comply with one or more of the following legally recognised UK safeguards:

• UK International Data Transfer Agreement (IDTA): The standard contractual clauses or the UK Addendum to the EU Standard Contractual Clauses approved by the UK government for the lawful transfer of data outside the UK;
• UK Binding Corporate Rules (BCRs): Internal data protection policies approved by the UK regulatory authority for transfers within an international group of companies;
• UK Extension to the EU-U.S. Data Privacy Framework: For secure, approved transfers to participating and certified organisations within the United States;
• UK Adequacy Regulations: A formal finding by the UK government ensuring that the destination country or international organisation maintains a standard of data protection that is not materially lower than that provided within the UK.

Where the above standards do not apply then we will ensure that at least one of the following conditional exemptions is met:

• You have given your explicit, informed consent to the specific transfer;
• The transfer is legally required for important reasons of public interest;
• The transfer is authorised by the relevant UK data protection authority.

Data security

We take the protection of your Personal Data seriously and have taken suitable and reasonable steps to protect the Personal Data we hold from misuse, loss, unauthorised access, and any unauthorised modification or disclosure.

We limit access to your Personal Data to those employees, agents, contractors, or third parties who have a business need to know. They will only process your Data on our strict instructions and are bound by a legal duty of confidentiality.

If you are submitting Personal Data over the internet that you wish to remain private, please note that while attempts are made to secure information transmitted to this site, there are inherent security risks in transmitting information across the internet. If you prefer, we can arrange for you to submit your Personal Data through alternative, secure means. Please contact us to discuss alternative methods.

Data retention

We will not keep your Personal Data for longer than is required with regard to the purpose for which it was collected by us or provided by you, including any legal, statutory, accounting, or record-keeping requirements.

We will take all reasonable steps to safely destroy or permanently de-identify your Personal Data when it is no longer required.

Your rights in relation to the data we hold

Under UK data protection laws, you have specific rights in relation to your Personal Data. These include the right to:

• Request access to your Personal Data (commonly known as a "data subject access request") and receive a copy of the data we hold about you.
• Request correction of any errors, inaccuracies, or incomplete information we hold about you.
• Request erasure of your Personal Data (the right to be "forgotten") where there is no good reason for us to continue processing it.
• Request restriction of processing or object to how your personal information is processed, including for direct marketing purposes.
• Request data portability, allowing you to obtain and reuse your personal data across different services.
• Withdraw consent at any time where we are relying on consent to process your Personal Data.

To find out more details about these statutory rights, you can visit the independent regulatory guidance at https://ico.org.uk/your-data-matters/

To ensure the information we hold about you remains accurate, please contact us using our main email address if at any time your personal details change.

How to Raise a Complaint

If you are not satisfied with how we process your Personal Data, you have a statutory right under the Data (Use and Access) Act to lodge a formal data complaint directly with us.

Please contact us at hello@thesoundbothy.com to initiate this process. We will acknowledge your complaint within 30 days, investigate the matter without undue delay, and provide you with a clear, written notification of the final outcome.

If we fail to resolve your complaint satisfactorily, or if you prefer to bypass our internal procedure, you have the right to lodge a complaint at any time with the Information Commission, the independent UK supervisory authority tasked with overseeing data protection issues.

Links to other sites

The Website may contain links to external third-party websites. We are not responsible for the privacy practices of those websites and have no knowledge of whether cookies or other tracking devices are used on any such linked sites. If you have any concerns regarding the privacy of your information, you should ensure you are aware of the individual privacy policies of those sites before disclosing any personal information.

Changes to this Privacy Notice

We reserve the right to alter, update, or amend this Privacy Notice without prior notice to you. Should our Privacy Notice be altered, the revised policy will be immediately posted on the Website with an updated effective date.

Your continued use of our Website after the publication date of any amendments or alterations will constitute your acknowledgment and acceptance of those changes. Therefore, we recommend you review this Privacy Notice regularly to keep informed of our data management practices.

Legal Jurisdiction

This Privacy Notice shall be governed by and construed in accordance with the laws of England and Wales, and by your use of our Website you agree to the exclusive jurisdiction of those Courts. If you are a resident of Scotland, you may alternatively choose to bring legal proceedings under Scottish law before the competent courts of Scotland.