Privacy policy

Who we are

Surrey Hills Enterprises C.I.C. (company number 08114796) is the data controller for the personal information described in this policy. Our address is Surrey Hills Enterprises C.I.C., Ashcombe Court, Woolsack Way, Godalming, GU7 1LQ.

Surrey Hills Enterprises C.I.C. is registered with the Information Commissioner's Office (ICO) under registration reference ZA531196.

If you have any question about this policy, or about the information we hold, please contact us at info@surreyhillsenterprises.co.uk or 01483 661150.

Who this policy covers

This policy applies, where relevant, to members and prospective members, event attendees and ticket purchasers, stallholders and exhibitors, speakers and presenters, partners and sponsors, suppliers and contractors, volunteers whose information is passed to us, people who contact us, and people who provide content, photographs or other material to us.

Information we collect

Membership. When an organisation applies to join, is onboarded or renews, we collect the organisation name, a contact name and role, email address, telephone number, postal address, organisation type, size and sector, website and social media details, and the responses given in the membership application. Much of this is information about an organisation rather than about an individual, but contact details and named roles are personal information.

Events and training. When someone books an event, training session or Lunch Hour Link-Up we collect the attendee's name and contact details, the booking and payment status, and any dietary or accessibility requirements they choose to tell us about.

Stallholders and exhibitors. When an organisation applies to trade or exhibit at one of our events, we collect the organisation and contact details provided in the application, together with information needed to assess and manage their participation in the event. This may include information about their products or services, trading requirements and other information they choose to provide. Applications and associated contact information are managed through GoHighLevel.

Enquiries and forms. Our forms are provided through GoHighLevel and cover general enquiries, contact, membership, partnership, events and opportunities, news and press releases, member introductions, referrals and questions submitted through our advice pages. We collect the contact details entered and the content of the message itself.

Member Hub. We collect the information needed to authenticate and secure access to the Member Hub. Member-only documents are only delivered after a valid Member Hub session has been confirmed.

Website use. Our website is served through our website platform and its hosting network, which processes technical information such as your IP address and browser type in order to deliver pages and keep the site secure.

Where we get personal information from

Almost all of the personal information we hold is given to us directly by you or by your organisation, through an application, a booking, a form or ordinary correspondence.

We may also receive business contact details from another person within your organisation, from a referral or introduction made by a member or partner, from a registration made on your behalf for an event, or from publicly available business information such as an organisation's own website.

How we use your information and our lawful basis

To administer membership, including applications, onboarding, renewals, invoicing and keeping member records up to date. Our lawful basis is the performance of our contract with your organisation, or our legitimate interest in administering membership where the contract is with an organisation rather than with you personally.

To organise and run events, training and Lunch Hour Link-Ups, including managing bookings, payment and attendance, and giving venues or presenters the details they need. Our lawful basis is the performance of the booking contract, or our legitimate interest in running events that our members have asked to attend.

To manage stallholders and exhibitors at our events, including applications, selection, bookings, payments, event planning and communications before and after the event. Our lawful basis is the performance of a contract, or taking steps before entering into a contract, and our legitimate interest in planning and running our events effectively.

To answer enquiries, provide member support and make introductions between members. Our lawful basis is our legitimate interest in responding to people who contact us and in delivering the introductions and support that membership exists to provide.

To send membership and service communications about your membership, bookings and requests. Our lawful basis is the performance of our contract with your organisation, or our legitimate interest in keeping member contacts informed about the membership they hold.

To promote events, opportunities and services by email or other electronic means. Our lawful basis is our legitimate interest in promoting the activities of the network to member and prospective member organisations, and, where the law requires it, your consent.

To keep the Member Hub and the website secure and working properly. Our lawful basis is our legitimate interest in protecting member-only content and preventing misuse of our systems.

To meet our legal, accounting and reporting obligations. Our lawful basis is compliance with a legal obligation.

We do not sell personal information.

Membership communications and marketing

Some messages are part of running your membership: renewal reminders, invoices and payment information, booking confirmations and joining instructions, replies to your enquiries, and notices about changes to your membership or to an event. We need to send these to administer your membership, booking or request, so they are not marketing.

Separately, we send marketing and promotional communications about events, training, opportunities, services and activities across the Surrey Hills Enterprises network. These communications may be sent through Mailchimp or GoHighLevel. We only send marketing communications to people where we have an appropriate basis to do so, including people who have subscribed or otherwise given appropriate consent, for example by ticking a marketing consent box during another interaction such as entering a raffle.

Every marketing email includes an unsubscribe link, and you can ask us to stop sending marketing messages at any time. Marketing to individuals, including sole traders and unincorporated businesses, is only sent where we have appropriate consent.

Dietary requirements

Where food is being provided at an event, we may ask whether you have any dietary requirements. Providing this information is optional.

We use this information to make appropriate catering arrangements and share relevant information with the caterer where necessary.

Dietary information remains within the relevant booking or event record in accordance with our retention policy, but we do not maintain a separate ongoing record of an individual's dietary requirements, and we do not assume that a requirement given for one event applies to another.

Accessibility requirements

If you choose to tell us about an accessibility requirement, we use that information only as far as necessary to help make appropriate arrangements for your attendance.

We share it with a venue or other relevant service provider only where that is necessary to meet the requirement, and you only need to tell us as much as is needed to make the arrangements.

Volunteer enquiries

Volunteer enquiries are managed through Surrey Hills National Landscape. Surrey Hills Enterprises may receive a copy of an enquiry where it is relevant to our activities or where we may be able to provide an appropriate volunteering opportunity.

We only use that information for the purpose of responding to or supporting the volunteering enquiry.

Photography and filming at our events

Photography and filming may take place at our public, business and member events. Images and recordings may be used to report on and promote our activities, events and membership.

Where practical, we will let attendees know that photography or filming is taking place. If you would prefer not to be photographed or filmed, please speak to a member of the team at the event and we will do our best to accommodate that. Where consent is specifically required, we will ask for it.

Content, photographs and materials you send us

We encourage members to send us news, press releases, event details, member profile information, photographs, logos and promotional material. We may use what you send for the purpose it was supplied for, including on our website, in emails and newsletters, on social media and in other promotional activity.

If you supply photographs, video, logos or other content, please make sure you have the rights and permissions needed to give it to us. Where an image shows identifiable people, the person supplying it should make sure there is an appropriate basis or permission for it to be used.

Member directory and public member profiles

Information supplied for your organisation's public member profile may be published in the Surrey Hills member directory, which is currently hosted on the Surrey Hills National Landscape website and runs on WordPress.

Private membership administration information, such as internal notes, invoicing details and application responses, is not automatically published. Only the profile information intended for publication appears in the directory.

Sharing your information

We use a small number of service providers who process information on our behalf, chosen for a particular purpose: Lovable and its hosting services, which build and host this website; GoHighLevel, which powers our forms, member, stallholder and contact records and related email communications; Mailchimp, for email marketing; Microsoft 365, for email, documents and organisational records; Xero, for accounting; and GoCardless and Stripe, for collecting and processing payments. We do not store card details ourselves.

WordPress remains in use for parts of the wider Surrey Hills online presence and member services, including the member directory. It does not host this website.

Some pages include content served by other organisations. Our enquiry forms are embedded from GoHighLevel, session recordings in the Member Hub are embedded from YouTube in its privacy-enhanced mode, and our website question assistant is provided by ElevenLabs. Our typefaces are hosted on our own website and are not loaded from Google Fonts.

When content is requested from another organisation's servers, that organisation receives technical information such as your IP address and your browser and device information, because that information forms part of any internet request.

Displaying a GoHighLevel form requires connections to GoHighLevel and its supporting infrastructure, including Cloudflare. The GoHighLevel embed also downloads a Facebook-hosted JavaScript library, even though Surrey Hills Enterprises has no Facebook Pixel configured. Our testing confirmed that no Meta Pixel is initialised, no Meta tracking or event information is sent, and no Meta cookies or browser storage are created. Facebook's servers do, however, receive the technical information described above when that file is requested.

The ElevenLabs question assistant does not load anything from ElevenLabs when you simply open a page. Its resources are requested only if you choose to open or use the assistant. If you do use it, what you say or type is sent to ElevenLabs so that it can provide the answer.

Member learning videos use YouTube's privacy-enhanced youtube-nocookie.com mode, so YouTube does not set its usual cookies merely because the Learning Library page is opened. Playing a video may result in YouTube using browser storage and receiving the technical information it needs to deliver the video.

Where necessary, we share attendee information with event venues, caterers and training presenters so that they can host the event you have booked.

We may share information with funders, partners or auditors in anonymised or aggregated form, and with authorities where we are legally required to do so.

International transfers

We use third-party service providers to help us manage our website, business, communications, membership services, accounting and payments. These include Lovable and its hosting services, GoHighLevel, Mailchimp, Microsoft 365, Xero, GoCardless and Stripe.

Some of these providers, or their approved service providers, may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we take steps to ensure that it continues to receive an appropriate level of protection in accordance with UK data protection law.

Depending on the country and service provider involved, these protections may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

You can contact us if you would like further information about the safeguards used when your personal information is transferred outside the UK.

How long we keep it

We only keep personal information for as long as we need it for the purpose for which it was collected.

Our standard retention periods are: member records, three years after our last interaction with the member or contact; event bookings and ticket-holder records, three years after the event; general emails and correspondence, three years; and financial and accounting records, six years.

We may retain information for longer where we are required to do so by law or where it is reasonably necessary to deal with a legal claim, complaint or other exceptional circumstance.

At the end of the relevant retention period, information is securely deleted or anonymised where appropriate.

Keeping information secure

Access to member, enquiry and event information is limited to Surrey Hills Enterprises staff and contractors who need it to do their work, and we take appropriate technical and organisational measures to protect it. Member-only documents are only released once a valid Member Hub session has been confirmed.

No website or system can be made completely secure, but we take the protection of your information seriously and review our arrangements as the site and our systems develop.

Your rights

Depending on the circumstances and the lawful basis we rely on, you may have rights in relation to your personal information, including the right to access it, to have inaccurate information corrected, to request deletion or restriction, to object to certain processing, and to receive certain information in a portable format.

You have the right to object to the use of your personal information for direct marketing at any time.

Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did lawfully before you withdrew it.

To make a request, contact us at info@surreyhillsenterprises.co.uk or 01483 661150. We will normally respond within one month.

If you are not happy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

Automated decision-making

We do not make decisions about you by automated means alone, and we do not use your personal information for profiling.

Cookies

We use Google Analytics 4 to understand how visitors use the website. It only loads if you accept analytics cookies, and it does not load if you decline. We do not use advertising cookies.

The Member Hub uses a single encrypted, HTTP-only session cookie to keep you signed in while you move between Member Hub pages. It expires after seven days and is removed when you sign out.

The cookie banner stores your choice in your browser's localStorage rather than in a cookie. This means it is not sent to our servers; it simply remembers the choice you made.

Content embedded from other organisations, such as our enquiry forms and video recordings, may set its own cookies or similar technologies under those organisations' own policies. Our cookie policy explains this in more detail.

Other websites

Our website links to other websites and services, including the other Surrey Hills organisations and services used by our members. We are not responsible for how those organisations handle personal information, so please read their own privacy information.

Changes to this policy

We review this policy regularly and will publish any changes on this page.