Privacy Policy

DESTINATION ORKNEY LTD 

DATA PRIVACY POLICY & GDPR COMPLIANCE STATEMENT 

Destination Orkney respects our members’ rights to data privacy and protection and revised our internal policies, procedures, working practices in order to meet the requirements of the GDPR, imposing obligations on organisations that control or process personal data and introduces rights and protections for EU citizens. 

The EU General Data Protection Regulation (GDPR) is a privacy and data protection regulation in the European Union effective from May 25 2018 – full details may be found online at https://gdpr-info.eu/. GDPR will be retained in UK law from the end of the Brexit transition period, starting 1 January 2021, and will continue to be read alongside the Data Protection Act 2018. 

Destination Orkney is committed to ensuring that your privacy is protected and adheres to the provisions of all relevant Data Protection Legislation, including GDPR, ensuring all personal data is handled in line with the principles outlined in the regulation. Regarding personal data collection, management and retention, the GDPR states: 

Personal data shall be: 

  • Processed lawfully, fairly and in a transparent manner in relation to the data subject 
  • Collected for specified, explicit and legitimate purposes and not further processed in a 
  • manner that is incompatible with those purposes 
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which 
  • they are processed 
  • Accurate and, where necessary, kept up to date 
  • Kept in a form which permits identification of data subjects for no longer than is necessary 
  • for the purposes for which the personal data are processed 
  • Processed in a manner that ensures appropriate security of the personal data, including 
  • protection against unauthorised or unlawful processing and against accidental loss, 
  • destruction, or damage, using appropriate technical or organisational measures 

Destination Orkney is committed to compliance with the GDPR as both a processor and controller of personal data. 

1. About Us 

Destination Orkney Ltd is the destination management, marketing and membership organisation for tourism in Orkney. Formerly known as Orkney Tourism Group Ltd, Destination Orkney provides a range of services to its members and stakeholders, and to members of the public. 

Destination Orkney is a membership organisation with a board of directors and communicates with partner organisations. We employ staff and purchase services from suppliers. We provide some services to members of the public. 

We collect and use personal data responsibly. We respect your data protection rights and aim to 
give you control over your own information. It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by contacting us at  admin@destinationorkney.co.uk. 

2. The personal information we collect, and how it is used 

Membership Information 

We use this information to administer our membership function, communicate with you, maintain our financial records, offer membership renewal, collect information for promotional publications and offer marketing opportunities. 

  • Name 
  • Address 
  • Business address 
  • Telephone numbers 
  • Email address 
  • Business details 
  • Membership payment information 
  • Business correspondence

Membership Surveys 

We use this research information to inform Orkney tourism strategy, monitor the performance of the tourism sector and represent the views of members to our partners and other organisations. 

  • Name 
  • Email address 
  • Survey responses 

Board of Directors 

We use this information to communicate with directors about meetings and other operational 
matters, and policy issues. 

  • Name 
  • Address 
  • Telephone numbers 
  • Email address 
  • Business correspondence 

Partner Organisations 

We use this information to communicate with partners about Destination Orkney business. 

  • Contact name 
  • Address 
  • Telephone numbers 
  • Email address 
  • Business correspondence 

Staff Members 

We use this information in connection with staff members’ employment. 

  • Information gathered about an employee and any references obtained during recruitment 
  • Details of terms of employment 
  • Payroll, tax and National Insurance information 
  • Performance information 
  • Health records 
  • Attendance records, including holiday records and self-certification forms 
  • Details of any disciplinary investigations and proceedings 
  • Training records 
  • Contact names and addresses 
  • Correspondence with Destination Orkney
  •  
  • Customers – requesting accommodation or tour guide search assistance 
  • We use this information to process requests for accommodation and/or tour guides, communicating requests to our members for them to respond directly to customers. 

Customer Surveys 

From time to time we invite customers to participate in research surveys including prize draws. We use this information to guide and evaluate our marketing activities, and to communicate with prize winners if appropriate. 

3. How we share your information 

In specific circumstances and in line with our business purpose, we may share your information. We only share your information where there is a legitimate business need to do so. 

Membership Information 

May be shared with NB Communications, to company which maintains our Orkney.com. Financial information may be shared with our accountant as part of our financial procedures. 

Staff member information 

We may need to disclose some information we hold about employees to relevant third parties. For example: 

  • An employee’s health and attendance records for the purposes of compliance with our 
    health and safety and our occupational health obligations 
  • Information in connection the administration of insurance, pension, sick pay and any other 
    related benefits 
  • Information in connection with unspent convictions to enable us to assess an employee’s 
    suitability for employment 

Customer Information 

If a customer has requested assistance with finding accommodation and/or tour guides their contact details will be shared with our members so that they can respond directly. 

4. The legal basis for processing your personal data 

Information we process as a contractual obligation 

When you contact us about a service we provide as part of our business, a contract is formed 
between you and us. Any processing of information that may lead to a contract – e.g. contacting us to enquire about a service or product – is also processed in this way as it may lead to a contractual obligation. 

To carry out our obligations under that contract we must process the information you give us. Some of this information may be personal information. 

We process this information on the basis there is a contract between you and us, or that you have requested we use the information before we enter into a legal contract. 

Additionally, we may aggregate this information in a general way and use it to provide information to monitor our performance with respect to a particular service we provide. If we use it for this purpose, you as an individual are not personally identifiable. 

Information we process with your consent 

Through certain actions when there is no contractual relationship between us, such as when you 
browse our website or ask us to provide you with more information about our business, products or services, you are providing your consent to us to process information that may be personal information. 

Wherever possible, we aim to obtain your explicit consent to process this information. 
Sometimes you might give your consent implicitly, such as when you send us a message by email to which you would reasonably expect us to reply. 

Except where you have consented to our use of your information for a specific purpose, we do not use your information in any way that would identify you personally. We may aggregate it in a 
general way and use it to provide information, for example to monitor the performance of a 
particular page on our website. 

We continue to process your information on this basis until you withdraw your consent or it can be reasonably assumed that your consent no longer exists. 

Information we process for the purposes of legitimate interests 

We may process information on the basis there is a reasonable legitimate interest, either to you or to us, in doing so. For example, we may process your data on this basis for the purposes of: 

  • record-keeping for the proper and necessary administration of our organisation/business 
  • responding to unsolicited communication from you to which we believe you would expect a 
  • response 
  • protecting and asserting the legal rights of any party 
  • protecting your interests where we believe we have a duty to do so. 

Information we process because we have a legal obligation 

We are subject to the law like everyone else. Sometimes, we must process your information to comply with a statutory obligation, such as HMRC tax or insurance obligations. 

We may be required to give information to legal authorities if they request it or if they have the proper authorisation such as a search warrant or court order. This may include your personal information. 

5. Security and storage of information 

We will keep your information secure by taking appropriate technical and organisational measures against its unauthorised or unlawful processing and against its accidental loss, destruction, or damage. We will do our best to protect your personal information, but we cannot guarantee the security of your data which is transmitted to our website, applications or services or to other website, applications, and services via an internet or similar connection. 

6. Other websites and social media 

If you follow a link from our website, application, or service to another site or service, this notice will no longer apply. We are not responsible for the information handling practices of third party sites or services and we encourage you to read the privacy policies appearing on those sites or services. 

Our websites, applications, or services may enable you to share information with social media sites or use social media sites to create your account or to connect your social media account. Those social media sites may automatically provide us with access to certain personal information retained by them about you (for example any content you have viewed). You should be able to manage your privacy settings from within your own third party social media account(s) to manage what personal information you enable us to access from that account. 

7. How long we retain your personal data 

We will retain your personal information for the duration of our business relationship and afterwards for as long as is necessary and relevant for our legitimate business purposes or to comply with applicable laws and regulation. Where we no longer need your personal information, we will dispose of it in a secure manner (without notifying you). 

8. Changes to our Privacy Policy 

We may change our privacy policy from time to time. We will always update the privacy policy on our website, so please try to read it when you visit the website (the ‘last updated’ reference – below – tells you when the privacy policy was last updated). 

9. Your rights Your personal information is important to us. 

You have the right to request a copy of the personal information we hold about you. We want to make sure that any personal information we hold is accurate, complete and up to date. You may ask us to correct any personal information about you that you believe does not meet these standards. 

You have the right to ask us to delete personal information about you when: 

  • You believe that we no longer require the information for the purposes for which it was obtained 
  • We have used your personal information with consent but you now wish to withdraw that consent
  • Our use of your personal information is contrary to law 

You have the right to ask for your personal information to be given to a third party. We will only do so when we can be assured that the third party will afford your personal information the same protection as we provide. 

If you have any questions regarding your personal information or wish to exercise your rights, please contact admin@destinationorkney.co.uk 

10. How to contact us 

You can contact us by post, email or phone. Our data controller is Ailsa Heal (Destination Manager). 

By post: Destination Orkney, First Floor, The Travel Centre, West Castle Street, Kirkwall, Orkney, KW15 1GU 

By email: admin@destinationorkney.co.uk 

By phone: +44 (0) 1856 230300 

Last updated 

This Privacy Policy was updated on 27.06.2022