Scope and who we are
This privacy notice explains how personal data is used in connection with enquiries, bookings, business support and other services delivered through the Stowmarket Innovation Gateway. It does not cover wider processing by Mid Suffolk District Council or Hethel Innovation Ltd outside the Innovation Gateway context.
Stowmarket Innovation Gateway is operated by Hethel Innovation Ltd. For the purposes of UK data protection law, Hethel Innovation Ltd is the data controller for personal data processed in connection with:
- Business support enquiries
- Customer relationship management systems
- Room bookings, events and operational services
- Visitor management
- Marketing communications where applicable
Mid Suffolk District Council is a separate data controller for personal data processed in connection with:
- Tenancy agreements and landlord functions
- Heads of Terms and tenancy contracts
- Lease billing and financial administration
- Economic development monitoring and statutory reporting
- Freedom of Information and Environmental Information duties
Each organisation is independently responsible for its own processing activities. If your query relates to how Mid Suffolk District Council uses your data more broadly, please refer to the Council’s own privacy information at midsuffolk.gov.uk.
The personal data we collect
Depending on how you interact with the Innovation Gateway, we may collect:
- Name
- Business name
- Job title
- Email address
- Telephone number
- Business sector and enquiry type
- Booking and attendance information
- Payment and transaction information where services are purchased
- Records of correspondence
- Information you choose to provide in enquiry forms
We do not routinely process special category data. If you provide information about accessibility or health requirements for an event, we will use it only to meet those requirements.
How we collect your data
We collect personal data directly from you when you:
- Submit an enquiry through our website
- Subscribe to updates
- Book meeting rooms or events
- Attend training or business support sessions
- Contact us by email, telephone or in person
Enquiry data submitted via the Stowmarket Innovation Gateway website is processed through systems operated and configured by Hethel Innovation Ltd.
Why we use your data and lawful bases
We process personal data under Article 6 UK GDPR as follows:
Contract
Where processing is necessary to enter into or perform a contract with you, for example to manage room and event bookings, provide business support services, or respond to specific service-related enquiries.
Legitimate interests
For our legitimate interests in the effective operation, promotion and development of the Innovation Gateway, for example to manage and improve services and facilities, maintain CRM records, and understand demand and engagement with programmes.
We only rely on legitimate interests where these are not overridden by your rights and freedoms. We maintain a documented assessment where this lawful basis is relied upon.
Consent
For electronic marketing communications where required under the Privacy and Electronic Communications Regulations 2003, such as email newsletters or event updates you choose to receive. You can withdraw your consent at any time.
Legal obligation
Where we are required to retain or disclose information for statutory or regulatory reasons, such as financial record-keeping, fraud prevention or responding to formal information requests relating to our activities.
Where Mid Suffolk District Council processes personal data in its role as landlord or public authority, it relies primarily on public task and legal obligation as its lawful bases.
Provision of personal data
In most cases, providing your personal data is necessary in order for us to respond to your enquiry, manage a booking or provide services. If you choose not to provide required information, we may be unable to deliver the relevant service or respond fully to your request.
Marketing communications
Where you opt in to receive marketing communications, we will send updates about events, opportunities and services related to the Innovation Gateway. We will not send you such communications if you have opted out.
You may withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us directly using the details below. We comply with the Privacy and Electronic Communications Regulations 2003 in relation to electronic marketing.
CRM and operational systems
Customer and enquiry data is stored within systems operated by Hethel Innovation Ltd for the purposes described in this notice. Access to these systems is role-based and restricted to staff who need it to perform their duties.
Mid Suffolk District Council may have access to relevant Innovation Gateway CRM data for reporting and governance purposes in accordance with agreed controller-to-controller arrangements. Where the Council accesses such information, it does so as an independent data controller for its own statutory and governance purposes.
Data sharing
We may share personal data with:
- Mid Suffolk District Council for monitoring, reporting, governance and landlord-related functions where applicable
- Skills and delivery partners where they are involved in delivering specific programmes or events, and in aggregated or anonymised form for analysis where possible
- Payment providers and booking platform providers to take payments and manage bookings
- Professional advisers and auditors, where necessary for advice, compliance and assurance
All sharing is limited to what is necessary and proportionate for the relevant purpose. Where personal data is shared with Mid Suffolk District Council, each party acts as an independent data controller. We do not sell personal data.
International transfers
We do not routinely transfer personal data outside the United Kingdom. If it becomes necessary to use service providers whose support, backup or related services involve a restricted transfer under UK GDPR, we will ensure appropriate safeguards are in place in accordance with UK GDPR, such as adequacy regulations or standard contractual clauses.
Retention
We retain personal data only for as long as necessary for:
- Delivery of services
- Contractual administration
- Reporting and accountability
- Legal and financial record keeping
Retention periods are defined within our internal retention schedule and are reviewed periodically. As an indication, financial records are normally retained for up to 7 years in line with legal and accounting requirements. Other records are kept for the minimum period needed to fulfil the purposes set out in this notice, after which they are securely deleted or anonymised.
Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on individuals.
Your rights
Under UK GDPR you have the right to:
- Access your personal data
- Rectify inaccurate or incomplete data
- Request erasure of your data in certain circumstances
- Restrict processing in certain circumstances
- Object to processing based on our legitimate interests
- Withdraw consent where processing is based on consent
- Data portability where applicable
Requests should be made in writing using the contact details below. We may need to verify your identity before responding.
If your request relates to tenancy or landlord matters, it may be handled by Mid Suffolk District Council as the relevant controller. In such cases we may direct you to contact the Council or share your request with them where appropriate.
Security
We implement appropriate technical and organisational measures to protect personal data. These include access controls, system permissions, encryption where appropriate, secure configuration of platforms and regular review of our security arrangements.
Changes to this privacy notice
We keep this privacy notice under regular review to ensure it remains accurate and reflects how personal data is processed at the Stowmarket Innovation Gateway.
We may update this notice from time to time. The latest version will always be published on our website and will include the effective date shown at the top of this document.
Where changes are material and affect how your personal data is used, we will take reasonable steps to bring those changes to your attention.
Contact details
