Your personal information and privacy
How and why Borough Market collects and uses personal information about visitors, traders, subscribers, business partners, customers and other contacts
Privacy Notice
Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.
When we use personal data we are regulated by the Information Commissioner under the Retained Regulation EU 2016/679 (“UK GDPR”) and the UK Data Protection Act 2018 (together, “Data Protection Legislation”). We are responsible, as Controller of your personal data, for the processing we do, for the purposes of Data Protection Legislation.
Key terms
It would be helpful to start by explaining some key terms used in this notice:
| We, Borough Market, us, our | The Borough Market (Southwark) Trust, a charity registered with the Charity Commission under number 1076940. |
| Personal data | Any information relating to an identified or identifiable natural person |
| Special category personal data | Personal data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership Genetic and biometric data Data concerning health, sex life or sexual orientation |
Personal data we collect
When you visit our website or otherwise engage with us, we will collect, store and use some or all of the following types of personal data from you, depending on whether you are a visitor or trader :-
- Name, Address, Email address, Mobile number, Bank details, Sole trader VAT registration number, Date of birth, Landline Telephone Number, Website address, Title, Facebook address, Twitter handle, Instagram account, CCTV imagery.
- We very rarely collect special category personal data, however some special category personal data may be collected via CCTV recordings for security purposes.
- In addition, when you use our website, we collect some technical information about your devices (such as your computer, your mobile, or your tablet) including your IP address and your device ID. Our website is not intended for children and we do not knowingly collect data relating to children.
- Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for how they use your personal information. When you leave our website, we encourage you to read the privacy policy of every website you visit.
How personal data is collected
We collect personal information directly from you, via some or all of the following means: when you visit our website as explained above; by email communication or if an enquiry is made via the enquiry form on our website; over the telephone; in writing; in face-to-face meetings and sometimes via our CCTV security systems.
How and why we use personal data
Under Data Protection Legislation, we can only use personal data if we have one or more legal basis for doing so. Our legal basis for collecting your personal data may be that you have given your consent (for example if subscribing for our newsletter); or to perform a contract that we have with you (for example, venue hire); or that it is in the legitimate interest of Borough Market (or other third party) that it be collected and processed, for example to enable us to fulfil our charitable objects, namely to provide a public market for the use and benefit of the local community.
Where we do collect special category personal data, this is done on the basis that operation of a CCTV security system in Borough Market is in the substantial public interest.
We use your personal information to deliver our services to you and to provide you with information about them, for example:
to provide a public market for the use and benefit of the local community in the Borough of Southwark and to promote social engagement;
to ensure the day-to-day safe running and management of the market;
to improve the visitor experience of the market;
to promote and run our charitable and commercial activities, including offers, events, exhibitions, clubs and venue hire;
to process requests, enquiries, complaints and bookings.
We collect personal information about traders (and people who apply to become traders) to ensure that the market continues to sell a diverse range of food, honestly priced and carefully sourced. We also use personal information about traders and other business contacts (such as people who contribute recipes or articles for our website or other publications) on our website and in other material promoting the market.
Promotional communications
We will only send you news and information about our exhibitions, events, special offers and other initiatives if you have given us consent to be on our mailing lists (for example, if you have signed up to receive our newsletter).
Every message we send you will give you the option to opt-out of receiving any further marketing communications from us.
Who we share personal data with
We only share personal data with our retained external third party service providers including cloud computing solutions such as AWS; Google drive; Dropbox and Node 4.
We only allow our retained external third parties to handle personal data if we are satisfied they take all appropriate technical and organisational measures (including the prescribed safeguards for the international transfer of personal data), to protect all personal data and only on our written instructions.
We may very occasionally disclose and exchange information with regulatory and statutory bodies such as the Charity Commission, to comply with our legal and regulatory obligations.
Where personal data is held and how it is kept safe
Where personal data is stored with any of the third party providers referred to above, we have ensured that such providers encrypt the personal data in transit and at rest and deploy multi-factor authentication and other state of the art security measures which are standard across the industry.
Some personal data may also be held on team devices such as mobile phones, in which case the personal data is protected by restricting access and requiring strong password protection.
How long personal data will be kept
We will only retain your personal data for as long as is necessary for the purpose for which we collected it, including for the purposes of discharging our legal and regulatory obligations.
When it is no longer necessary to retain personal data, we will delete it.
Rights
All data subjects have the following rights, which can be exercised free of charge:
| Access | The right to be provided with a copy of personal data held on a data subject |
| Rectification | The right to require us to correct any mistakes in a data subject’s personal data |
| To be forgotten | The right to require us to delete personal data—in certain situations |
| Restriction of processing | The right to require us to restrict processing of certain personal data—in certain circumstances, e.g. if the accuracy of the data is contested |
| Data portability | The right to receive the personal data provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations |
| To object | The right to object: —at any time to personal data being processed for direct marketing (including profiling); —in certain other situations to our continued processing of personal data, e.g. processing carried out for the purpose of our legitimate interests. |
| Not to be subject to automated individual decision-making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning a data subject |
| To withdraw consent | The right to withdraw consent as a legal basis for processing, at any time |
For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under Data Protection Legislation.
To exercise any of those rights, please contact us —see below: ‘How to contact us’.
How to complain
We hope that we can resolve any query or concern raised about our use of personal data.
Data Protection Legislation also gives the right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns or telephone: 0303 123 1113.
Changes to this privacy policy
We may change this privacy policy from time to time, when we do we will inform data subjects by the most appropriate means.
How to contact us
We can be contacted by post or email. Our mailing address is 8 Southwark Street, London SE1 1TL.
Our email address is: [email protected]
For all data subject rights, please contact: [email protected]
Last updated: June 2023