Privacy notice
byCaerdydd Venues, Hospitality and Commercial Filming Data Privacy Notice.
Cardiff University is the data controller for the personal information you provide to byCaerdydd Venues and Hospitality. We take your privacy seriously and are committed to protecting your personal data and using it responsibly and transparently.
This Privacy Statement explains how byCaerdydd uses your personal data when you make an enquiry, request information, or book venues, hospitality or accommodation with us. It should be read alongside the University’s Data Protection Notice for Enquirers and Professional Partners, which provides full details of your rights, how to contact the University’s Data Protection Officer, and how to raise a concern with the Information Commissioner.
Visit the University’s main data protection notice.
Where byCaerdydd Venues and Hospitality are acting on the instruction of another organisation to manage their conference, that organisation may be the data controller. Cardiff University would be the data processor, and you will be provided with the contact details of the data controller with whom we share your delegate information.
1. How we use your information
We will use your personal information to administer and manage your enquiry or booking and to deliver the services you have requested from us. Your details are held for internal use only and are stored securely within the University’s systems.
2. Marketing communications
From time to time, we may contact you with information about byCaerdydd venues, services or updates. We will only do this where you have indicated that you are happy to receive such communications or where you have previously used our services and this contact is permitted under data protection legislation.
You can opt out at any time by using the unsubscribe link included in marketing emails or by contacting us directly.
3. What personal information we collect
Depending on the nature of your enquiry or booking, we may collect and process the following information:
- Name and title
- Organisation name
- Postal address (home or work)
- Telephone number
- Email address
- Payment and invoicing details, where applicable
- Emergency contact details, where required
- Information relating to access, dietary or other reasonable adjustments
4. Why we collect your data and our lawful basis
We collect and use your personal data for the following purposes:
- To manage enquiries, bookings, contracts and event administration.
Legal basis: processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract. - To ensure the health, safety and security of delegates, guests and staff while at Cardiff University venues and facilities, and to enable reasonable adjustments where required.
Legal basis: processing is necessary for compliance with a legal obligation and for reasons of substantial public interest. - To keep you informed about relevant byCaerdydd venues, services or developments.
Legal basis: consent, or the University’s legitimate interests, where appropriate and permitted by law.
You can opt out of receiving marketing communications at any time. Where you opt out of receiving marketing communications, we will no longer use your information for that purpose, however we will retain your information on a suppression list to ensure that we can comply with our statutory obligation regarding your opt-out.
5. Who has access to your data
Access to your personal data is restricted to University staff who need it to perform their role, including:
- byCaerydd Venues and Hospitality staff administering your enquiry or booking
- Campus Services Residences, where relevant
- Cardiff University Finance and payments teams.
Cardiff University may use trusted third party suppliers to support specific services, such as payment processing. These suppliers are contractually required to process personal data securely and in accordance with data protection legislation and the University’s instructions.
We do not sell your personal data to third parties.
6. Data security and retention
Your personal data is held securely and managed in line with Cardiff University information security and data protection policies. We retain personal data only for as long as necessary for the purpose for which it was collected.
Where financial transactions are involved, records are normally retained for seven years in accordance with financial and legal requirements.
7. Your rights
You have rights under data protection legislation, including the right to request access to your personal data, request correction or erasure, restrict or object to processing, and withdraw consent where applicable. Full details of these rights are set out in the University’s Data Protection Notice for Enquirers and Professional Partners.
8. Changes to this Privacy Statement
Any updates to this Privacy Statement will be published on the University website. Where appropriate, we may notify you directly of significant changes.
9. Contact us
If you have any questions about how we use your personal data
If you are unhappy with the way in which your personal data has been processed you should contact www.venues@cardiff.ac.uk in the first instance. If your concern is not resolved, you can contact the University Data Protection Officer:
Data Protection Officer
Compliance and Risk
University Secretary's Office
Cardiff University
42 Park Place
Cathays, Cardiff
CF10 3BB
Email: inforequest@cardiff.ac.uk
If you remain dissatisfied thereafter you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: Contact us | ICO.