Privacy notice.

Who is responsible for your information

MAC Hub is a venue owned and managed by:

Ekopia Social Investments Limited
Community Benefit Society, registered number 2574 RS
567 West Whins, Findhorn Hive
The Park, Findhorn
Moray IV36 3SH
Scotland

Email: hello@mac-hub.uk
Telephone: +44 (0)1309 691258

Ekopia Social Investments Limited is the data controller for the personal information described in this notice. In this notice, “Ekopia”, “we”, “us” and “our” refer to Ekopia Social Investments Limited.

MAC Hub is a separate, independent charity and is not responsible for this website or the processing described in this notice.

Information we collect

Depending on how you use the website and venue services, we may collect:

• your name, organisation, job or role;
• your email address and telephone number;
• your preferred contact method;
• details of an enquiry, proposed activity, class, workshop, meeting, exhibition or event;
• preferred dates, anticipated group size and room requirements;
• accessibility, equipment, catering or other practical requirements;
• booking confirmations, correspondence and changes;
• billing address, invoices, payment status and accounting records;
• feedback, complaints or information concerning an incident;
• photographs, testimonials or other contributions where you have agreed to their use;
• cookie choices and consent records; and
• technical information including your IP address, browser, device, operating system, referring page, pages viewed and the date and time of requests.

We normally receive this information directly from you. We may also receive it from an organisation or facilitator on whose behalf you are acting, another member of your group, LemonBooking, a payment provider or publicly available sources where appropriate.

Information submitted through the enquiry form

Our Squarespace contact form may ask for your name, organisation, email address, telephone number, area of interest, preferred date, approximate group size and information about the activity you wish to arrange.

Form submissions are processed by Squarespace. They may be retained in the Squarespace Form Submitters area and delivered to an authorised Ekopia email account.

Please provide only information relevant to your enquiry. Do not include confidential information about other people, information about children, or sensitive personal information unless it is genuinely necessary.

Submitting a form does not add you to a marketing mailing list.

Sensitive and special category information

Information about health, disability, religious or philosophical beliefs, racial or ethnic origin, sexual orientation, political opinions or trade union membership is treated as special category information under UK data protection law.

We do not routinely request this information. However, you may voluntarily provide limited health or disability information where this is necessary to discuss accessibility or safety arrangements.

Where special category information is necessary, we will normally process it with your explicit consent. In exceptional circumstances, another condition permitted by law may apply, such as protecting someone’s vital interests in an emergency.

We will limit access to this information and delete it when it is no longer needed.

Why we use your information

Responding to enquiries

We use your information to understand and respond to your enquiry, discuss availability and suitability, provide quotations and take steps towards a possible booking.

Our lawful bases are taking steps at your request before entering into a contract and our legitimate interest in responding to venue enquiries. Where you act for an organisation, we rely primarily on legitimate interests.

Managing bookings and venue use

We use information to administer bookings, allocate rooms, communicate practical arrangements, issue invoices, record payments, manage access and deal with changes, cancellations, incidents or disputes.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in managing the venue properly.

Operating and protecting the website

We process limited technical information to deliver pages, maintain security, prevent misuse, diagnose faults and keep the website available.

Our lawful basis is our legitimate interest in operating a secure and reliable website.

Analytics and service improvement

Where you have consented to analytics cookies, we may use aggregated website information to understand which pages are visited and how visitors find and use the website.

Our lawful basis for non-essential analytics and performance technologies is consent. You can withdraw your consent through the Cookie Settings control.

Legal and financial administration

We may retain and use information to maintain accounting records, respond to legal claims, prevent fraud, protect our property and comply with requests from regulators, courts or public authorities.

Our lawful bases are compliance with legal obligations and our legitimate interests in protecting Ekopia and managing its affairs.

Photographs and testimonials

Where photographs, quotations or testimonials identify an individual, we will use them with consent or, in limited circumstances, on the basis of a documented legitimate interest. Consent can be withdrawn for future use, although this may not affect material already lawfully printed or published.

Squarespace hosting and analytics

This website is hosted by Squarespace.

When you visit the website, Squarespace may receive information about your browser, network and device, your IP address, pages viewed, referring pages and interactions with the website. Squarespace uses information to deliver the website, maintain security, provide analytics and protect or improve its platform.

Squarespace may act as our processor for information we control and may separately control certain technical information for its own platform purposes.

More information is available in the Squarespace Privacy Policy.

LemonBooking

We use, or intend to use, LemonBooking to display availability and administer room bookings.

When you interact with the booking calendar or make a booking, LemonBooking may process your name, contact details, organisation, address, booking selections, correspondence, invoice information, payment status and other information required to manage the booking.

LemonBooking processes booking information to provide its services to Ekopia. It may also process limited technical or account information for security, support and platform administration. LemonBooking states that its booking data is hosted in Amazon Web Services data centres in London, although some of its service providers may process limited information elsewhere.

You can read the LemonBooking Privacy Policy.

If a separate payment provider is introduced, payment details will normally be collected directly by that provider. This notice will be updated to identify the provider before online payments are activated.

Google reCAPTCHA

The enquiry form is protected by Google reCAPTCHA to reduce spam, fraud and automated abuse.

reCAPTCHA may receive technical information including your IP address, browser and device information, referrer information, interaction data and cookies or similar identifiers. Google analyses this information to assess whether a submission is likely to have been made by a person or an automated system.

We use reCAPTCHA on the basis of our legitimate interest in protecting the website and enquiry service. Security cookies that are strictly necessary for this purpose may be used without optional cookie consent.

Google processes information under its Privacy Policy and Terms of Service.

reCAPTCHA does not make decisions that have legal or similarly significant effects on you. It may, however, prevent or challenge a form submission that appears automated. You can contact us by email if the form does not work.

Cookies and similar technologies

Cookies are small files or pieces of information stored on your device. The website may also use local storage, pixels and similar technologies.

Necessary cookies

Squarespace uses necessary cookies to securely deliver the website, remember privacy choices and enable essential functions.

Google reCAPTCHA may use security technologies necessary to protect the enquiry form. LemonBooking may also use cookies necessary to provide its booking functionality.

Necessary technologies cannot always be disabled through the cookie banner because the associated service may not work without them.

Analytics and performance cookies

Squarespace analytics and performance cookies may collect information about visits, pages viewed, clicks, internal links, scrolling, searches and timestamps.

These cookies are restricted until you consent through the cookie banner. We do not use them if you decline the relevant category.

We do not currently use Google Analytics, Meta Pixel or advertising cookies. This notice and the cookie controls must be updated before any such service is introduced.

Managing cookie choices

You can accept, decline or manage non-essential cookies through the website’s cookie banner. You can change your choice later through the Cookie Settings link in the site footer.

You can also delete or block cookies through your browser. Blocking necessary cookies may prevent parts of the website, form or booking service from working correctly.

Squarespace publishes further information about the cookies used by Squarespace websites.

Fonts

The website may use fonts provided through Squarespace’s Google Fonts integration.

Where a font is requested directly from Google, Google may receive your IP address, browser and device information, and information about the page requesting the font. We use externally delivered fonts for our legitimate interest in presenting a clear, consistent and accessible website.

If all fonts are delivered locally or by Squarespace without a request to Google, this transfer does not take place.

OpenStreetMap

The Visit page includes a map based on OpenStreetMap.

When the embedded map loads, the OpenStreetMap Foundation or the relevant map service may receive your IP address, browser and device type, operating system, referring page, date and time of access and the map resources requested.

We use the map for our legitimate interest in helping visitors locate and travel to the venue. More information is available in the OpenStreetMap Foundation Privacy Policy.

YouTube and Vimeo videos

We may occasionally include videos hosted by YouTube or Vimeo.

Embedded video players can receive your IP address, browser and device information, referring page, video interactions and cookie identifiers. If you are signed in to the relevant provider, the provider may associate your interaction with your account.

Video players should remain blocked until you consent to external media or choose to load the video. No connection to the video provider should be made merely because you visit a page containing a blocked video.

Where possible, YouTube videos will use privacy-enhanced mode and Vimeo videos will use its Do Not Track setting. These settings reduce some tracking but do not prevent all technical information or essential security cookies from being transmitted.

You can read the Google Privacy Policy, which applies to YouTube, and the Vimeo Privacy Policy.

Who we share information with

Where necessary, information may be shared with:

• authorised Ekopia staff, directors, contractors and venue administrators;
• Squarespace, as website and form service provider;
• the provider of Ekopia’s email service;
• LemonBooking and any approved payment provider;
• Google for reCAPTCHA and, if enabled, Google Fonts or YouTube;
• Vimeo where Vimeo content is embedded;
• OpenStreetMap Foundation or the selected map provider;
• accountants, insurers, legal advisers and other professional advisers;
• IT, security and technical support providers;
• emergency services where necessary to protect someone’s vital interests; and
• public authorities, regulators or courts where disclosure is required or permitted by law.

We do not sell personal information.

International transfers

Some providers, including Squarespace, Google, YouTube and Vimeo, are based in or operate from countries outside the UK.

Where personal information is transferred outside the UK, we require an appropriate safeguard recognised under UK data protection law. Depending on the provider and destination, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to approved Standard Contractual Clauses.

Squarespace states that it uses recognised transfer safeguards, including the UK Addendum and the UK Extension to the EU-US Data Privacy Framework.

You may contact us if you would like further information about safeguards relevant to a particular service.

How long we keep information

We normally apply the following retention periods:

• enquiries that do not become bookings: up to 12 months after the last meaningful contact;
• booking correspondence and operational records: for the booking and for a reasonable period afterwards;
• contracts, invoices, payment and accounting records: normally six years after the end of the relevant financial year;
• accessibility or health information: only until it is no longer required, normally no more than 90 days after the relevant event, unless needed in connection with an incident or legal claim;
• complaints, incidents and legal claims: for as long as reasonably necessary to investigate and resolve the matter and meet applicable limitation periods;
• photographs and testimonials: until consent is withdrawn, the material is replaced, or we no longer have a lawful reason to retain it; and
• website security, analytics and cookie records: according to the relevant security need, consent choice and provider retention settings.

We may retain information for longer where required by law, insurance, safeguarding, financial reporting or the establishment, exercise or defence of legal claims. Information that is no longer needed will be deleted, anonymised or securely destroyed.

Security

We use reasonable technical and organisational measures to protect personal information against loss, misuse, alteration, unauthorised access and disclosure.

Access is limited to people who need the information for their work. We also select service providers expected to provide appropriate security and data protection safeguards.

No internet transmission or storage system can be guaranteed to be completely secure. Please do not send highly confidential information through the general enquiry form.

Children’s information

The website and booking form are intended primarily for adult facilitators, organisers and venue users.

Please do not submit personal information about a child through the general enquiry form unless this is necessary and you have authority to do so. Organisers of activities involving children remain responsible for their own data protection, consent and safeguarding obligations.

Automated decision-making

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects.

reCAPTCHA uses automated analysis to identify suspected spam or automated submissions, but it does not determine whether a booking will be accepted.

Your rights

Depending on the circumstances and lawful basis, you may have the right to:

• ask for confirmation that we process your personal information;
• receive a copy of your personal information;
• have inaccurate or incomplete information corrected;
• ask for information to be deleted;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• receive certain information in a portable format; and
• withdraw consent at any time where processing is based on consent.

These rights are not absolute, and legal exceptions may apply.

You have the right to object to processing based on legitimate interests. You also have the right to object at any time to the use of your information for direct marketing.

To exercise a right, contact info@ekopia.org.uk. We may need to request information to confirm your identity. We will normally respond within one month.

Complaints

Please contact us first if you have concerns so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner’s Office:

Make a data protection complaint to the ICO
Telephone: 0303 123 1113

Changes to this notice

We may update this notice when the website, venue services, providers or legal requirements change. The latest version will be published on this page with an updated review date.