PRIVACY POLICY

Welcome to the Structural Timber Association Privacy Policy.

The Structural Timber Association respects the privacy of individuals and is committed to protecting personal data. This privacy policy will inform individuals as to how we look after their personal data when they visit our website, www.structuraltimber.co.uk (regardless of where it is visited from), when they become a member, apply to attend events, purchase products or services, or when they otherwise contact us. It will also tell individuals about their privacy rights and how the law protects them.

References to “an individual” or “individuals” are to individuals using our websites or otherwise contacting us (either on behalf of themselves, their business, a member or another individual or organisation).

1 IMPORTANT INFORMATION

It is important that this privacy policy is read together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data, for example, our rules of membership, so that individuals are fully aware of how and why we are using their data. This privacy policy supplements the other notices and is not intended to override them.

This version was last updated on 25th January 2021

It is important that the personal data we hold about individuals is accurate and current. Individuals should keep us informed if their personal data changes during their relationship with us. 

Our website is not intended for children and we do not knowingly collect data relating to children. 

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about the individual. We do not control these third-party websites and are not responsible for their privacy statements. When leaving our website, we encourage individuals to read the privacy policy of every website they visit.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

2 WHO WE ARE

We are Structural Timber Association Limited, a company incorporated in England and Wales with company number 03862401. Our registered office is Morris Owen, 43-45 Devizes Road, Swindon SN1 4BG The Structural Timber Association is the controller and responsible for individuals’ personal data (referred to as the “Structural Timber Association”, “we”, “us” or “our” in this privacy policy).

The Structural Timber Association operates a code of conduct / standard and membership services for customers in the timber and construction industry. We also provide training services and offer related products / services for sale through our website.

We are bound by applicable data protection laws in respect of the handling and collection of your personal data. The Structural Timber Association is registered as a data controller in England and Wales, with the Information Commissioner’s Office (ICO) under the ICO number 

The Structural Timber Association is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection.

If you have any questions about this privacy policy, including any requests to exercise legal rights, please contact us using the contact details in section 12.

3 BASIS FOR PROCESSING PERSONAL DATA

3.1 Sections 3.2 – 3.10 below explain how and why we process an individual’s personal data, as well as the legal basis on which this processing is carried out.

3.2 To provide membership services to our members: We may process personal data in order to operate and maintain our memberships and provide various supporting membership services to both members and individuals (such as individuals who work for and on behalf of our members and where those individuals contact us with a question in connection with our membership service and/or requests certain information from us). This may include providing contact details and other information to third parties interested in establishing a connection with our members (unless our member has formally notified us not to provide this information).

We may also process personal data relating to our members when they order products and/or services through our website.

The legal basis on which we process an individual’s personal data in these circumstances is performance of a contract with our member and to comply with legal obligations (in relation to our members) or our respective legitimate interests in dealing with membership service requests, providing products and/or services, responding to communications and solving members’ issues. If an individual does not provide us with the personal data we request from them for membership services purposes, we may not be able to fully answer their queries.

3.3 To provide membership benefits to our members: We may process personal data relating to individuals (such as individuals who work for and on behalf of our members) in order to provide our members with their membership benefits. These benefits include providing our members with newsletters containing industry news and promotions and notification about seminars, events and conferences and legal changes that may be of interest.

The legal basis on which we process an individual’s personal data in these circumstances is our legitimate interest to operate and promote the activities of an industry association.

3.4 To enter into a contract with an individual (non-members): We may process personal data relating to individuals who purchase products and/or services (such as handbooks and training services) through our website. We process this data in order to provide the products or services those individuals have ordered and to process payment.

The legal basis on which we process an individual’s personal data in these circumstances is performance of a contract with that individual. 

3.5 To provide information to individuals: We may process personal data relating to individuals in order to respond to general or specific enquiries from individuals or prospective members. This includes those enquiries received through the contact form on our website or otherwise communicated to us.

The legal basis on which we process an individual’s personal data in these circumstances is our legitimate interest to assist individuals with queries, grow our business and to provide customer service to our prospective members.

3.6 To make our website better: We may process an individual’s personal data in order to provide such individual with a more tailored user experience, including using their personal data to make sure our website is displayed in the most effective way for the device such individual is using. This processing means that an individual’s experience of our site will be more tailored to them, and that the content an individual sees on our site may differ from someone accessing the same site with a different browsing history or habits. We also use various cookies to help us improve our website (more details are set out in section 6), but we will not share an individual’s personal data with the third party analytics and search engine providers that assist us in the improvement and optimisation of our website.

We will also process personal data for the purposes of making our website more secure, and to administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. 

The legal basis on which we process personal data in these circumstances is our legitimate interest to provide an individual with the best experience we can, keep our website updated and relevant, study how individuals use our services, to inform our marketing strategy and to ensure that our website is kept secure. 

3.7 For marketing purposes: We may send individuals marketing communications by email, telephone or mail.

We will send members our regular newsletters and email information and updates as we believe this is one of the benefits of being a member. The legal basis on which we process personal data for these purposes is our legitimate interest to develop and further the aims of our organisation and your interest in receiving information. You can ask us to stop sending you the newsletter at any time by contacting us (please see section 12) or, by following the unsubscribe link in every marketing communication received from us.

We will only send marketing communications (other than member communications) if you have provided your express, opt-in consent.  You can withdraw your consent at any time by contacting us (please see section 12) or, by following the unsubscribe link in every marketing communication received from us 

If an individual does choose to opt out or to withdraw their consent, this will not mean that our processing of such individual’s personal data before they withdrew their consent was unlawful.

3.8 For prospecting: In a business-to-business context we may make contact with individuals to provide or seek information in connection with our services. The legal basis we rely on for making contact with individuals and processing their personal data is our shared legitimate interests in doing business together. When we make contact with individuals, they can exercise their right to object to such contact from us (for more information about individuals’ rights, see section 12).

3.9 If our business is sold: We may transfer individual personal data to a third party:

3.9.1 in the event that we sell or buy any business or assets, in which case we will disclose personal data to the prospective seller or buyer of such business or assets (at all times in accordance with all applicable data protection laws); or

3.9.2 if the Structural Timber Association or substantially all of its assets are acquired by a third party, in which case personal data held by the Structural Timber Association about its prospective members and members (including those individuals who work for and on behalf of our members) will be one of the assets transferred to the purchaser, in each case, the legal basis on which we process data in these circumstances is our legitimate interest to ensure our business can be continued by a purchaser. If individuals object to our use of personal data in this way, the relevant seller or buyer of our business may not be able to provide the applicable services.

3.10 To notify individuals of changes to our privacy policy: We may process personal data in order to update individuals to any changes made to our privacy policy.

The legal basis on which we process personal data in these circumstances is our legitimate interest to remain transparent in our use of individuals’ personal data and to ensure individuals are kept updated on how and why we process their personal data.  

3.11 We will only use an individual’s personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

3.12 If we need to use individuals’ personal data for an unrelated purpose, we will notify each individual and we will explain the legal basis which allows us to do so.

3.13 Please note that we may process an individual’s personal data without knowledge or consent, where this is required or permitted by law.

4 CATEGORIES OF INFORMATION WE COLLECT FROM INDIVIDUALS

4.1 We will collect and process the following personal data.

4.2 Information individuals give us: Individuals (such as individuals working for and on behalf of a member) may provide their personal data when making enquiries about and signing up to our membership services, filling in enquiry forms on our website, purchasing products and/or services through our website, corresponding with us about our membership services or other general correspondence with us by phone, email or otherwise. 

4.3 Online information we collect: With regard to visits to our website we may automatically collect the following information:

4.3.1 technical information, including the Internet protocol (IP) address used to connect an individual’s computer to the Internet, login information, browser type and version, time zone setting, browser plug-in types and versions, other hardware information, domain name, operating system and platform and possibly other software information;

4.3.2 information about an individual’s visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page.

4.4 Information we receive from other sources: We may receive information about an individual through the use our website or through use of the other services we provide. We work closely with third parties (including, for example, National Fire Chiefs Council who provide us with the STA members Sitesafe registration data base. We do not process (as a controller) any special categories of personal data, meaning personal data revealing:

4.4.1 racial or ethnic origin; 

4.4.2 political opinions; religious or philosophical beliefs or trade union membership; 

4.4.3 genetic or biometric data that uniquely identifies you; or

4.4.4 data concerning your health, sex life or sexual orientation.

4.5 We do not collect data relating to criminal convictions or offences or related security measures. 

5 CATEGORIES OF RECIPIENTS OF PERSONAL DATA

5.1 The details in our privacy policy relating to third parties other than the Structural Timber Association are for information only. We are not responsible for the privacy policies or practices of third party recipients of an individual’s personal data. Where third parties are recipients of an individual’s personal data from us, please ensure that as that individual you read any information those third parties provide about how, why and the legal basis for, their processing of such personal data and make your own enquiries in respect of them.

5.2 An individual’s personal data may be shared by us with external third parties for the purposes set out in section 3.  Sections 5.3 to 5.5 below, detail our main third-party recipients of personal data.

5.3 An individual’s personal data may be shared by us with external third parties who wish to establish a connection with our members (where that individual works for and on behalf of our member). We recommend that individuals’ contact details are not provided by our members for such purposes and that a corporate email address is used.   

5.4 An individual’s personal data may be shared by us with external third parties who provide support integral to the provision of our products and/or services and enable us to operate our business. These include:

  • Service providers acting as processors based in the UK who provide IT and system administration services.
  • Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors, insurers and employment and recruitment agencies based in the UK (or other relevant jurisdictions) who provide consultancy, banking, legal, insurance, accounting and recruitment services.
  • HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the UK (or other relevant jurisdictions) who require reporting of processing activities in certain circumstances.
  • Other third party companies where we have an agreement in place and only where an individual has agreed that we may share their personal data with them.

5.5 We may share an individual’s personal data with specific third parties for the purposes set out in section 3, such as: 

  • Lithium Systems – UK – IT / outlook 365 and website hosting
  • Radar Communications – UK – Communication Marketing and website management 
  • CIB – UK – PR
  • WebCRM ( UK Ltd) UK – data base members and external 
  • Xero –  UK – Accountancy package 
  • National Fire Chiefs Council – UK – Sitesafe registration 
  • Cogent Consulting – UK – Auditing of members 

6 COOKIES

6.1 Our website uses cookies to distinguish individuals from other users of our website. This helps us to provide individuals with a good experience when they browse our website and also allows us to improve our website. By continuing to browse the website, users are agreeing to our use of cookies.

6.2 A cookie is a small file of letters and numbers that we store on an individual’s browser or the hard drive of their computer. We only use (and store) non-essential cookies on an individual’s computer’s browser or hard drive if they provide their consent.

6.3 We use the following cookies:

 Cookie Purpose Expiration
 PHPSESSID necessary cookie used to maintain session on the website When browser is closed
 _ga Used to distinguish users. 2 years
 _gid Used to distinguish users. 24 hours
_gatUsed to throttle request rate.1 minute

More information

Full explanation of Google Analytics cookie usage available here: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

6.4 Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

6.5 Individuals can block cookies by activating the setting on their browser that allows such individual to refuse the setting of all or some cookies. However, if individuals use their browser settings to block all cookies (including essential cookies) they may not be able to access all or parts of our website. 

6.6 Except for essential cookies, all cookies will expire as outlined under the expiration column in the table included in paragraph 6.2.

7 USES MADE OF THE INFORMATION

7.1 We will combine the information individuals provide to us with information we collect about them. We will use this information and the combined information for the purposes set out in section 3 (depending on the types of information we receive).

7.2 The transmission of information via the internet is not completely secure. Although we will do our best to protect an individual’s personal data, we cannot guarantee the security of data transmitted to our website; any transmission is at the individual’s own risk. Once we have received an individual’s information, we will use strict procedures and security features to try to prevent unauthorised access.

8 WHERE WE STORE PERSONAL DATA

8.1 Individuals or members who access our website may be based outside the European Economic Area (EEA) so the processing of their personal data will involve the transfer and storage of data outside the EEA. Some of our suppliers are based outside the EEA.

8.2 Whenever we transfer personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

8.2.1 We will only transfer personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.

8.2.2 Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

8.3 If further information on the specific mechanism used by us when transferring an individual’s personal data out of the EEA is required please contact us directly (please see section 12).

8.4 All information individuals provide to us is stored on secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given an individual (or where the individual has chosen) a password which enables access to certain parts of our website, the individual is responsible for keeping this password confidential and must not share this password with anyone.

9 DATA SECURITY

9.1 We have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to individuals’ personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process personal data on our instructions and they are subject to a duty of confidentiality.

9.2 We have put in place procedures to deal with any suspected personal data breach and will notify the individuals involved and any applicable regulator of a breach where we are legally required to do so.

10 DATA RETENTION 

10.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

10.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

10.3 We will generally retain our members’ and customers’ data for a period of seven years after the membership has ended / they cease to be a customer, to ensure that we are able to assist you should you have any questions or feedback in relation to your membership or the products / services that they purchased or to protect or defend our legal rights.

10.4 Where we have processed your personal data to provide you with marketing communications with consent, we may contact you at least every twelve (12) months to ensure you are happy to continue receiving such communications. If you tell us that you no longer wish to receive such communications, your personal data will be removed from our marketing lists (but will be added to a “do not contact” list).

10.5 [Where we have processed your data for any other reason (such as where you have contacted us with a question in connection with services), subject to section 10.3, we will retain your data for [twelve (12) months].

10.6 In some circumstances you can ask us to delete your data: see section 11.1.3 below for further information.

10.7 In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

11 INDIVIDUALS’ LEGAL RIGHTS  

11.1 Under certain circumstances, individuals have rights under data protection laws in relation to their personal data. Individuals may have the right to: 

11.1.1 Request access to their personal data (commonly known as a “data subject access request”). This enables individuals to receive a copy of the personal data we hold about them and to check that we are lawfully processing it.

11.1.2 Request correction of the personal data that we hold about them. This enables individuals to have any incomplete or inaccurate data we hold about them corrected, though we may need to verify the accuracy of the new data they provide to us.

11.1.3 Request erasure of personal data. This enables individuals to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Individuals also have the right to ask us to delete or remove their personal data where they have successfully exercised their right to object to processing (see below), where we may have processed their information unlawfully or where we are required to erase their personal data to comply with local law. Note, however, that we may not always be able to comply with an individual’s request of erasure for specific legal reasons which will be notified to them, if applicable, at the time of their request.

11.1.4 Object to processing of their personal data where we are relying on a legitimate interest (or those of a third party) and there is something about their particular situation which makes them want to object to processing on this ground as they feel it impacts on their fundamental rights and freedoms. Individuals also have the right to object where we are processing their personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process an individual’s information which override their rights and freedoms.

11.1.5 Request restriction of processing of their personal data. This enables individuals to ask us to suspend the processing of their personal data in the following scenarios: (a) if they want us to establish the data’s accuracy; (b) where our use of the data is unlawful but they do not want us to erase it; (c) where they need us to hold the data even if we no longer require it as they need it to establish, exercise or defend legal claims; or (d) they have objected to our use of their data but we need to verify whether we have overriding legitimate grounds to use it.

11.1.6 Request the transfer of their personal data to them or to a third party. We will provide to individuals, or a third party they have chosen, their personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which they initially provided consent for us to use or where we used the information to perform a contract with the individual.

11.1.7 Withdraw consent at any time where we are relying on consent to process their personal data. However, this will not affect the lawfulness of any processing carried out before the individual withdrew their consent. If an individual withdraws their consent, we may not be able to provide certain products or services to them. We will advise the individual if this is the case at the time they withdraw their consent.

Individuals wishing to exercise any of the rights set out above should contact us directly. 

Individuals have the right to make a complaint at any time to the ICO, the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with concerns before you approach the ICO so please contact us in the first instance.

11.2 No fee usually required  

Individuals will not have to pay a fee to access their personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if their request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with their request in these circumstances.

11.3 What we may need from individuals  

We may need to request specific information from individuals to help us confirm their identity and ensure their right to access personal data (or to exercise any of their other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact individuals to ask for further information in relation to their request to speed up our response.

11.4 Time limit to respond  

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if an individual’s request is particularly complex or they have made a number of requests. In this case, we will notify the individual and keep them updated.

12 CONTACT

Questions, comments and requests regarding this privacy policy are welcomed:

Structural Timber Association Limited
The E Centre
Cooperage Way
Alloa
FK10 3LP
Telephone number: 01259 272140
Email address: Office@structuraltimber.co.uk
Company Number: 03862401

13 OTHER DOCUMENTS

Document Library – Terms and Conditions of Use can be found here

[Last Reviewed 27/07/2022]