- Who collects your data
Thousand Hands Ltd. trading as Novara Media is the ‘controller’ of the personal data we collect and process. The controller is the decision-maker of the overall means and purposes of the personal data we hold.
- What data is collected
In most circumstances we will only ask you for your name and contact details, as well as payment details if you donate to Novara Media. Sometimes we ask for additional information about you and your views, interests and activities you take part in, if this helps improve our services relevant to you.
If you have provided content to Novara Media, we will also keep a record of your contributions in addition to publishing that content.
If you donate to Novara Media, we use your bank card data, but we do not store this data ourselves, rather it is stored by our payment processor Stripe. We may also securely store details of when you made a payment, how much you paid and when and how much you intend to pay in the future. If you make payments using a cheque or cash, we will also securely store physical records of this.
We also collect information on how you access and use our services. This usage data may include information such as your computer’s internet protocol address (e.g. IP address), browser type, browser version, the pages of our website you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our services.
Examples of Cookies we use: session cookies (we use these cookies to operate our services) and preference cookies (we use these cookies to remember your preferences and various settings).
This site uses Cloudflare. Cloudflare sets a __cfduid cookie as part of the services it provides to keep this site secure and online faced with the threats of the internet. It does not correspond to any user ID and does store any personally identifiable information.
- Where we obtain your data from
In most cases, we will obtain your personal data directly from you, using an electronic or physical form.
- How your data is kept secure
The security of your personal data is important to us, but remember that no method of transmission over the internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.
- Who has access to your data
We will never sell your personal data but sometimes it is necessary to share your information. Personal data is only ever shared where we have a lawful basis to do so.
In Novara Media, only those authorised to process your personal data can access it. We make sure that our staff and volunteers see only the personal data that is necessary to perform their tasks.
We may employ third party companies and individuals to facilitate our services, to provide services on our behalf, or to assist us in analysing how our services are used. These third parties have access to your personal data only to perform these tasks and are obligated not to disclose or use it for any other purpose. At all times, we remain the controller of your personal data whereas third parties are merely processors.
Disclosure for law enforcement: Under certain circumstances, we may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).
- International transfers
In order to process your data for the purposes outlined below, we may need to transfer your data to countries or jurisdictions outside the EEA. In each case, we ensure that our suppliers provide adequate protection for the rights of data individuals in connection to the transfer of their personal data. Currently, we expect all suppliers to use a standard contractual clause approved by the European Union or be subject to Privacy Shield scheme in the United States.
- How your data is processed
We use the collected data for various purposes:
- To provide and maintain our services
- To notify you about changes to our services
- To allow you to participate in interactive features of our services when you choose to do so
- To gather analysis or valuable information so that we can improve our services
- To monitor the usage of our services and
- To detect, prevent and address technical issues
- The bases on which we process your data
We process your data on the following bases:
- Legal obligation
- Legitimate interest
We process most of the data that we hold on the basis of consent. Where we process your data on the basis of your consent, that processing of your data will be restricted to those types of processing for which we have received your consent
- How Novara Media will communicate with you
For any direct “marketing” communications, we will only contact you via email or text if we have your permission to do so.
To respond to your queries we will contact you either via the medium you used to contact us or by a medium you have indicated you would like us to respond with. If it is necessary to contact you for any administrative purposes then we will usually try to email, text or call you, depending on what contact details we have available for you.
- How you can affect the way Novara Media processes your data
You have a number of privacy rights under the GDPR. These are:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
To exercise any of these rights, please email firstname.lastname@example.org. There is no prescribed format for your request.
We think the rights most relevant to you are as follows: The right of access allows you to request details of all personal data we hold on you. The right of erasure allows you to require us to delete your personal data. The right of rectification requires us to amend your data where appropriate. The right to object allows you to restrict the way we contact you or otherwise process your personal data.
Whenever you exercise one of your privacy rights, we are required to respond as soon as practically possible and no later than 1 month unless exceptional circumstances apply.
- Retention of your personal data
Generally, we keep your personal data while your regular donation and user account is active. Once your regular donation or user account is deleted the personal data is either deleted or anonymised to be kept for analysis. Once anonymised it no longer contains any personal data. In some circumstances under UK tax law, our payment processors Stripe, PayPal and GoCardless may be required to keep your basic personal data (name, address, contact details) for a minimum of 6 years.
- How to find out more or make a complaint
If you would like to make a complaint to us about how your data is processed, please email us at [email protected]
If you are not satisfied with our response, or believe we are processing your personal data not in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).