Privacy policy

SE1 Media Ltd is the data controller for the personal data described in this policy. We trade as the Digital Tourism Think Tank and this policy uses DTTT, we, us and our to mean the same company.

We have appointed a data protection officer who oversees how we handle personal data and is the point of contact for any question about it. Write to the Data Protection Officer at info@thinkdigital.travel or at the registered office above and mark it for their attention.

What we hold depends on your relationship with us. Most of it you give us directly, by filling in a form, buying a membership, registering for an event or corresponding with us. Some of it, described under website visitors, is collected automatically as you use the site.

Data categories used in this policy

We process personal data only where we have a lawful basis under the UK GDPR. The table below sets out what we do and the basis for each.

We use the services below to run this site and our work. Each acts as a data processor under a written contract with us and each may only process personal data on our instructions. All are based in the United States, apart from Xero which is headquartered in New Zealand, operating under Standard Contractual Clauses as approved by the UK Information Commissioner's Office.

Where we run a market screening, consultation or survey on a client's behalf, we share the responses, including the contact details of the person who submits them, with that client. The page that collects the responses names the client. The client uses them for that purpose under its own data protection obligations.

Using the services named in section 5 involves transferring personal data out of the United Kingdom, to the United States in every case and to New Zealand in Xero's. New Zealand holds a UK adequacy regulation. For the rest we rely on one of the mechanisms available under UK law:

• a UK adequacy regulation, where the destination country has been assessed as providing adequate protection
• the International Data Transfer Agreement
• the UK Addendum to the European Commission's standard contractual clauses
• the UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it

Which one applies depends on the provider. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework we rely on that. Otherwise we rely on the International Data Transfer Agreement or the UK Addendum in the data processing agreement we hold with them.

We keep personal data only for as long as we need it for the purpose it was collected for, including any period required for legal, accounting or reporting purposes.

The cookies this site sets

We use AI tools in producing our own content, including research, writing, design and code. Member and client personal data is excluded from those tools.

No automated decision-making takes place. Nothing that affects you, including membership, pricing or eligibility, is decided by a system without a person involved.

Where an engagement would involve AI processing of personal data, we agree it with the client in writing before the work starts and we run our AI Ethics Consideration Tool first.

If you think we have handled your personal data badly, tell us. Email info@thinkdigital.travel with "Data protection complaint" in the subject line and describe what happened.

We acknowledge every complaint within 30 days. The acknowledgement tells you who is looking at it, what we are doing and when to expect an outcome.

You can also complain to the Information Commissioner's Office, the UK supervisory authority for data protection. You do not have to come to us first and complaining to us does not affect your right to go to the ICO.

We update this page when our practices change. The version and date at the top show when it was last revised and every change is recorded in the log below. Material changes are emailed to members and to registered event attendees.

This policy is reviewed once a year and sooner if we add a service that handles personal data.