Privacy Policy
Be Inclusive Hospitality CIC
Who we are
Be Inclusive Hospitality CIC (“BIH”, “we”, “us”) is a not-for-profit social enterprise working to accelerate inclusion and belonging in hospitality, food and drink. We are the data controller for the information described below.
Company number 12758973 · ICO registration ZB231300
124 City Road, London
This policy covers everyone whose data we hold: website visitors, subscribers, programme participants, mentors, scholarship applicants, awards entrants and judges, event attendees, research participants, and contacts at partner, client, funder and supplier organisations.
What we collect
| If you are | We collect |
|---|---|
| A website visitor | Pages viewed, referral source, approximate location, device type, cookie identifiers |
| A subscriber or community member | Name, email, organisation, job role, email engagement |
| A programme, mentorship or workshop participant | Contact details, photograph, organisation, role, career stage, biography, application and assessment information, attendance, feedback |
| An awards entrant, nominee or judge | Contact details, entry or nomination content, supporting materials, and comments |
| An event attendee | Contact details, dietary and accessibility requirements, photographs and film |
| A partner, client, sponsor, funder or supplier contact | Business contact details, contract and correspondence records,feedback, payment information |
Our sector research surveys are anonymous. We do not collect names or contact details and responses cannot be traced back to you, so they are not personal data. Where research needs identifiable information, such as a named interview or case study, we say so and ask separately.
Equity monitoring
Across our programmes, events, awards and research we may ask about ethnicity, and may also ask about disability, religion or belief, sexual orientation, and sex or gender identity.
We collect it because we cannot measure or improve equity without it, and because funders require us to evidence who our work reaches. Where we ask these questions, we rely on your explicit consent under Article 9(2)(a) UK GDPR.
We report in aggregate only, suppress any figure based on fewer than five responses, and restrict access to those who need it for analysis. We keep anonymised research data indefinitely so we can track change in the sector over time.
Why we use your data, and our legal basis
| Purpose | Basis |
|---|---|
| Newsletter and marketing emails | Consent |
| Delivering programmes, mentorship, workshops, scholarships and events | Contract, or legitimate interests |
| Conducting and publishing research, and monitoring equity | Legitimate interests, plus the condition above |
| Reporting to funders, sponsors or partners | Legitimate interests, or legal obligation where an agreement requires it |
| Responding to enquiries | Legitimate interests |
| Financial and statutory records | Legal obligation |
| Website analytics | Consent, once our cookie consent tool is live |
Where we rely on legitimate interests, our interest is in running and improving a social enterprise that advances equity in hospitality; you can request our assessment. Where we rely on consent, you can withdraw it at any time without affecting what we did beforehand.
Who we share it with
We do not sell your data or share it for others’ marketing.
We use suppliers who handle data on our behalf under contracts requiring them to protect it and act only on our instructions: Mailchimp (email), SmartSurvey (surveys), Eventbrite (ticketing), and our website host and cloud storage providers. We also share entries with awards judges, who are bound by confidentiality, and report to funders, normally in aggregate. We disclose data to advisers, auditors, regulators or law enforcement where the law requires it.
Some suppliers are based outside the UK, mainly in the United States. Those transfers are protected by the supplier’s certification under the UK Extension to the EU–US Data Privacy Framework, or by an International Data Transfer Agreement. Details are available on request.
How long we keep it
| Subscribers | Until you unsubscribe, then email retained on a suppression list, so we do not contact you again |
| Enquiries | 2 years from last contact |
| Unsuccessful applications | 48 months |
| Programme, awards, funder, partner and scholarship participants | Duration, plus 6 years |
| Event attendance | 2 years; dietary and accessibility details deleted within 3 months |
| Photography and film | 5 years, or until you object |
Where a funder or client agreement requires longer, that period applies. At the end of a period, we securely delete or irreversibly anonymise.
Photography at events
We photograph and film our events, for reporting and publicity. We give notice in advance and at the venue. Inform a team member on arrival if you would prefer not to appear, or contact us afterwards to have an image removed. For significant uses such as campaign or advertising material we ask consent separately.
Cookies
Cookies are small files stored on your device. They usually count as personal data, and we treat them accordingly. Our use is governed by PECR as amended by the Data (Use and Access) Act 2025.
Strictly necessary cookies keep the site working and cannot be switched off. Analytics cookies(Google Analytics) tell us how the site is used. We are currently introducing a cookie consent tool. Until it is live, you can prevent these cookies by blocking or deleting cookies in your browser settings, or by installing Google’s browser opt-out add-on. Third-party cookies may be set by embedded content from LinkedIn, Instagram, YouTube or Substack, which those platforms may use for their own purposes — their privacy policies apply.
Security
We use encryption in transit, access controls, multi-factor authentication, written contracts with all processors, and staff training. We have a documented breach procedure, including notifying the ICO within 72 hours where required. No system is completely secure and we cannot guarantee absolute security.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or stop our use of it, transfer it, or withdraw consent. You can object to direct marketing at any time and we will always stop — the unsubscribe link in any email does this immediately.
These rights do not apply to anonymous research responses, because we cannot tell which response is yours.
Contact contact@bihospitality.co.uk. We respond within one calendar month, extendable by two months for complex requests, and will tell you if that applies. There is no charge unless a request is manifestly unfounded or excessive.
We do not make decisions about you by solely automated means. Applications are assessed by people. Our services are for adults; we do not knowingly collect data from under-18s.
Complaints
Please raise concerns with us first at contact@bihospitality.co.uk. We acknowledge within 30 days and respond without undue delay. If you remain dissatisfied you can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.
Changes
We review this policy annually and update it when our practices or the law change. The current version is always here, and we will tell you directly about material changes.