Privacy Policy - The Lane Norfolk

The Lane Norfolk (“The Lane”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, join The Lane, create or maintain a directory profile, contact us, attend or register for our activities, or subscribe to our communications.

It also explains the rights you have under UK data protection law.

1. Who we are

The Lane Norfolk is an online directory and community designed to champion independent professionals and make it easier for businesses and other users to discover freelance talent.

For the purposes of UK data protection law, the data controller is:

The Lane Norfolk Registered/business address: Reflection, The Turnpike, Bunwell, NR16 1SP.

Email: hello@thelanenorfolk.co.uk

ICO registration number: ZC278186

As data controller, we decide how and why personal information collected through The Lane is used.

2. The information we collect

The personal information we collect depends on how you interact with The Lane.

Membership and account information

When you join The Lane or create an account, we may collect:

your name;
business or trading name;
email address;
telephone number;
billing address;
membership type;
account and login information;
membership start, renewal and cancellation information;
payment and transaction records; and
correspondence relating to your membership.

Payment information

Payments for The Lane memberships are processed securely by Stripe.

When you make a payment, Stripe may collect and process information including your name, billing information, payment card or other payment method details, transaction information, IP address and information used for fraud prevention and payment authentication.

The Lane does not receive or store your full payment card details. Payment information required to process the transaction is provided directly to Stripe and handled in accordance with Stripe’s own privacy and security practices.

We may receive limited information from Stripe relating to your payment, such as:

your name and contact details;
billing information;
the amount paid;
payment status;
transaction or payment reference;
membership or subscription information;
renewal and cancellation information; and
limited payment-method information, such as the type of card and its last four digits.

We use this information to administer memberships, process and reconcile payments, manage recurring subscriptions and renewals, deal with refunds or payment queries, maintain appropriate financial records and help prevent fraudulent transactions.

Our lawful bases for this processing are performance of our contract with you, compliance with our legal obligations, including relevant accounting and tax requirements, and, where appropriate, our legitimate interests in administering payments and protecting The Lane against fraud.

Stripe acts independently in respect of certain personal information it processes for its own purposes, for example to comply with legal and regulatory obligations, provide payment services and prevent fraud. Stripe’s own privacy notice explains how it processes personal information.

Directory profile information

Members may provide information for publication within The Lane directory, including:

name;
photograph or profile image;
business name and logo;
job title or professional description;
business location or area served;
website;
social media links;
contact information;
biography or business description;
services, expertise and specialisms;
platforms, software or professional tools used;
examples of work or portfolio information; and
any other information a member chooses to include in their profile.

The purpose of the directory is to make professional information publicly discoverable. Information included in a published profile should therefore be treated as public information.

Public profiles may be viewed by people who are not members of The Lane and may also be indexed, cached or displayed by search engines and other third-party services.

Although we can remove information from The Lane itself, we cannot guarantee the immediate removal of copies that have already been indexed, cached, saved or republished by independent third parties.

We recommend that members only include contact details and other information they are comfortable making publicly available.

Verification and membership review information

We may collect or review information reasonably necessary to verify that a member represents a genuine business or professional service and that their profile complies with our Membership Terms.

This may include information from:

the member directly;
their business website;
professional or business social media profiles;
publicly accessible business directories;
Companies House or other public registers, where relevant; and
other publicly available professional information.

We do not use this process to carry out intrusive background checks or to collect information that is not reasonably relevant to operating a trusted professional directory.

Enquiries and correspondence

If you contact us, we may collect:

your name;
email address;
telephone number;
business name;
the content of your message; and
any information you choose to provide.

Mailing list and marketing information

If you subscribe to updates from The Lane, we may collect:

your name;
email address;
business or professional information you provide;
your marketing preferences;
the date, time and source of your subscription or consent;
email delivery information; and
information about interaction with our communications, where tracking is enabled and permitted.

We use Klaviyo to help manage our mailing lists, email communications and related marketing activity. More information about Klaviyo is provided in section 8 below.

Website and technical information

When you use our website, we may automatically receive information such as:

IP address;
browser and device type;
operating system;
pages viewed;
referring pages or links;
approximate geographic information derived from an IP address;
dates and times of visits; and
information collected through cookies and similar technologies.

How cookies and similar technologies are used is explained separately in our Cookie Policy.

3. How we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for processing personal information.

Providing your membership

We use membership and account information to:

create and administer your membership;
provide membership benefits;
manage renewals, cancellations and payments;
respond to membership enquiries; and
provide information necessary to operate your membership.

Our lawful basis is generally performance of a contract, or taking steps at your request before entering into a contract.

Publishing your directory profile

We use the information you submit for your directory profile to create, maintain and publish your listing and make it discoverable to users of The Lane.

Because publication in the directory is a core part of the membership service, our lawful basis is generally performance of our contract with you.

You are responsible for ensuring that information you provide for publication is accurate and that you have the right to provide any information, images, logos, intellectual property or personal information relating to another person.

Verifying members and moderating the directory

We may review profiles and publicly available professional information to protect the integrity of the directory, investigate concerns, enforce our Membership Terms and reduce fraudulent, misleading or inappropriate listings.

Our lawful basis is our legitimate interests in maintaining a genuine, useful and trusted directory and community.

Where appropriate, processing may also be necessary for the performance of our contract with members.

Responding to enquiries

We use information provided in enquiries to respond to you and manage our relationship with you.

Depending on the nature of the enquiry, our lawful basis may be:

taking steps before entering into a contract;
performance of a contract; or
our legitimate interests in responding to enquiries and operating our business.

Payments, subscriptions, accounting and legal records

We use Stripe to process membership payments and, where applicable, recurring membership subscriptions.

We process information relating to payments and subscriptions in order to:

take membership payments;
administer recurring payments and renewals;
confirm whether payments have been successful;
deal with failed or overdue payments;
process refunds where applicable;
manage cancellations;
reconcile our financial records;
comply with accounting and taxation requirements; and
detect or prevent fraudulent transactions.

Our lawful bases for this processing may include performance of our contract with you, compliance with a legal obligation and our legitimate interests in administering and protecting our business.

Service and membership communications

We may send members administrative communications relating to their account or membership, including payment confirmations, renewal information, changes to services, important policy information and messages required to provide the membership.

These are service communications rather than marketing communications.

Our lawful basis is generally performance of our contract with you and, where appropriate, our legitimate interests in administering The Lane.

Marketing communications

We may send newsletters, updates, event information, offers and other marketing communications where we are legally permitted to do so.

Where consent is required under the Privacy and Electronic Communications Regulations (“PECR”), we will ask for consent.

In circumstances where the law permits marketing without prior consent, such as where an applicable soft opt-in or business-to-business rule applies, we may rely on our legitimate interests, provided that those interests do not override your rights and freedoms.

We do not treat acceptance of our Membership Terms as consent to receive optional marketing.

You can unsubscribe from marketing communications at any time by using the unsubscribe link included in our emails or contacting us at hello@thelanenorfolk.co.uk.

We may retain limited information on a suppression list after you unsubscribe so that we can respect your preference and avoid sending marketing to you again inadvertently.

Website security, administration and improvement

We process appropriate technical information to operate and secure our website, detect faults, prevent misuse and understand how our services are being used.

Depending on the technology and purpose involved, our lawful basis may be our legitimate interests in operating, securing and improving The Lane.

Where cookies or similar technologies require consent under PECR, the fact that we may have a legitimate interest under data protection law does not remove the requirement to obtain that cookie consent.

4. Information that you make public

The Lane is designed to provide a public professional directory.

When you choose to publish information in your directory profile, it may be:

visible without logging in;
found through searches on The Lane;
shared by visitors;
indexed by search engines; and
accessed from outside the UK.

Please therefore avoid including private, sensitive or unnecessary personal information in your public profile.

If you want information removed or amended, please update your profile where that functionality is available or contact us.

Removal from The Lane does not necessarily remove information previously cached, indexed or independently stored by search engines or other third parties.

5. Special category personal information

We do not ordinarily require members or website users to provide special category personal information, such as information concerning health, ethnicity, religion, political opinions, trade union membership, genetic or biometric information, or sexual orientation.

Please do not include this type of information in a directory profile unless it is genuinely necessary for your professional listing and you are comfortable making it public.

If we ever need to process special category personal information for another purpose, we will ensure that an appropriate lawful basis and additional legal condition applies.

6. Where we obtain your information

Most information we process is provided directly by you when you:

join The Lane;
create or update a profile;
subscribe to communications;
contact us;
register for an event or activity; or
otherwise interact with us.

We may also receive limited payment and transaction information from Stripe when you purchase or renew a membership.

We may obtain limited professional or business information from publicly accessible sources for membership verification, directory administration or to check information supplied to us.

Where required by law, we will provide appropriate privacy information where personal information has been obtained from another source.

7. Who we share personal information with

We do not sell personal information.

We may share information with carefully selected service providers where reasonably necessary to operate The Lane, including providers involved in:

website hosting and technical support;
website and membership administration;
payment and subscription processing, including Stripe;
email delivery and marketing;
cloud storage and business administration;
security and fraud prevention;
analytics, where used;
accounting and professional advice; and
events or services that you specifically choose to participate in.

These providers may process personal information on our behalf and, in some circumstances, may act as independent controllers for particular processing activities.

In particular, Stripe processes payment information in connection with membership purchases and subscriptions. Stripe may process certain personal information for its own purposes, including payment processing, fraud prevention, security and compliance with legal and regulatory requirements.

We may also disclose personal information where reasonably necessary:

to comply with a legal or regulatory obligation;
in connection with legal proceedings;
to establish, exercise or defend legal rights;
to prevent or investigate fraud or unlawful activity;
to protect The Lane, its members or other people; or
in connection with a sale, restructuring or transfer of all or part of The Lane, subject to appropriate safeguards.

Information deliberately published in a directory profile is available publicly and is not restricted to our contracted service providers.

8. Klaviyo

We use Klaviyo as a service provider for email marketing, mailing-list management, communications and related marketing analytics.

Information processed through Klaviyo may include your:

name;
email address;
marketing preferences;
subscription and unsubscribe information;
email engagement information;
IP address;
device and browser information; and
website activity where Klaviyo onsite tracking is enabled and you have provided any consent required for that tracking.

Klaviyo may use cookies and similar technologies to recognise browsers and associate website activity with a Klaviyo profile once a visitor becomes identifiable.

For example, Klaviyo uses a cookie known as __kla_id. It may initially contain an anonymous browser identifier. Once a visitor is identified, the cookie may enable browsing activity to be associated with identifiers held within their Klaviyo profile.

The duration of this cookie varies according to browser technology and configuration and may be refreshed when an individual is subsequently identified.

Klaviyo may also provide reporting about the delivery and interaction with communications, including information relating to email opens and link clicks where those features are enabled and lawfully used.

We configure Klaviyo and our cookie/marketing settings with the intention of respecting applicable UK privacy and electronic communications requirements.

Klaviyo, Inc. is based in the United States, and its platform/customer data is hosted using AWS infrastructure in the United States. This means personal information processed through Klaviyo may be transferred outside the UK.

Klaviyo provides contractual and other transfer safeguards through its Data Processing Agreement, including provisions designed to address transfers of personal information subject to UK data protection law.

You can find further information in Klaviyo’s own Privacy Notice and legal documentation.

9. International transfers

Some of the organisations that provide services to us, including Klaviyo and Stripe, operate internationally and may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we take steps to ensure that the transfer is made in accordance with applicable UK data protection law.

This may include relying on an applicable UK adequacy regulation or recognised contractual safeguards or other lawful transfer mechanisms.

You can contact us if you would like more information about safeguards relevant to a particular transfer.

10. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet contractual, accounting, legal and regulatory requirements.

As a general approach:

Active membership and profile information is normally retained for the duration of your membership and for a reasonable period afterwards where necessary to administer cancellation, resolve disputes or maintain appropriate records.

Public directory information will normally be removed from The Lane following the termination or expiry of a membership, subject to any limited retention needed for legal or administrative purposes. Copies controlled independently by search engines and third parties may remain outside our control.

Financial and transaction records may normally be retained for up to six years, or for another period required by applicable tax, accounting or legal obligations.

Enquiry and correspondence records are normally retained only for as long as they remain relevant and may generally be deleted or anonymised after approximately 24 months where there is no continuing relationship or legal reason to retain them.

Marketing information is retained while you remain subscribed or while we are otherwise lawfully permitted to send marketing. If you unsubscribe or object, we may retain the minimum information necessary on a suppression list to respect your preference.

Technical and security records are retained for a period appropriate to their security, diagnostic or administrative purpose.

We may retain information for longer where this is necessary to establish, exercise or defend legal claims, comply with law, investigate fraud or resolve a dispute.

We periodically review the information we hold and delete or anonymise information that is no longer required.

11. Security

We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

Measures may include controlled access to systems, password protection, appropriate security settings, secure service providers, software updates, backups and other measures proportionate to the information we process.

No online system can be guaranteed to be completely secure, but we take reasonable steps to protect the information entrusted to us.

12. Your rights

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information, including the right to:

be informed about how your information is used;
request access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase your personal information in certain circumstances;
ask us to restrict processing in certain circumstances;
receive certain information in a portable format where the right to data portability applies;
object to certain processing based on legitimate interests; and
object at any time to the use of your personal information for direct marketing.

Some rights are subject to legal conditions and exemptions and will not apply in every situation.

If we rely on your consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before the consent was withdrawn.

To exercise your rights, contact us at hello@thelanenorfolk.co.uk

We may need to ask for reasonable information to confirm your identity before acting on a request.

13. Automated decision-making

We do not currently make decisions about members or website users based solely on automated processing where those decisions produce legal or similarly significant effects.

If this changes, we will update this Privacy Policy and provide any information required by law.

14. Third-party websites

Our website and directory may contain links to members’ websites, social media accounts and other third-party services.

The Lane is not responsible for the privacy practices, content or security of independent third-party websites. When you leave our website, the relevant third party’s privacy terms will apply.

15. Complaints

If you have concerns about how we use your personal information, please contact us first at:

hello@thelanenorfolk.co.uk

We will aim to investigate and respond appropriately.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).

Information about raising a concern is available at ico.org.uk.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to The Lane, the technology we use or applicable legal requirements.

The most recent version will be published on our website with the date it was last updated.

If we make a material change to the way we use personal information, we will take appropriate steps to bring that change to the attention of affected users where required.