1. Introduction

Welcome to SmellTaste privacy notice.
SmellTaste respects your privacy and is committed to protecting your personal information (“personal data”). This privacy notice will inform you how we look after your personal data when you visit our digital platform and website (collectively referred to as “website”) (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

2. Scope

Website

This website and its owners take a proactive approach to user privacy and ensure the necessary steps are taken to protect the privacy of its users throughout their visiting experience. This website complies with all UK national laws and requirements for user privacy.
In addition to this overarching privacy policy, a privacy notice is provided at each point where personal data is collected (e.g., registration forms, sign up for a LTSAT session, support requests). That notice links back to this policy and sets out the exact categories of data that will be collected, the purpose of the collection, and any third party sharing (for example, with our data processing partner Beacon).

3. What personal data do we collect?

Our website does not routinely collect any personal data unless you contact us directly using the forms for membership and support or a survey that you may be asked to participate. For more information, please see our GDPR policy.
If you contact us, we will collect the following personal data:
• Identity Data – your name.
• Contact Data – your email address and first four letters/digits of your postcode.
• Technical Data – internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Usage Data – information about how you use our website and services.
• Marketing and Communications Data – your preference in receiving marketing from us and our third parties and your communication preferences.
We also occasionally collect Sensitive Personal Data (special categories) when you voluntarily disclose health related information during a support call or LTSAT session. In those cases we obtain explicit, separate consent before processing that data, and we only use it for the purpose you have authorised (e.g., providing personalised support and information).
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). The exception is the health related data described above, which is processed only with explicit consent.
We also do not collect any information about criminal convictions and offences.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

4. How do we collect your personal data?

We can only collect your personal data if you contact us directly and provide this information.

We collect data and process data when you:
• email us with queries, suggestions or feedback; or
• register online for any services.
• Where we survey SmellTaste members and then we may use the anonymised results in a medical journal publication. We will therefore accept your participation in the survey as consent for this to happen unless you contact us at info@smelltaste.org.uk to state otherwise.

As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie clause below for further details.
We also receive data from Beacon, our third party data processing partner, when you sign up for a LTSAT session or a support call. Beacon processes the data on our behalf under a signed Data Processor Agreement (DPA). The DPA ensures that Beacon adheres to the same UK GDPR standards as SmellTaste.
We also collect Technical Data from analytics providers such as Google based outside the UK.

5. Lawful basis for processing

We collect your personal data in the following circumstances:
• when we perform a contract, we are about to enter into or have entered into with you;
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
• where it is necessary to comply with a legal obligation; or
• you have provided us with consent.
Contractual context – In the context of SmellTaste services, “contract” refers to any formal agreement you enter into with us, such as signing up for a Let’s Talk Smell and Taste (LTSAT) session, to become a member, or support and information contact. The contract gives us a lawful basis to process the data you provide in order to deliver the agreed upon service.
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

6. Sharing your data

We will never share your data with any other organisations without asking you and without you giving your permission.
• External third parties including service providers acting as processors based outside the UK who provide IT and system administration services or joint controllers including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.
We specifically share data with Beacon for the purpose of delivering LTSAT sessions and support and information, education and engagement and community development and fundraising. This sharing is covered by our Data Processor Agreement with Beacon, which obligates Beacon to process the data only on our instructions and to implement appropriate security measures.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

7. International transfers

We do not transfer your personal data outside the UK except when we use third party analytics providers (e.g., Google) that operate outside the UK. Those transfers are governed by Standard Contractual Clauses and other safeguards approved by the UK Information Commissioner’s Office (ICO).

8. Data storage & security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We store your data in our password protected office computer system using a contact database.

9. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.
We store your contact details for 24 months after the last time you have contacted us.

10. Marketing

We might consider sending you information about products and services of ours that we think you might like but only if you have agreed to receive marketing. You may opt out later.
You have the right at any time to stop us from contacting you. If you no longer wish to be contacted for marketing purposes, please email us at: info@smelltaste.org.uk

11. Your data protection rights

We want to make sure you are aware of your rights. You have:
• The right to access – the right to request copies of your personal data
• The right to rectification – the right to request that we correct any information which you believe is inaccurate or expand on any information you believe is incomplete
• The right to erasure – the right to request that we erase your personal data
• The right to restrict or object to us processing your data
• The right to request transfer of your personal data
• The right to withdraw consent
If you make a request, we have one month to respond to you. If you would like to exercise these rights, then please contact us at our email: info@smelltaste.org.uk

12. Cookies

SmellTaste website uses Google and Meta analytics cookies to collect standard anonymised information about visitors’ behaviour. This information enables us to improve your experience of SmellTaste website by understanding how you use our content.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.
We use the following cookies:
• Strictly necessary cookies – required for the operation of our website (e.g., login, secure areas).
• Analytical or performance cookies – allow us to recognise and count the number of visitors and see how visitors move around our website.
• Functionality cookies – recognise you when you return, personalise content, remember preferences (e.g., language).
• Targeting cookies – record your visit, pages viewed and links followed; used to make the website and advertising more relevant to your interests.
We do not share the information collected by the cookies with any third parties.
We now display a cookie banner on first visit that asks for your consent to non essential cookies (analytical, functionality and targeting). You can accept, reject or manage preferences. The banner also links to a dedicated Cookie Policy page that explains each category in detail.
You can also prevent the setting of cookies by adjusting the settings on your browser (see your browser ‘help’ to understand how to do this). Be aware that disabling cookies may affect the functionality of this and other websites you visit.

13. Links to other websites

SmellTaste website contains links to other websites – our privacy notice does not extend to those sites.

14. Changes to our privacy notice

This privacy notice was created in July 2024 and updated September 2025.

15. Contact us

You can get in touch by emailing us at: info@smelltaste.org.uk
Or you can write to us at: Unit 2, Franklins House, Wesley Lane, Bicester OX26 6JU

16. Reporting complaints

If you wish to report a complaint or feel that we have not addressed your concern in a satisfactory manner, you may contact the Information Commissioner:
The Information Commissioner’s website is: https://ico.org.uk/make-a-complaint/