PRIVACY POLICY

Last update: 22/08/26

1. Who we are

Totnes Business Forum CIC (“TBF”, “we”, “our”, “us”) is a community interest company set up to support independent businesses in Totnes and the surrounding district. This policy explains how we collect, use, and protect information about the businesses and individuals we work with.

TBF is the “data controller” for the information described in this policy.

Contact address: 2B Burke Road, Totnes, Devon, TQ9 5XL

Contact email: hello@totnesbusinessforum.co.uk

Company registration number: 17405525 

2. What information we collect

We collect information directly from you, whether online — for example, through our website, by email, or when you apply for Forum membership — or in person, such as at a TBF event or meeting. This includes:

• Business details: business name, trading address, sector, and size.

• Contact details: your name, role, email address, and telephone number.

• Information you provide when you take part in a TBF survey, project, or initiative, including your business’s needs, preferences, and current arrangements relevant to that activity.

• If you sign up to our newsletter or mailing list: your name, email address, and business name.

• If you ask us for more information about Forum membership, before making a formal application: your name, contact details, and business name, so we can follow up with you.

• If you apply for Forum membership: the tier you are applying for, information relevant to your eligibility for that tier, and, if you are approved, your membership tier, join date, renewal date, and dues payment history.

• If you set up a Direct Debit mandate to pay dues: your bank account details are collected and held directly by GoCardless, our Direct Debit provider, not by TBF. We hold only the mandate reference and payment status.

• If you raise a complaint: details of your complaint, and any related correspondence or evidence.

• If we take photos or video at a TBF event or meeting: images that may identify you, where you're pictured.

• Information collected automatically when you visit our website — see “Cookies and website analytics” below.

If you are a sole trader, or you contact us using a personal email address, some of the information above will be your personal data as an individual, and every protection in this policy applies to you in full.

3. How and why we use your information

We use your information to:

• Keep you informed about TBF membership, meetings, and events.

• Develop and deliver collective projects on behalf of participating businesses — for example, group purchasing or procurement schemes, shared local services, or joint promotional initiatives. From time to time this may mean inviting prospective suppliers or delivery partners to bid for the opportunity to work with our participating businesses collectively.

• Respond to enquiries you send us, including following up if you've asked for more information about Forum membership.

• Send our newsletter and other member communications, where you have asked to receive them.

• Assess your application for Forum membership and, if you are approved, administer your membership — including renewals and collecting annual dues.

• Handle and respond to complaints, in line with our Complaints Policy.

• Use photos and video from TBF events to promote TBF and its activities — for example, on our website, social media, and newsletter.

• Understand how our website is used, so we can improve it.

Our legal basis for this processing is usually our legitimate interest in supporting and representing the local business community, which is TBF’s core purpose. Where you apply for paid Forum membership (as a Sponsor Member, Member or Associate Member), we process your information as necessary to take steps you have asked for before entering into that arrangement, and, once you join, to administer it and collect dues. Where we send you marketing-style communications such as our newsletter, we rely on your consent, which you can withdraw at any time. Where we use photos or video from an event to promote TBF, we do this on the basis of our legitimate interest in promoting TBF and the local business community, balanced by the notice and opt-out described below. Where a collective project leads to you entering into an individual arrangement with a delivery partner, we — and that partner — will process the necessary information as a step towards setting up that arrangement.

If we take photos or video at a TBF event, we’ll give notice that this is happening — for example, by signage or an announcement at the start of the event — and explain how to opt out, or ask us afterwards not to use a particular photo or video clip. If an event may include children, we take extra care, and will seek a parent or guardian’s specific agreement before using any photo that identifies a child.

4. Who we share your information with

When TBF runs a collective project that involves selecting an external supplier or delivery partner:

• We may share aggregated and anonymised information (for example, total figures or summaries that do not identify any individual business) with prospective partners during the selection process, so they can prepare an informed proposal.

• Once a partner has been selected, we will share the identifying details of participating businesses (such as business name, address, and contact details) with that partner only, so they can contact you directly to set up your individual arrangement.

We also use trusted service providers who process information on our behalf, currently:

• Google — for forms, spreadsheets, polls, surveys and website analytics

• Squarespace — our website host

• Mailchimp — for sending our newsletter and other member communications

• GoCardless — for collecting membership dues by Direct Debit

• Meta — for TBF's public Facebook page, private members' Facebook group, members' WhatsApp group, and Instagram account

• Microsoft — for TBF's LinkedIn profile

Google, Squarespace, Mailchimp, Meta, and Microsoft are based in the United States. Where information is transferred to them, this is done under UK-approved safeguards, such as the International Data Transfer Addendum or Standard Contractual Clauses, as set out in their respective data processing terms. GoCardless is a UK company, authorised and regulated by the Financial Conduct Authority, so no international transfer applies to information processed through it.

If you set up a Direct Debit mandate to pay membership dues, your bank account details are collected and held directly by GoCardless. TBF does not see or store your full bank account details — only the payment reference, mandate status, and payment history needed to administer your membership.

Photos and video from TBF events may be published on TBF's website, on TBF's public Facebook page, on TBF's Instagram account, and on TBF's LinkedIn profile.

TBF also runs a private, members-only Facebook group and a members-only WhatsApp group. If you're a member of the Forum, we may invite you to join either or both. Joining the Facebook group means your name, as shown on your Facebook profile, becomes visible to other members of the group. Joining the WhatsApp group means your phone number becomes visible to other members of the group, in addition to your name. Both groups are processed by Meta. TBF manages who can join or must leave each group, but what's posted inside them is otherwise outside TBF's control and subject to Meta's own terms. Anyone in either group is expected to follow TBF's Forum Members' Code of Conduct.

We do not sell your information, and we do not share it with third parties for their own marketing purposes.

5. How long we keep your information

We keep information for no longer than we need it. Our standard retention periods are:

6. Cookies and website analytics

Our website uses cookies — small files stored on your device that help websites function and help us understand how our site is used.