Privacy Policy

This notice explains how the Burley Gate Community Shop uses and protects personal information. Any questions regarding this policy should be addressed either in writing to The Secretary, Burley Gate Community Shop Ltd, Burley Gate, Hereford, HR1 3QR; or via email to

This privacy notice has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.

What personal information do we collect?

  • CCTV images

  • Shareholder & investor names and contact details

  • Volunteer & employee names and contact details

  • Customer account holder names and contact details

  • Supplier names and contact details

How do we use personal information?

  • We capture CCTV images inside and outside the shop, for crime prevention and security purposes

  • We store shareholder & investor details to maintain our register of investors, and fulfil our contractual obligations

  • We store volunteer & employee details to manage operational shift rotas, and fulfil our contractual obligations

  • We store customer account holder details to fulfil our contractual obligations

  • We store supplier details for purchasing and to fulfil our contractual obligations

For how long do we keep personal information?

We keep personal information only as long as necessary for the purposes for which we collected it, and to comply with applicable law.

What is the legal basis for processing the information we keep?

As a Community Benefit Society, we provide a service which is in the public interest; additionally, all personal information that we keep is processed under the following legal bases:

  • CCTV images are captured on the legal bases of Legitimate Interest; and potentially Legal Obligation, and Criminal Offence Data

  • All other personal information is processed on the legal bases of of Legitimate Interest and Contract

How do we keep personal information secure?

  • All personal data (excluding CCTV images) will be stored electronically in a GDPR-compliant, central location, accessible only to authorized individuals.

  • We will delete promptly all personal data (including CCTV images) unnecessary to the operation of the business, and not required for legal purposes.

  • All changes made to personal data will only be made by an authorized individual, and every change will be logged with the name of the modifier, the date, and the reason.

  • Appropriate training/information on matters relating to data security will be provided to all who volunteer and work in the shop

Do we share personal information?

We do not share any personal information with third parties except the relevant authorities, on the basis of Legal Obligation, or the basis of Criminal Offence Data.

Legal rights

Under data protection law, you have a number of rights over your personal information.

These include:

  • the right to request your information,

  • the right to request that any errors are corrected,

  • and the right (under certain circumstances) to request that your information be erased or anonymised.

To request your records, you will need to put your request in writing or email, including proof of identification, to
the address given above.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) about the handling of your personal data or a data request; for further details see