Privacy Policy

Privacy Policy v.2.26     1^st July 2026

1. Introduction

This Privacy Policy explains how members of the Attention Industries group of companies (“we”, “us”, “our”, “the Company”, or “the Group”) collect, use, store, share and protect personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable data protection legislation.

This Privacy Policy applies to all individuals whose personal data we process, including but not limited to:

• Customers and prospective customers
• Employees / workers
• Job applicants
• Contractors
• Consultants
• Agency personnel
• Suppliers and supplier personnel
• Business contacts
• Website users
• Visitors to our premises
• Marketing contacts
• Content / journalistic contributors
• Research panel members

2. Data Controller

The data controllers within the Group are:

 

Name	ICO Registration Number
Attention Industries Limited	ZB343649
72Point Limited (also trades as OnePoll, PinPep, and Oath)	Z8020853
Creatorville Limited	ZB775653
South West News Service Limited	Z1433952

 

Each Data Controller may be contacted at [email protected] or at Media Centre, Emma Chris Way, Filton, Bristol, BS34 7JU.

3. Definitions

For the purposes of this Policy:

Personal Data means any information relating to an identified or identifiable living individual.

Special Category Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, or data concerning a person’s sex life or sexual orientation.

Processing means any operation performed on personal data including collection, storage, use, disclosure, deletion or destruction.

Data Subject means the individual to whom the personal data relates.

4. Data Protection Principles

We process personal data in accordance with the principles contained within Article 5 UK GDPR. Personal data will be:

(a)        processed lawfully, fairly and transparently.

(b)        collected only for specified, explicit and legitimate purposes.

(c)        adequate, relevant and limited to what is necessary.

(d)        accurate and kept up to date.

(e)        kept no longer than necessary.

(f)         processed securely.

(g)        processed in a manner that enables us to demonstrate compliance.

 

5. Categories of Personal Data We Process

Depending upon your relationship with us, we may process:

Identity Information: includes name, previous names, title, date of birth, nationality, photographs/images, employee/NI number, customer number;

Contact Information: includes home address, business address, telephone numbers, email addresses, emergency contact details;

Financial Information: includes bank account details, payment information, salary information, tax information, pension information, purchase history;

Employment Information: includes employment history, qualifications, training records, performance information, attendance records, disciplinary records, right to work documentation;

Supplier Information: includes business contact details, banking details, company information, contract information;

Customer Information: includes account information, orders, purchases, complaints, communications;

Technical information: includesIP address, device identifiers, browser information, cookies, website usage, login information;

Marketing Information: includes communication preferences, marketing consents, event attendance, survey responses;

Special Category Data: where necessary and lawful, we may process health information, disability information, occupational health reports, equality monitoring information, biometric information, trade union membership;

Criminal Conviction Data: where authorised by law, we may process criminal conviction data in accordance with Schedule 1 Data Protection Act 2018.

6. How We Collect Personal Data

We collect personal data directly from you, during the course of your employment or engagement, and through contracts and recruitment. We also collect personal data from suppliers, publicly available sources, professional advisers, referees, recruitment agencies, credit reference/DBS agencies where lawful, government bodies, correspondence, meetings and telephone conversations.

We also collect personal data through use of our websites, including the use of cookies on those websites.

7. Purposes of Processing

We process personal data for purposes including contract management, delivering products and services, creating content, managing customer/supplier accounts and relationships, contract administration, payment processing; marketing, promotion, and sales access control, cybersecurity, fraud prevention, legal and regulatory compliance.

In respect of employees and workers we process personal data for purposes includes recruitment, payroll, pension administration, performance management, training, workforce planning, health and safety, DEI monitoring, employee wellbeing.

In respect of journalistic endeavours, and personal data processed with the intention of publication, we may rely on the journalistic exemptions in Schedule 2, Part 5 of the Data Protection Act 2018. These exemptions mean that some of a data subjects’ rights may be disapplied, including the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), notification obligations (Article 19), data portability (Article 20), and objection (Article 21).

8. Lawful Bases for Processing

In processing personal data we rely upon one or more of the following lawful bases according to the circumstances: Contractual performance, legal obligation, consent, or legitimate interest (this includes but is not limited to processing for administration, fraud prevention, security, relationship management, internal reporting).

9. Special Category Data

Where Special Category Data is processed we rely upon an Article 9 UK GDPR condition including, where appropriate, employment obligations, social security law, occupational health, legal claims, explicit consent, substantial public interest.

10. Criminal Conviction Data

Where we process criminal conviction data we do so only where authorised by law and where an appropriate policy document exists where required.

11. With Whom do we Share Personal Data?

Among those with whom we may share personal data employees (including employees of other Group companies) who require access, Group companies, professional advisers, IT providers, cloud service providers, payroll, pension and HR service providers; insurers, regulators, government authorities, recruitment agencies, occupational health providers, training providers.

All third parties are required to process personal data lawfully and securely.

12. International Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place including a UK International Data Transfer Agreement (IDTA), or UK Addendum to EU Standard Contractual Clauses.

13. Data Security

We implement appropriate technical and organisational measures including without limitation, encryption, access control, multi-factor authentication, firewalls, secure backups, appropriate training.

14. Data Retention

We retain personal data only for as long as necessary, and retention periods are determined by considering our legal obligations/regulatory requirements, legal limitation periods, contractual obligations, and prudent business management requirements.

Accounting data (which may include personal data) is retained for seven years or such other period as required by law. Other personal data, including emails, is generally retained for six years, although some data may be retained longer in specific circumstances.

15. Your Rights

Subject to legal limitations (including the journalistic exemptions Schedule 2, Part 5 of the Data Protection Act 2018), you have a right: to be informed, of access, to rectification, to erasure (the right to be forgotten), to restrict processing, to data portability, to object to processing.

Requests may be submitted to [email protected], and we will normally respond within one month.

16. Subject Access Requests

You may request a copy of your personal data. We may request proof of identity before responding.

Requests are generally free of charge unless they are manifestly unfounded or excessive.

17. Automated Decision-Making

We do not use automated processing to take decisions which give rise to legal or similarly significant effects.

18. Cookies

Our website may use cookies and similar technologies.

19. Data Breaches

We maintain procedures for identifying, investigating and responding to personal data breaches.

Where required, we will notify the Information Commissioner’s Office and/or affected individuals, within the timescales required by law.

20. Complaints

If you have concerns about our processing of your personal data, please contact us at [email protected]

You also have the right to complain to: to the Information Commissioner’s Office, whose website is www.ico.org.uk

21. Changes to this Policy

We may update this Privacy Policy from time to time, and the latest version will always be available from us. The effective date will appear at the beginning of the Policy.

22. Summary of Processing Activities

Data Subject	Typical Personal Data	Purpose	Lawful Basis
Customers	Contact, payment, transaction data	Supply goods/services	Contract; Legitimate Interests
Prospective customers	Contact details	Sales and marketing	Legitimate Interests; Consent
Employees	HR, payroll, performance, health	Employment	Contract; Legal Obligation; Employment conditions under Article 9
Applicants	CVs, references	Recruitment	Legitimate Interests; Contract
Contractors/Consultants	Contact, financial, contractual	Contract management	Contract
Suppliers	Business contacts, banking	Procurement	Contract
Website users	Technical data, cookies	Website administration	Legitimate Interests; Consent (where required)
Visitors	Visitor logs, CCTV	Security	Legitimate Interests
Shareholders	Identity, contact, shareholdings	Corporate governance	Legal Obligation
Story contributors, journalistic subjects	Identity, location	Publication	Contractual performance, legitimate interests

 

23. Complaints

If you have concerns about how we have collected or used your personal data, you have the right to make a complaint to us directly, in line with the complaints process required by the Data (Use and Access) Act 2025.

You can contact us with any complaint by emailing [email protected], giving us as much detail as possible about your concern.

Once we receive your complaint, we will acknowledge it within 30 days. We will then look into the matter, keep you updated on our progress where appropriate, and respond to you without undue delay once we have finished investigating, telling you the outcome and any action we are taking as a result.

You also have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection matters, at www.ico.org.uk or by calling 0303 123 1113. We would, however, welcome the opportunity to look into and address your concerns before you approach the ICO, so please contact us in the first instance.