Privacy Notice

Last updated: 30^th August 2023

Your privacy is incredibly important to us at Tortoise Media. Whilst we can’t promise that this policy will be a scintillating read, we’ve tried to make it as short and simple as we can, so that you know you can trust us to look after any personal data you choose to share with us. We’ve tried to strike the balance between collecting, using and storing the data we need to help you to get the best out of Tortoise Media’s journalism on- and offline, without compromising your privacy in any way.

This privacy policy, along with our Cookies Policy, sets out how Tortoise Media Limited (“Tortoise Media”, “we”, “our” or “us”), use the personal data that we collect and process about you (the “user” or “member”).

It applies to our members, subscribers, anyone who signs up to receive marketing communications from us, anyone who visits www.tortoisemedia.com (the “Site”) and indeed anyone who interacts with any other services that we provide, including via the Tortoise app.

Here’s the official bit:

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018 (the “Data Protection Laws“), the “controller” of personal data collected through the “Site” or through events we host is Tortoise Media Limited, company number 11100473, registered office: The Harley Building, 77–79 New Cavendish Street, London, W1W 6XB.

Please read the following carefully if you’d like to understand how we will use your personal data. If you want to, please check back regularly – we will update our policy if we need to reflect any changes to our operations and services.

If you have any questions about all this privacy stuff, write to us at gdpr@tortoisemedia.com.

Contents

What is personal data
Personal data we may collect about you
Data we collect from third parties
Our legal basis for collecting your personal data
Social media
Sharing your personal data
Retaining and storing your data
International transfers
Security of your personal data
Your rights
How to complain
Individuals under 16
External links
Changes to this policy
How to contact us

1. What is personal data

‘Personal data’ is any information from which you can be identified, either directly or indirectly. For example, your name, email address or an online identifier.

‘Special category personal data’ is more sensitive personal data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation.

2. Personal data we may collect about you

When you become a member

When you join, we need a bit of personal data about you to set up your membership and provide you with our products and services. For example, we may collect your:

Name
Email address
Postal address (including postcode)
Telephone number
Age range
Payment details

We will use the personal data we collect about you for the following purposes:

create and maintain your account with us;
perform obligations arising from your membership and any contracts entered into between you and us;
send you basic info about your membership account, such as when you need to renew, password resets or order confirmations;
notify you about any changes to our services or any updates to our policies;
send you stories and/or event reminders via push notifications, newsletters and so on;
deliver Tortoise products to you;
process payments;
detect and reduce fraud, including fraudulent orders; and
comply with any legal obligations to which we are subject, and to protect and defend Our rights and interests.

When you become a subscriber via our Site

If you register on the Site, for example for our Sensemaker newsletters, we will collect your email address and we will use this information to contact you about Tortoise’s products and services, and any content available to registered users.

When you use our app

When you use our app, we need some personal data about you to sign you in to your account or get you started on the app.

When creating an account to become either a member of subscriber we will collect the following personal data about you:

Name
Email address
Age range
Listening topics you’re interested in

When you sign up to receive our marketing communications

If you sign up to receive marketing communications from us, we will collect your name and email address.

We will use this information to contact you about Tortoise products, services and events that we think you might like.

You can opt-out of receiving marketing communications at any time by contacting member services at memberhelp@tortoisemedia.com; or clicking the unsubscribe link at the bottom of our emails.

Please note that if you unsubscribe from marketing communications, we will still send you important service notifications (things that affect your ability to use the website, for example, if you are a member) or where we have some other legal basis for contacting you.

When you contact us

If you call, email or write to us about anything, we will collect any information that you choose to share and use it to review, investigate and respond to whatever it is you contacted us about.

When you complete a Tortoise Media survey
We will occasionally reach out to members and subscribers to ask you to complete
surveys. The personal data we collect within this may include the following:
● Age range
● Gender identity
● Employment status
● Household income
● Details around your employment and organisation
● Any other information you provide within our surveys.

3. Data we collect from third parties

We work closely with third party service providers including, Design my Night, our corporate partners, and analytics providers. We may receive data about you from such third-party service providers.

For example, if you sign up (via www.designmynight.co.uk) to attend a live event we will receive your name and email address in order to contact you about the event.

If you would like more information about personal data we may receive from third parties, please contact us using the details below.

4. Our legal basis for collecting your personal data

Consent

If you have given us your personal data in order for us to send you marketing communications via email, then our legal basis for using your personal data is your consent. For example, as part of the sign-up process for our marketing communications or completing a survey.

Please note that where we collect special category data, such as when collecting
gender identity, we rely upon the lawful basis of explicit consent.

Performance of a contract

Entering into and performing a contract with you. Such as, when you become a member. When you become a member of our newsroom we will need to process your personal data to provide you with our service; for example, we will need to use your address to send you the Tortoise Quarterly book, and we will need to use your email to send you the Sensemaker newsletters.

Please note that where we collect special category data, such as when collecting gender identity, we rely upon the lawful basis of explicit consent.

Legitimate Interest

Our legitimate business interests, as set out below.

If you contact us or simply browse the Site, our legal basis for processing your personal data is that we have a legitimate interest in administering, monitoring and improving our Site and responding to your queries. This information helps us to run and improve Tortoise products and services, analyse member engagement with our content and make sure our products (including websites and apps) are compatible with browsers and operating systems.

Tortoise media publishes content on social media platforms e.g. Twitter, Facebook, LinkedIn through both “organic” and “paid” methods, to help us reach current and potential members.

“Organic” is what we call it when we publish content and/or offers onto a social media platform so that they may appear ‘naturally’ in your feed on that platform, without being promoted or artificially ‘forced’ to appear more prominently.
“Paid” is what we call it when we pay the social media platform owners to make sure that our content and/or offers appear prominently in your feed, or to make sure our content appears in the feeds on people who do not currently follow us on that platform. These types of placements are always marked as ‘promoted’ or ‘advertising’, so you know which is which.

We may place one or more social media platform “tags” on our Site so we can figure out which Tortoise Media content will be most useful, relevant and valuable to you based on what else you have looked at on our Site. These tags only record information that identifies whether or not you are already registered or already a member, so that we can use your reading preferences to show you relevant content and/or offers e.g. we will remove subscription offers from your feed if you are a current subscriber.

We do not have direct access to your personal data on your social media platforms.

Under some circumstances, and only when we need to do so, we may share your personal data with selected third parties including:

third party service providers that help us operate our business, our Site and app, or administer activities on our behalf. One such third party provider is Piano, the technology company we work with to build and serve your member experience.
payment processors that collect payments on our behalf;
marketing platforms that help us send you messages or push notifications, and give us feedback on message opens, clicks and how we can improve the formatting of our emails;
analytic providers to carry out statistical analysis and surveys about our journalism;
courier and postal service providers, so you can receive (for example) Tortoise Quarterly and your Welcome Pack.

Occasionally we may also disclose your personal data to third parties for the following reasons:

in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
if we transfer ownership or management of our Site, services, business and/or assets (in whole or in part) to a third party, in which case we may also transfer your personal data to such third party, provided such third party agrees to observe and adhere to the terms set out in this privacy policy (as amended from time to time); and
if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms and other agreements; or to protect our rights, property, or safety, or those of our customers or others. This includes exchanging data with other companies and organisations for the purposes of fraud protection.

7. Retaining and storing your data

How long we keep your personal data for depends on why we collected it, as well as the requirements of any applicable law or regulation.

For example, if you join as a member, we will store your personal data and details about your membership for as long as necessary to fulfil with any contract we have with you and to comply with applicable laws and tax legislation.

Whereas, if we haven’t heard from you – that is, you’ve not opened an email, looked at a story, been to an event or interacted with Tortoise Media in any other way – we will generally no longer hold your data after 5 years, unless there is a legal or regulatory reason why we have to.

If you ask us not to contact you anymore, we will make sure we remove you from any future communications but will keep a minimum amount of data about you in our records. This way, if you go on to use our products and services at a later date, we will be able to tell that you’d previously asked us not to include you in marketing communications.

At the end of the retention period, your personal data will be securely deleted or anonymised.

8. International transfers

The personal data that we collect from you may be transferred to third parties located in countries outside of the United Kingdom or European Economic Area (“EEA”) including the United States.

We have taken appropriate steps to ensure that where personal data is processed outside the UK, it has an essentially equivalent level of protection as within the UK. We do this by ensuring that:

Your personal data is only processed in a country which that Secretary of State has confirmed benefits from an adequate level of protection (an adequacy regulation); or
We enter into International Data Transfer Agreements (IDTAs), or equivalent with the receiving parties and ensure that supplementary measures are also applied, where necessary.

9. Security of your personal data

We have implemented appropriate technical and organisational measures to safeguard your personal data and protect it from accidental or unlawful destruction, loss or alteration and from unauthorised disclosure or access.

In addition to the technical and organisational measures we have put in place, there are a number of simple things you can do to in order to further protect your personal information, such as;

Never enter your details after clicking on a link in an email or text message.
Never download software or let anyone log on to your computer or devices remotely, during or after a cold call.

10. Your rights

You have certain rights in relation to the processing of personal data we collect about you, including to:

Request access to your personal data (commonly known as a “Subject Access Request”). This enables you to receive a copy of the personal data we hold about you.
Request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. If you object to us using your personal data for marketing purposes we will stop sending you marketing material.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal data to another party (data portability).
Automated decision-making. You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.

Right to withdraw consent

In the circumstances where you may have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we are permitted by law to do so.

How to exercise your rights

You will not usually need to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access if clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. If you wish to exercise your rights, please contact us at gdpr@tortoisemedia.com.

11. How to complain

You also have the right to complain about the use of your data to the Supervisory Authority, which in the UK is the Information Commissioner’s Office (ICO). The ICO can be contacted online at:

Or by telephone on 0303 123 1113

12. Individuals under 16

Tortoise Media does not intentionally, or knowingly, collect or otherwise process personal information relating to people under the age of 16. We will make every effort to delete any such personal information where a parent or guardian has let us know that we’ve collected such details.

13. External links

This privacy policy only applies to Tortoise Media’s use of your personal information. Our Site, services or products may, from time to time, contain links to third party sites, services or mobile software applications that are not owned or controlled by us (each a “Third Party Service”).

Tortoise Media is not responsible for the privacy policy or the content of any Third-Party Service and we strongly recommend that you read the privacy policy on each Third Party Service that you choose to use or interact with.

14. Changes to this policy

From time to time, we may make changes to our privacy policy to take account of changes in the law or changes in our services and practices.

If we make changes, we will let you know by revising the date at the top of this policy. If the changes are significant, we may give you with additional notice, such as adding a statement to the homepage of the Site or sending you an email with the updated version.

Any personal information held will be governed by our most current privacy policy.

15. Contact us

If you have any questions about this policy or about your personal information, or if you wish to exercise any of your rights outlined above, please write to us at the following address:

Tortoise Media
77-79 New Cavendish Street
London
W1W 6XB

Alternatively, you can email us at gdpr@tortoisemedia.com. To help us respond to you quickly, please include a brief description of what you’re emailing us about in the subject line of the email.