Zen Meetings & Events is a trading division of Reed & Mackay Travel Ltd.
1. YOUR PERSONAL DATA
The Data Subject, Controller and Processor for Personal Data
For the purposes of the General Data Protection Regulation (GDPR), Zen Meetings & Events will process your personal data on behalf of your employer. Where travel or associated services are delivered to you as part of an arrangement between your employer and Zen Meetings & Events then, then due our status as an agent, the relevant service provider will be responsible for the security of personal data it received and for compliance with applicable law. Zen Meetings & Events is not responsible for the acts or omissions of such service providers.
The Data Subject’s employer is the Data Controller for these purposes. The Data Controller is the Client Company of Zen Meetings & Events, and Zen Meetings & Events in turn acts as the Processor of the Data Subject’s Personal Data. Pursuant to a written contract with the Data Controller, Zen Meetings & Events as Processor, will use the Personal Data of the Data Subject, provided by the Client Company, to facilitate travel arrangements for the Data Subject. It is this contract of service which forms the ‘Legal Basis’ for the processing of Personal Data carried out by Zen Meetings & Events. (Further information on ‘Legal Basis’ is set out in the appendix to this document.)
There are circumstances where Zen Meetings & Events may also become a Data Controller. If Zen Meetings & Events collects additional Personal Data directly from a Data Subject, Zen Meetings & Events will be acting under a ‘Legitimate Interest’ to legally process the data to facilitate travel arrangements for the Data Subject and to fulfil the contractual requirements for its Client Company. In circumstances where Zen Meetings & Events collects Personal Data from the Data Subject, Zen Meetings & Events will obtain that Data Subject’s express consent. Zen Meetings & Events also acts as a Data Controller for any Personal Data held regarding its own employees, and legally processes this data under its Contract of Employment with those Data Subjects.
2. PERSONAL DATA WE COLLECT ABOUT YOU
The Personal Data we collect about you will only be the data specifically required to fulfil travel, accommodation, or other travel-related arrangements. Such data may be collected directly from you or provided to Zen Meetings & Events via your employer. Such data will only be processed for that purpose. Certain kinds of Personal Data collected, such as data about your racial or ethnic origin, physical or mental health, or religious beliefs requires additional protection. By providing any sensitive data of this kind you agree that we may collect it and use it to provide our services.
3. HOW WE USE YOUR PERSONAL DAT
Zen Meetings & Events has adopted the following principles to govern its processing and use of your Personal Data. Zen Meetings & Events is committed to ensuring that the Personal Data collected:
- Shall be processed lawfully, fairly, and in a transparent manner;
- Is retained for as long as it is required to fulfil our contractual requirements, or to provide statistics to our Client Company;
- Is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is collected and/or processed;
- Is accurate and, where necessary, kept up to date; and
- Will not be used by Zen Meetings & Events for any monitoring or profiling activity or process, and will not adopt any automated decision making processes.
4. HOW WE PROTECT YOUR PERSONAL DATA
Zen Meetings & Events protects your Personal Data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and password protection to protect your data. We also use operational measures to protect the data, for example by restricting access to only those in personnel who need to access your data.
Mindful of technological development, we keep these security measures under review and Zen Meetings & Events may therefore need to implement adequate alternative technical and organisational measures.
5. YOUR RIGHTS
As a Data Subject you have the rights set out in chapter 3 GDPR. Zen Meetings & Events will always fully respect your rights regarding the processing of your Personal Data, and has provided below at section 10 the details of the person to contact if you have any concerns or questions regarding how we process your data, or if you wish to exercise any rights you have under the GDPR.
In summary, you are entitled to know who has your Personal Data, what they are using it for, to see copies of all Personal Data held by Zen Meetings & Events and to amend, correct or delete such data. You may also limit, restrict or object to the processing of your data. In each case, the request must be in writing to Zen Meetings & Events using the details set out at section 10 below.
For example, most travel bookings must be made under the traveller’s full name and must include contact details and appropriate identification (e.g. passport details). Zen Meetings & Events cannot make bookings for you without this information.
6. SHARING YOUR DATA
Transfers to Third Parties
To fulfil your travel arrangements it will in most cases be necessary for Zen Meetings & Events to process Personal Data via a third party (these include but are not limited to airlines, hotels, car hire companies, and Visa or Passport companies). Personal Data shall only be transferred to, or processed by, third party companies where such companies are necessary for the fulfilment of the travel arrangements.
Sending data outside of the European Union
Zen Meetings & Events will not transfer Personal Data to a country or territory outside the European Economic Area (EEA) unless the transfer is made to a country or territory recognised by the EU as having an adequate level of Data Security, or is made with your consent, or is made to satisfy the legitimate interest of Zen Meetings & Events in regard to its contractual arrangements with its clients.
All internal group transfers of Personal Data shall be subject to written agreements under Zen Meetings & Events Intra Group Data Transfer Agreement (IGDTA) for internal Data transfers which are based on Standard Contractual Clauses recognised by the European Data Protection Authority.
A Cookie is a small text file that can be stored by your browser on the device you use to access internet and allows the browser to pass small amounts of information to help you efficiently browse our website and how you interact with our webpages to improve your experience.
We will never share any personal information about you with any third parties and the cookies used maintain your anonymity.
You have the right to make a complaint directly to our supervisory authority, the Information Commissioner’s Office at the following address:
England SK9 5AF
10. CONTACT US
To exercise any of your rights, you can send an email to us at firstname.lastname@example.org or you can write to us:
Zen Meetings & Events
4 Waterside Drive
Appendix – Definitions of certain terms referred to above:
(Article 4 of the GDPR): means any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
(Article 4 of the GDPR): means any operation or set of operations which is performed upon Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure or destruction.
(Article 4 of the GDPR): this means the person or company that determines the purposes and the means of processing Personal Data.
(Article 4 of the GDPR): means a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the controller.
Legal Basis for Processing:
(Article 6 of the GDPR): At least one of these must apply whenever Personal Data is processed:
Consent: the individual has given clear consent for the processing of their Personal Data for a specific purpose.
Contract: the processing is necessary for compliance with a contract.
Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
Vital interests: the processing is necessary to protect someone’s life.
Public task: the processing is necessary to perform a task in the public interest, and the task or function has a clear basis in law.
Legitimate interests: the processing is necessary for the legitimate interests of the Data Controller unless there is a good reason to protect the individual’s Personal Data which overrides those legitimate interests.
Data Privacy and Security
We understand that your data is sacred – that’s why we only collect the information necessary for your travel requirements. We know exactly what data we need, where it is and why it’s stored, and as an ISO27001 certified company, we constantly review our security practices and controls for your peace of mind.
We want you to know that you can trust us to respect your privacy and keep your personal information safe. Legislation implemented on 25th May 2018, called the General Data Protection Regulation (GDPR), gives you more control over your data. We see it as a great opportunity to show you exactly what we do with the information you give us permission to have, so we can provide you with the best possible travel service.
What kind of personal data do we collect?
The business travel industry is dependent on large volumes of data to facilitate travel arrangements, itinerary requests and related services. For example, to make a booking, we might need information such as your name, relevant addresses, contact information, passport details, banking details, dietary requirements and any other information that will help us meet your travel requests. In other circumstances, we may keep your data on record to respond to you regarding an enquiry or a promotional event/competition. In some cases, we also might need to pass your travel information onto a third party if you’ve specifically requested a travel ancillary that we ourselves, do not handle in-house; travel insurance or visa applications, for example.
Being an ISO27001 certified organisation means that we have carefully selected all of our partners and subsequently have ensured they meet our heightened security standards. It also means that we ourselves have a robust and secure data management system in place. Any data we collect is securely stored only for as long as legitimately necessary.
We are committed to providing independent assurance of our data privacy system and security controls through regular third-party assessments and audits. We take data security very seriously, providing continuous training for our staff around the handling of personal information, scrutinising our supply chain and industry partners on their data-practices and creating a dedicated in-house ISO Committee to focus on ensuring we meet industry standards and best practice.
ISO27001 is a globally-recognised standard of risk management that provides a framework for a robust Information Security Management System (ISMS). What this means for our clients is that they have complete assurance that their data and information meets international standards and is handled and stored with minimal risk.