Introduction

1. This Privacy Statement lets you know what we do with information we collect about you. The statement is addressed to individuals who are users of our services i.e. our customers, visitors, members, prospective clients, website users and third parties. We refer to all these individuals as “customers” or “you” in this Statement.

2. We are Antrim Estates Company, based at:

2 Castle Demesne, Glenarm, Ballymena, Co. Antrim, Northern Ireland, BT44 0BQ.

3. Our core functions are, renting and operating real estate properties, farming, hospitality, tourism, as a wedding venue, and hosting entertainment and cultural events.

Your personal data – what we collect and what we do with it

4. To fulfil our functions, we will ask for information about you. We may ask for yourname, address, contact telephone number, and/or a contact email address. This is known as your “Personal Data”.

5. We do notcollect information about you from other persons but if we did this, it would also form part of your “Personal Data”.

6. We use your Personal Data in the following ways:

• To enable us to communicate effectively with you.

• We cannot provide you with our services unless we can use the personal data that we collect from you to enable us to communicate with you during or prior to your visit(s) or after your visit(s) to Glenarm Castle or as part of your specific interaction with Antrim Estates Company as a customer for any of our services or as a provider of services to us.

7. We will use your personal data in several ways to administer our service to you.

8. Therefore, to administer our services, we are allowed to use your Personal Data in the following ways because it is in our interests to deliver and improve our services.

• To manage our IT environment and business operation and ensure security of your data and our IT operations. We can use your Personal Data in this way because it is a necessary requirement for us to provide our services to you, and we also have a legal duty to ensure the security of your data.

• To monitor and assess compliance with Antrim Estates Company policies and procedures and to comply with our legal, regulatory and good governance obligations. We can use your Personal Data in this way because we have a legitimate interest to do so and it will assist us to provide the best service to you.

o For training purposes, we can use your Personal Data in this way because we have a legitimate interest to do so and it will assist us to provide the best service to you.

Sharing Personal Data

9. On specific occasions we are required to provide your personal data to Emergency Services such as the ambulance or the police to fulfil our Health & Safety responsibilities to you as a visitor to our site or as a provider to you of specific entertainment or cultural events at Glenarm Castle.

10. We may also supply HMRC with the personal data of our employees to fulfil their and our taxation and national insurance responsibilities.

11. To a third party in the event of any reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).

12. As we believe to be necessary or appropriate – to comply with legal process, to respond to requests from public and government authorities including public and government authorities outside your country of residence, to enforce our terms and conditions, to protect our operations, to protect our rights, privacy, safety or property, and/or that of you or others; to detect and prevent crime, including fraud.

13. We will share your personal data with persons acting on your behalf but onlywhere we have your consent to do so.

Conducting marketing activities

14. If you have provided us with your email address at some point over the past 36 months we might use this email address to provide you with specific offers directly or via social media sites that allow re-targeting services.

15. When you participate in our promotional activities (e.g. competitions during events at Glenarm Castle or on our social media channels), your contact information will be collected to administer these promotions. If at the time you provide your email address and opt-in to our marketing activities, we will use your contact information to send you regular news and offers related to our products and services. You will only be added to our marketing database with your prior marketing opt-in permission located on the form your contact details were collected. You can unsubscribe/opt-out from marketing communication at any time by clicking the relevant link in the email message or contacting the marketing department at [email protected].

16. If you choose to participate in our social media activities (e.g. competitions, shared offers or other promotions), we may use the publicly available information you voluntarily share with us during the activity (e.g. your photos). This information might only be used in connection with that specific activity and we do generally try asking you if you agree for us to use it beforehand.

17. If you have not objected to us using your details in this way, we may contact your business contact email, telephone or address to provide you with information related to our services and products, which we think will be of interest and value to you (e.g. forthcoming events, special promotions or offers).

The Security & Retention of your Personal Data

18. Where we hold your personal data, we undertake to take all reasonable steps to keep it secure, in both hard copy and digital/electronic formats.

19. We take security responsibilities seriously, employing the most appropriate physical and technical measures, including staff training and awareness and we review these measures regularly.

20. We will keep your personal data for as long as it is necessary to enable you to use our services, or for us to provide our services to you, unless a longer retention period is required. This is to comply with applicable laws, resolve disputes with any parties and otherwise as necessary to allow us to conduct our business, including to detect and prevent fraud or other illegal activities. All personal data we retain will be subject to this Privacy Statement. If you have a question about a specific retention period for certain types of the personal data we hold or process about you, please contact us via the contact details provided below.

Data Processing overseas

21. Antrim Estates Company does notengage in data processing outside the UK.

Contacting us about this Statement

22. We are not required by current data protection legislation to have a specific Data Protection Officer (DPO). However, as we have already stated above, we take our data protection responsibilities seriously and have a designated data protection lead within our company. A specific staff member has responsibility as our data protection lead and can be contacted by ringing the main office on +44 (0)28 2884 1203or emailing us at [email protected]. Our data protection lead is responsible for addressing any queries or questions you may have about this privacy statement or dealing with your requests to exercise your rights which are described below.

We recognise and respect your data protection rights as a data subject. To facilitate your rights, you can contact us at the telephone number and/or the email address above and/or in writing by letter addressed to the Senior Office Administrator at our Estates Office at 2 Castle Lane, Glenarm, Ballymena, Co. Antrim, Northern Ireland, BT44 0BQfor one or more of the following reasons:

• To ask us to amend or update any information about you that is wrong or incomplete, this is known as “your right to rectification”.

• To ask us to delete information about you, this is known as “your right to erasure”.

• To tell us you no longer agree to us using information about you and asking us to stop, this is known as “your right to object”.

• To tell us to stop using information about you to inform you of our services, this is known as “your right to restrict processing”.

• To make a “data subject access request”, which is a request by you for usto send you the personal data that we have about you.

• To ask us to provide you or someone else (on your request) in a structured, commonly used and machine-readable format with the information that you have provided to us about yourself. This is known as “your right of “data portability”.

• To ask us not to use information about you in a way that allows computers to make decisions about you based solely on automated processing. This is known as “your right to restrict automated decision making”.

23. Sometimes we will notstop using your information when you ask us to, for the reasons described in this Statement, but we will tell you about this if you make a request.

24. In other cases, if we stop using your information we will not be able to provide the services that you are asking us to give you. We will tell you about this if you make a request.

Complaints

25. You have the right to complain to the Information Commissioner’s Office (ICO) about how we treat your Personal Data and Sensitive Personal Data. The ICO can be contacted at: https://ico.org.uk/global/contact-us/

26. We are only allowed to keep your information if we need it for one of the reasons we describe above.

27. We will keep it for up to 7 years to satisfy HMRC requirements or for as long as required where there may be additional Health & Safety requirements or where we are obliged to comply with the specific requirements of national or international law.

Profiling

28. We will not use your personal data to engage in any form of profiling with the use of a computer system.

Changes to this Privacy Statement

29. We may require to update this Privacy Statement from time to time. We will notify you of the changes on our web site where we are required by law to do so.

30. This is our first Privacy Statement under the new Data Protection Act 2018. It is version 01/2018, which was produced in May 2018. In the future we will always provide the current Privacy Statement on our website. Previous versions of the statement will be available on request using the following contact details: Tel. +44 (0)28 2884 1203 or emailing us at [email protected].