Who We Are
Communicorp UK Limited is a media and advertising group operating radio, podcast, digital, advertising, commercial, creative and research services.
This Privacy Policy applies across Communicorp UK brands, platforms, websites, services, competitions, surveys, research activity, tender activity, supplier interactions and other external business activities.
For most interactions, Communicorp UK Limited acts as the primary data controller. Depending on how you engage with us, a specific group company may act as the data controller, or group companies may act jointly within the Communicorp UK group.
The Communicorp UK group entities covered by this policy include Communicorp UK Limited, Voiceworks (Sport) Limited (Sport Social Podcast Network), Mindfield Advertising and Marketing Limited, GOMO Outdoors Limited, Galaxy Radio Scotland Ltd, Real Radio North Limited, Cardiff Broadcasting Company Ltd, Real Radio XS Limited, Smooth Radio Limited, Smooth Radio Midlands Ltd, Smooth Radio NE Ltd, The St Albans and Watford Broadcasting Company Ltd, Radio Hertford (Commercial) Limited,Real Radio (Yorkshire) Limited, and any other Communicorp UK group company that operates our services, brands or platforms.
We are committed to handling personal data lawfully, fairly and transparently, and to minimising the personal data we collect, use and retain.
Scope of this Policy
This policy applies to individuals who interact with us, including:
- website users and online visitors
- advertisers, clients, prospects and business contacts
- agencies, media buyers, sponsors and commercial partners
- podcasters, contributors, content partners, guests and interviewees
- competition entrants, prize winners and promotion participants
- research participants, survey respondents and audience insight participants
- suppliers, contractors, consultants and tender participants
- individuals who contact us or submit forms
- social media users interacting with our brands
- event attendees, callers, listeners and people who participate in recorded content or audience engagement
- job applicants, where relevant to external recruitment activity.
Employees, freelancers, workers and job applicants should also read our separate workforce privacy notice, which provides more detailed information about HR, recruitment, payroll, engagement and employment-related processing.
What Personal Data We Collect
The personal data we collect depends on how you interact with us. We may collect and use the following categories of personal data:
- Identity and contact data - name, email address, phone number, postal address, company, job title, business role and contact preferences.
- Business and commercial data - client, supplier, tender, proposal, contract, order, campaign, invoice, payment, procurement and relationship information.
- Technical and usage data - IP address, browser type, device information, cookie identifiers, website usage, form interactions and analytics data.
- Marketing and communications data - marketing preferences, opt-ins, opt-outs, email engagement, campaign engagement, event interactions and communications with us.
- Competition and promotion data - entry information, age/eligibility confirmation, winner details, prize fulfilment information, correspondence and sponsor opt-in preferences.
- Research and survey data - survey responses, opinions, preferences, demographic information, research notes, interview records, recordings, transcripts, incentives and contact details where research is identifiable.
- Audio, image, video and content data - voice, image, video, interview contributions, podcast/audio content, listener calls, social media content, user-generated content and related metadata.
- Meeting, call and recording data - call recordings, meeting recordings, transcripts, AI-generated summaries, notes, action points and follow-up records.
- Recruitment data - application information, CVs, interview notes, interview call and recording data and candidate communications, with more detailed information provided in our workforce privacy notice.
- Supplier and tender data - business contact details, due diligence information, proposal records, procurement correspondence and compliance information.
- Special category data - we do not actively seek to collect special category data unless you choose to provide it, it is required for a specific purpose, or it arises in limited contexts such as research, recruitment, access needs, contributor arrangements or legal/compliance matters. Special category data includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation.
Where We Get Your Data From
We may collect personal data from:
- you directly, for example through forms, enquiries, competitions, surveys, interviews, meetings, calls or business interactions
- your employer, agency, representative, client, supplier or business partner
- publicly available sources such as company websites, Companies House, LinkedIn, professional directories and public social media profiles
- third-party data providers, lead sources, event partners or licensed B2B data providers, where permitted
- competition sponsors, prize providers, research partners, agencies, platform providers and brand licence partners
- technology, CRM, analytics, advertising, podcast, research and communication platforms used in connection with our services
- our own websites, systems, phone systems, meeting platforms, recording systems, CRM, email and business records.
How We Use Your Data
We use personal data for the purposes set out below.
- Delivering services - to manage advertising campaigns, podcast hosting, partnerships, promotions, creative services, research services, digital services and related commercial activity.
- Communicating with you - to respond to enquiries, manage relationships, arrange meetings, provide updates and deal with service or support requests.
- Marketing and business development - to contact relevant business contacts about our services, events, campaigns, tenders, opportunities and commercial updates, where permitted by law.
- Research and insights - to conduct surveys, interviews, audience research and insight projects, and to produce anonymised, aggregated or identifiable outputs where appropriate and explained.
- Competitions and promotions - to administer competitions, check eligibility, contact winners, fulfil prizes, manage sponsor involvement and maintain appropriate records.
- Tenders, procurement and supplier management - to assess, submit and manage tender opportunities, supplier relationships, procurement processes, contractual negotiations, due diligence, conflicts checks and compliance requirements.
- Improving our services - to analyse website, campaign, CRM, podcast, audience, commercial and operational data.
- Recording, notes and follow-up - to record or transcribe meetings, calls, interviews, research sessions, listener interactions or production content where appropriate, and to create notes, summaries and action points.
- Artificial intelligence support - to use approved AI tools to support summaries, notes, drafting, analysis, reporting, follow-up actions and operational processes.
- Recruitment - to manage applications and hiring processes, with more detailed information in our workforce privacy notice.
- Security and operations - to protect systems, data, devices, platforms, services, users and business operations, and to prevent unauthorised access, fraud, misuse or security incidents.
- Legal, regulatory and business administration - to comply with laws, maintain records, manage complaints, resolve disputes, enforce contracts, exercise legal rights and support audits or business transfers.
Lawful Bases for Processing Your Data
Under UK data protection law, we must have a lawful basis for using personal data. The lawful basis depends on the purpose and context. The main lawful bases we rely on are:
- Contract - where processing is necessary to enter into or perform a contract with you or the organisation you represent.
- Legitimate interests - where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms.
- Consent - where you have given clear consent, for example for certain marketing, cookies, sponsor opt-ins or research activities.
- Legal obligation - where processing is necessary to comply with a legal or regulatory obligation.
Where we rely on legitimate interests, our interests may include managing and developing our business, promoting relevant services to business contacts, maintaining accurate records, improving our services, securing our systems, preventing misuse, managing client and supplier relationships, creating meeting notes and follow-up actions, administering competitions and producing research or commercial insights. We consider whether the processing is necessary and whether your interests, rights and freedoms override our interests.
| Purpose | Lawful basis | Legitimate interest or explanation |
|---|---|---|
| Responding to enquiries and managing relationships | Legitimate interests; contract where relevant | Managing business enquiries, communications and relationships. |
| Delivering advertising, podcast, creative, digital, research and commercial services | Contract; legitimate interests | Providing services to clients, agencies, partners and contributors. |
| B2B marketing and business development | Legitimate interests; consent where required by PECR | Promoting relevant services to appropriate business contacts. |
| Marketing to sole traders, partnerships or individual subscribers where PECR requires consent | Consent or another PECR-compliant basis | Not applicable where consent is used. |
| Website analytics, pixels and advertising tracking | Consent for non-essential cookies and similar technologies; legitimate interests for limited essential operational analytics where permitted | Understanding website performance and campaign effectiveness. |
| Competitions, prize draws and promotions | Contract; legitimate interests; consent for sponsor marketing opt-ins; legal obligation where applicable | Administering competitions, verifying eligibility, fulfilling prizes and data opt-in. |
| Research, surveys and audience insight | Consent or legitimate interests depending on the activity; contract where relevant | Conducting research and producing insight outputs. |
| Call, meeting, interview and production recording | Legitimate interests; contract; consent where appropriate | Accurate records, production, training, service improvement, research and follow-up. |
| AI-generated notes, summaries, drafting, analysis and reporting | Legitimate interests; contract where relevant | Improving efficiency, accuracy, follow-up and operational processes. |
| Supplier, tender and procurement activity | Contract; legitimate interests; legal obligation | Managing suppliers, procurement, due diligence and tender opportunities. |
| Security monitoring and system protection | Legitimate interests; legal obligation | Protecting systems, services, users, confidential information and personal data. |
| Recruitment | Contract; legitimate interests; legal obligation; consent in limited cases | Assessing candidates and managing hiring processes. |
| Legal claims, complaints, disputes, audits and regulatory matters | Legal obligation; legitimate interests | Protecting legal rights and meeting legal, audit or regulatory requirements. |
Marketing and Business Development
We may contact business contacts about our services using existing relationship data, publicly available business information, licensed B2B data or information provided through enquiries, events, tenders, forms or business interactions.
We rely on legitimate interests for relevant B2B marketing where permitted by law. Our legitimate interests are promoting our services, developing business relationships and contacting people in relevant business roles.
Where the Privacy and Electronic Communications Regulations (PECR) require consent, including for certain marketing to sole traders, partnerships or individual subscribers, we will only send electronic marketing where we have the required consent or another lawful basis under PECR applies.
All marketing communications include a clear way to opt out where required. You can opt out of marketing at any time. We maintain suppression records to ensure we respect opt-outs.
We do not sell personal data. We only share personal data with sponsors or partners for their own marketing where this has been clearly explained and, where required, you have opted in.
Competitions, Promotions and Prize Draws
Our competitions and promotions are restricted to individuals aged 18 or over.
We may process your personal data to administer competitions, verify eligibility, contact winners, fulfil prizes, deal with queries or complaints, comply with competition rules and maintain appropriate audit records.
Competitions may be managed using Campaign Manager, an approved competition management system provided by Global Media, our brand licence holder, or another approved competition platform.
Where a competition sponsor or prize provider is involved, we may share winner details where necessary to fulfil the prize. We will only share entrant details with a sponsor or partner for that sponsor's own marketing where this has been clearly explained and you have opted in. Where this happens, the sponsor or partner will become an independent data controller for its own use of your data and its own privacy policy will apply.
Competition terms and conditions may provide additional information about eligibility, prize fulfilment, publicity, winner details and any sponsor or partner involvement.
Research, Surveys and Audience Insight
We may conduct research, surveys, interviews and audience insight activities. Depending on the project, we may collect identifiable information such as name, contact details, demographic information, survey responses, interview notes, recordings, transcripts, opinions, preferences and incentive/payment details.
We will explain at the point of collection whether participation is optional, what the research is for, whether responses are anonymous or identifiable, how results will be used, and whether outputs may be shared with clients or partners.
Where possible, research outputs are anonymised or aggregated before being shared. Where identifiable information needs to be used, we will only use it for the stated research purpose or another lawful and compatible purpose.
Where research may involve individuals under 18, we will assess whether additional safeguards, parental or guardian involvement, or specific consent arrangements are required.
Recording, transcription and production content
We may record, transcribe or create notes from calls, meetings, interviews, podcasts, research sessions, listener interactions, candidate interviews, commercial discussions or contributor sessions where appropriate. Recordings may take place through phone systems, Microsoft Teams, HubSpot, approved AI tools, recording equipment, production systems or other approved business tools.
Recordings may be used for note-taking, training, quality monitoring, editorial production, research, service improvement, business records, contractual evidence, safeguarding our rights and creating follow-up actions.
Where recording takes place, we will normally provide notice through system notifications, meeting invitations, verbal notice, production arrangements, contributor communications or other appropriate means. We do not conduct covert recording for ordinary business purposes.
Recordings, transcripts, AI summaries, edited audio and production notes may be stored in approved systems and accessed by authorised personnel only.
Use of AI tools
We use approved AI tools, which may include ChatGPT, our own internal GPT, Microsoft Copilot, HubSpot AI and Adobe AI features, to support business activities such as meeting summaries, call notes, follow-up actions, drafting, analysis, reporting, research, lead identification, administration and operational processes.
We do not use personal data to train public AI models.
AI outputs are subject to human review where used to support decisions, actions or records. We do not rely solely on automated decision-making that produces legal or similarly significant effects. Recruitment decisions are made by humans.
Advertising, Analytics and Profiling
We may use limited data, including location, engagement, campaign, website, podcast, CRM and advertising data, to understand audiences, improve advertising relevance, measure campaign performance, produce insights and improve our services.
We may use limited profiling or segmentation for business marketing, audience insights, advertising measurement and service improvement. We do not use this to make decisions that produce legal or similarly significant effects about individuals.
Where advertising or analytics technologies involve cookies, pixels or similar technologies, we will obtain consent where required.
International Transfers
Some of our AI, CRM, analytics, advertising, podcast, research, cloud and support providers may process personal data outside the UK, including in the United States or other countries.
Where personal data is transferred internationally, we use appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, transfer risk assessments and contractual/data protection controls as required.
You can contact us using the details below if you would like more information about the safeguards used for international transfers.
Security and Monitoring
We implement appropriate technical and organisational measures to protect personal data. These include secure systems, access controls, approved platforms, device and account controls, monitoring, staff awareness and incident reporting procedures.
Monitoring may include access logs, security alerts, system activity, device compliance and use of company systems, where relevant to security, compliance or operational purposes.
Where monitoring takes place, it is proportionate, limited to business purposes and carried out in accordance with data protection laws.
Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, including to meet legal, accounting, regulatory, contractual, audit, complaint and dispute requirements. Our detailed retention periods are maintained in our Record of Processing Activities and Retention Schedule.
Typical retention periods include:
| Type of data | Typical retention period |
|---|---|
| Marketing contacts | Until unsubscribe, objection or 24 months after last meaningful interaction, unless retained on a suppression list. |
| Suppression records | As long as necessary to respect opt-outs and avoid contacting individuals who have objected. |
| Client, supplier, commercial contract and order records | Generally for the relationship duration plus six years. |
| Prospect CRM records | Generally 24 months after last meaningful interaction unless another lawful reason applies. |
| Competition non-winner records | Generally six months after competition close or prize fulfilment. |
| Standard competition winner records | Generally 12 months after prize fulfilment. |
| High-value, sponsored, travel or contractual prize records | Up to six years where needed for contract, audit, tax, complaints or disputes. |
| Website analytics data | Generally 24 months. |
| Cookie consent records | Generally 24 months from consent or last preference update. |
| Meeting recordings | 24 months, unless a longer period is justified. |
| Commercial call recordings | 24 months, or up to six years where needed for contract, complaint, dispute or legal purposes. |
| Research respondent personal data | Normally deleted or anonymised within 12 months after project completion. |
| Anonymised research outputs | May be retained indefinitely where individuals cannot be re-identified. |
| Recruitment records | Handled in accordance with our workforce privacy notice and recruitment retention schedule. |
Where a complaint, claim, audit, investigation, legal hold or regulatory matter applies, we may retain relevant information for longer. When data is no longer needed, we securely delete, anonymise or archive it in accordance with our retention requirements.
Under 18s
Our competitions and promotions are restricted to individuals aged 18 or over.
Our radio broadcasts, podcasts, websites and social media content may be accessed by individuals under 18, but our services are not specifically directed at children and we do not knowingly collect children's personal data for marketing or commercial purposes.
If we become aware that we have collected personal data from an individual under 18 in circumstances where this is not appropriate, we will take steps to delete it or apply additional safeguards. Where any activity may involve under-18s, such as audience interaction, editorial content, research or contributor participation, we will assess whether additional safeguards, parental/guardian involvement or specific consent arrangements are required.
Third-Party Platforms and Links
Our services, websites, podcasts, social media pages, competitions, surveys or communications may include links to third-party websites, platforms or services.
When you leave our services or interact with third-party platforms, those organisations may process your data under their own privacy policies. We do not control how third parties use your data except where they process it on our behalf under our instructions.
Business Transfers
We may transfer personal data as part of a business sale, merger, acquisition, restructuring, investment, financing or transfer of assets. Where this happens, we will take appropriate steps to protect personal data and ensure it continues to be handled in accordance with data protection law.
Your Rights
Depending on the circumstances, you may have the following rights under data protection law:
- Access - to request a copy of the personal data we hold about you.
- Rectification - to ask us to correct inaccurate or incomplete personal data.
- Erasure - to ask us to delete personal data in certain circumstances.
- Restriction - to ask us to restrict how we use personal data in certain circumstances.
- Objection - to object to certain processing, including processing based on legitimate interests.
- Direct marketing objection - to object to direct marketing at any time.
- Data portability - to receive certain data in a structured, commonly used and machine-readable format.
- Withdraw consent - where we rely on consent, to withdraw that consent at any time.
Some rights are subject to conditions and exemptions under data protection law. However, you always have the right to object to direct marketing.
To exercise your rights, contact <compliance@communicorpuk.com>. We may need to verify your identity before processing your request to ensure personal data is only disclosed to the correct individual. We handle requests in accordance with UK GDPR and aim to respond to valid requests within one month, unless an extension is permitted by law.
Complaints
If you have concerns about how we use your personal data, please contact us first so we can try to resolve the issue.
Email: compliance@communicorpuk.com
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Website: www.ico.org.uk