Privacy Notice
Effective date: 07 September 2026
Last reviewed: 07 September 2026
Controller: The Loop Collective Limited trading as “In The Loop Jersey”
Company number: 166863
Registered office: 27 Elizabeth Avenue, La Route Orange, St Brelade, Jersey, JE3 8GR
Privacy contact: hello@intheloopjersey.com
Website: www.intheloopjersey.com
1. About this Privacy Notice
This Privacy Notice explains how In The Loop Jersey (“In The Loop”, “we”, “us” or “our”) collects, uses, stores and shares personal data, and the rights individuals have in relation to that information.
It is intended to cover the personal data we handle in connection with our local discovery platform, including our website, business membership services, business directory, newsletters, social media activity, local guides, events, offers, editorial content and communications with prospective and existing business members.
This Notice is principally drafted to reflect the Data Protection (Jersey) Law 2018. Other data protection laws may apply to particular processing depending on the circumstances.
2. Who this Notice applies to
This Notice may apply to you if you are:
- a director, owner, employee or representative of a business member or prospective business member;
- a person who contacts us, submits an enquiry or communicates with us;
- a subscriber to an In The Loop newsletter or other marketing communication;
- a visitor to our website or someone who interacts with our social media channels;
- a person who submits an event, offer, business update or other content to us; or
- an individual whose personal data appears in Brand Content or other material provided to us for publication.
3. Our role as data controller
For the personal data described in this Notice, In The Loop will usually act as a data controller because we decide why and how that personal data is used.
Business members may also be data controllers in their own right for personal data they provide to us. For example, if a member supplies a photograph showing an identifiable employee or provides an individual’s contact details for publication, the member is responsible for ensuring it is entitled to provide that information. In The Loop remains responsible for its own obligations when it receives and uses that personal data.
4. Personal data we may collect
Depending on how you interact with us, we may collect and use the following types of personal data:
- Identity information, such as your name, job title, role and the business or organisation you represent.
- Contact information, such as business or personal email address, telephone number, postal address and social media details.
- Membership and account information, such as the selected membership package, start date, membership status, onboarding information, preferences and records of services provided.
- Business profile information, including contact details, images, descriptions, offers, events and other Brand Content submitted for display or promotion. Some of this may identify individuals, particularly where a business is operated by a sole trader.
- Financial and transaction information, such as invoices, payment status, billing details and transaction references. Payment card information may be handled by a payment provider rather than stored directly by us.
- Communications, including emails, messages, meeting notes, feedback, complaints and records of enquiries.
- Marketing preferences, including whether you have subscribed, unsubscribed or objected to direct marketing.
- Technical and usage information, such as IP address, device/browser information, website activity and cookie or analytics data where collected.
- Social media information that you make available when you interact with our accounts or content.
- Other information you choose to provide to us.
Special category data. We do not normally need special category personal data or other unusually sensitive information for our membership and discovery services. Please do not provide this type of information unless it is genuinely necessary and has been expressly agreed with us in advance. If we do process it, we will only do so where a lawful condition applies and appropriate safeguards are in place.
5. How we collect personal data
We may obtain personal data:
- directly from you, including when you complete a membership application, sign an agreement, submit Brand Content, subscribe to communications, contact us or use our website;
- from the business or organisation you represent;
- from publicly available business sources, such as company websites, business social media pages and public directories, where appropriate;
- from service providers that support our website, communications, payments, analytics or administration; and
- automatically through cookies or similar technologies where these are used.
6. How and why we use personal data
We only process personal data where we have a lawful basis to do so. The principal purposes and lawful bases we expect to rely on are set out below.
| Purpose | How we use personal data | Typical data involved | Lawful basis |
|---|---|---|---|
| Membership and onboarding | To assess applications, enter into and administer the Business Membership Agreement, create and maintain member records, and deliver the selected membership services. | Identity, contact, membership, business profile and communications data. | Contract; legitimate interests |
| Business profiles and visibility | To create, publish, update and promote business profiles, offers, events and other agreed content across relevant In The Loop channels. | Business profile information, Brand Content, contact information and images. | Contract; legitimate interests; consent where required |
| Enquiries and relationship management | To respond to questions, arrange meetings, provide support, maintain business relationships and keep records of discussions. | Identity, contact and communications data. | Contract; steps before contract; legitimate interests |
| Billing and records | To issue invoices, process payments, maintain accounting records, recover sums due and meet tax, accounting and legal requirements. | Identity, billing, transaction and membership data. | Contract; legal obligation; legitimate interests |
| Service communications | To send operational or administrative messages about membership, account changes, onboarding, service updates or matters affecting the agreement. | Identity, contact and membership data. | Contract; legitimate interests |
| Marketing and newsletters | To send newsletters, launch information, updates and marketing communications where permitted, and to manage preferences and objections. | Identity, contact, marketing preferences and engagement data. | Consent where used; legitimate interests where lawful |
| Platform operation and improvement | To operate, secure, troubleshoot and improve our website and services, understand usage and develop new features. | Technical, usage, device and communications data. | Legitimate interests; consent where required for cookies/analytics |
| Legal and regulatory matters | To protect our rights, investigate misuse, manage complaints, respond to lawful requests and comply with legal or regulatory obligations. | Any relevant personal data. | Legal obligation; legitimate interests |
“Legitimate interests” means our legitimate business interests in operating, protecting and developing In The Loop, supporting our members, maintaining business relationships and promoting the platform, provided those interests are not overridden by an individual’s rights and freedoms.
7. Business profiles and public-facing information
A core part of In The Loop is helping businesses become discoverable. Information supplied for a business profile or promotional feature may therefore be made publicly available through the In The Loop website, directory, newsletter, social media, guides, campaigns, event or offer listings and other agreed channels.
Where a business contact detail is also personal data — for example, a sole trader’s name, mobile number or personal business email address — we will use it only where there is an appropriate lawful basis and it is suitable for the intended public-facing purpose. Members should clearly identify any information that is not intended to be published.
We may format, crop, resize or edit submitted content for presentation, but this does not change the Member’s responsibility under the Business Membership Agreement to ensure it has the necessary rights and permissions to supply Brand Content.
8. Marketing and communications
We may send relevant communications about In The Loop, including newsletters, platform updates, membership information and opportunities. Where consent is the lawful basis, you can withdraw it at any time. Where we rely on legitimate interests for direct marketing, you have the right to object at any time.
Every direct marketing email should provide a clear way to unsubscribe or object. Once you object to direct marketing, we will stop using your personal data for that purpose, although we may keep a minimal suppression record so that we can respect your preference in future.
9. Cookies and website analytics
Our website may use cookies or similar technologies for essential functionality and, where enabled, analytics or other optional purposes. Where consent is required, optional cookies will not be used unless the appropriate choice has been made.
More information should be provided in our Cookie Notice.
10. Who we may share personal data with
We may share personal data where reasonably necessary with the following categories of recipient:
- website hosting, cloud storage, IT support and website development providers;
- email, newsletter and communications providers;
- payment, invoicing, bookkeeping and accounting providers;
- analytics and cookie providers where enabled;
- social media platforms where content is published or promoted through those platforms;
- professional advisers, including legal, accounting and insurance advisers;
- regulators, courts, law enforcement, tax authorities or other public bodies where disclosure is required or permitted by law; and
- a purchaser, investor or professional adviser involved in a genuine proposed sale, restructuring or investment in our business, subject to appropriate confidentiality and data protection safeguards.
We do not sell personal data to advertisers or other third parties.
Key service providers currently used:
| Website Host | Our website is hosted using services provided by Fasthosts. Fasthosts may process certain technical information when you visit our website, such as your IP address, browser information and information collected through cookies or similar technologies. For further information about how Fasthosts processes personal data, please refer to Fasthosts’ privacy notice. |
|---|---|
| Cloud Storage | We use Dropbox to provide secure cloud storage and document management services for our business. Personal data that we collect may therefore be stored within our Dropbox account where this is necessary for the administration and operation of our business. This may include, for example, business contact details, correspondence, membership or subscription information, records relating to our business relationships and other administrative records. Access to information stored within Dropbox is restricted to authorized persons who require access for legitimate business purposes. Dropbox may process personal data on our behalf in connection with the provision of its services. Further information about how Dropbox handles personal data can be found in Dropbox’s Privacy Policy. |
| Google Workspace | We use Google Workspace to provide business email and communication services. Personal data contained within emails, including names, email addresses, correspondence and attachments, may therefore be processed through our Google Workspace account where this is necessary for the administration and operation of our business. Google may process personal data on our behalf in connection with the provision of its services. Further information about how Google handles personal data can be found in Google’s Privacy Policy and Google Workspace privacy documentation. |
11. International transfers
Some of the technology and service providers we use may store, access or process personal data outside Jersey or the European Economic Area, including in the United States.
Where personal data is transferred outside Jersey or the EEA, we will ensure that the transfer is made in accordance with the Data Protection (Jersey) Law 2018.
Where the recipient is located in a jurisdiction recognised as providing an adequate level of protection, we may rely on that adequacy decision. Where an adequacy decision does not apply, we will ensure that appropriate safeguards are in place, such as approved contractual safeguards, where required.
Our current technology providers include Dropbox, which we use for cloud storage and document management, Fasthosts, which provides our website services and Google Workspace which provides our email services. These providers may process personal data outside Jersey and the EEA in connection with the provision of their services.
12. How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting and dispute-management requirements. The period depends on the type of information and why we hold it.
| Category | Typical retention approach |
|---|---|
| Membership agreements and core account records | For the duration of the membership and afterwards for as long as needed to meet legal, accounting, tax, contractual or dispute-management requirements. Accounting records may need to be retained for longer periods under Jersey law. |
| Invoices and transaction records | For the period required by applicable company, accounting and tax record-keeping rules. |
| Prospective member enquiries | Normally for 24 months after the last meaningful contact, unless there is a reason to keep them for longer or you ask us not to. |
| Marketing records | Until you unsubscribe or object, plus a minimal suppression record where needed to ensure we respect your preference. |
| Website analytics / cookie information | For the period stated in the relevant cookie settings, Cookie Notice or provider configuration. |
| Published member content | Normally while the relevant membership, listing or campaign is active, with copies retained afterwards only where reasonably necessary for administration, records, legal claims or agreed archival purposes. |
13. Keeping personal data secure
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures may include access controls, password protection, appropriate device and account security, secure cloud services, backups, staff access restrictions and supplier due diligence.
No method of internet transmission or electronic storage can be guaranteed to be completely secure. We therefore keep our security arrangements under review and will respond to personal data breaches in accordance with applicable law.
14. Your data protection rights
Subject to the circumstances and any applicable exemptions, you may have the following rights under the Data Protection (Jersey) Law 2018:
- to be informed about how your personal data is used;
- to request access to your personal data;
- to ask us to correct inaccurate or incomplete personal data;
- to ask for erasure of personal data in certain circumstances;
- to ask us to restrict processing in certain circumstances;
- to receive certain personal data in a portable format where the right applies;
- to object to processing based on legitimate interests in certain circumstances;
- to object at any time to processing for direct marketing purposes; and
- to have protections in relation to certain solely automated decisions and profiling.
You can exercise your rights by contacting us using the details in section 19. We may need to verify your identity before acting on a request. We will normally respond without undue delay and within four weeks, although the law allows an extension in certain circumstances.
15. Consent
Where we rely on consent as the lawful basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. You can withdraw consent using the method provided at the point of collection or by contacting us.
16. Automated decision-making
We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals in connection with our standard business membership services.
If this changes, this Notice will be updated before the relevant processing begins and will explain the logic involved and the likely consequences where required by law.
17. Information about other people
If you provide personal data about another individual to us, you should make sure you are entitled to do so and, where required, that the individual has been given appropriate privacy information. This is particularly important for photographs, staff biographies, individual contact details, testimonials and event information submitted for publication.
18. Complaints
If you have concerns about how we use personal data, please contact us first so that we can try to resolve the issue.
You also have the right to raise a concern or complaint with the Jersey Office of the Information Commissioner (JOIC):
| Address | Jersey Data Protection Authority, 5 Castle Street, St Helier, Jersey, JE2 3BT |
|---|---|
| Telephone | +44 (0)1534 716530 |
| enquiries@jerseyoic.org | |
| Website | www.jerseyoic.org |
19. Contacting In The Loop about privacy
For questions about this Notice, requests to exercise data protection rights, or concerns about our use of personal data, contact:
Privacy contact: Lizzie Ferrara and Claire Main
Email: hello@intheloopjersey.com
Postal address: 27 Elizabeth Avenue, La Route Orange, St Brelade, Jersey, JE3 8GR
20. Changes to this Privacy Notice
We may update this Notice from time to time to reflect changes in our services, suppliers, technology, legal requirements or the way we process personal data. The latest version should be made available on our website. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals before the new use begins where required.
