Stowmarket Innovation Gateway
Privacy Notice
Version 1.0
Effective: 3 rd March 2026

Scope and who we are
This privacy notice explains how personal data is used in connection with enquiries,
bookings, business support and other services delivered through the Stowmarket Innovation
Gateway. It does not cover wider processing by Mid Suffolk District Council or Hethel
Innovation Ltd outside the Innovation Gateway context.

Stowmarket Innovation Gateway is operated by Hethel Innovation Ltd. For the purposes of
UK data protection law, Hethel Innovation Ltd is the data controller for personal data
processed in connection with:
 

• Business support enquiries

• Customer relationship management systems

• Room bookings, events and operational services

• Visitor management

• Marketing communications where applicable
   

Mid Suffolk District Council is a separate data controller for personal data processed in
connection with:
 

• Tenancy agreements and landlord functions

• Heads of Terms and tenancy contracts

• Lease billing and financial administration

• Economic development monitoring and statutory reporting

• Freedom of Information and Environmental Information duties
   

Each organisation is independently responsible for its own processing activities. If your
query relates to how Mid Suffolk District Council uses your data more broadly, please refer
to the Council’s own privacy information at:

https://www.midsuffolk.gov.uk/w/privacy-policy 

The personal data we collect
Depending on how you interact with the Innovation Gateway, we may collect:
 

• Name

• Business name

• Job title

• Email address

• Telephone number

• Business sector and enquiry type

• Booking and attendance information

• Payment and transaction information where services are purchased

• Records of correspondence

• Information you choose to provide in enquiry forms
   

We do not routinely process special category data. If you provide information about
accessibility or health requirements for an event, we will use it only to meet those
requirements.

How we collect your data
We collect personal data directly from you when you:
 

• Submit an enquiry through our website

• Subscribe to updates

• Book meeting rooms or events

• Attend training or business support sessions

• Contact us by email, telephone or in person

Enquiry data submitted via the Stowmarket Innovation Gateway website is processed
through systems operated and configured by Hethel Innovation Ltd.

Why we use your data and lawful bases
We process personal data under Article 6 UK GDPR as follows:

Contract – where processing is necessary to enter into or perform a contract with
you, for example to:
​

• manage room and event bookings

• provide business support services

• respond to specific service-related enquiries
  
  Legitimate interests – for our legitimate interests in the effective operation,
  promotion and development of the Innovation Gateway, for example to:
   

• manage and improve our services and facilities

• maintain CRM records of enquiries and interactions

• understand demand and engagement with our programmes
   

We only rely on legitimate interests where these are not overridden by your rights and
freedoms. We maintain a documented assessment where this lawful basis is relied upon.

- Consent – for electronic marketing communications where required under the
Privacy and Electronic Communications Regulations 2003, such as email newsletters
or event updates you choose to receive. You can withdraw your consent at any time
(see “Marketing communications” below).

- Legal obligation – where we are required to retain or disclose information for
statutory or regulatory reasons, such as financial record-keeping, fraud prevention or
responding to formal information requests relating to our activities.

Where Mid Suffolk District Council processes personal data in its role as landlord or public
authority, it relies primarily on public task and legal obligation as its lawful bases.

Provision of personal data
In most cases, providing your personal data is necessary in order for us to respond to your
enquiry, manage a booking or provide services. If you choose not to provide required
information, we may be unable to deliver the relevant service or respond fully to your
request.

Marketing communications
Where you opt in to receive marketing communications, we will send updates about events,
opportunities and services related to the Innovation Gateway. We will not send you such
communications if you have opted out.
You may withdraw your consent at any time by using the unsubscribe link in our emails or
by contacting us directly using the details below. We comply with the Privacy and Electronic
Communications Regulations 2003 in relation to electronic marketing.

CRM and operational systems
Customer and enquiry data is stored within systems operated by Hethel Innovation Ltd for
the purposes described in this notice. Access to these systems is role-based and restricted to
staff who need it to perform their duties.

Mid Suffolk District Council may have access to relevant Innovation Gateway CRM data for
reporting and governance purposes in accordance with agreed controller-to-controller
arrangements. Where the Council accesses such information, it does so as an independent
data controller for its own statutory and governance purposes.

Data sharing
We may share personal data with:
 

• Mid Suffolk District Council for monitoring, reporting, governance and landlord-

• related functions where applicable

• Skills and delivery partners where they are involved in delivering specific

• programmes or events, and in aggregated or anonymised form for analysis where possible

• Payment providers and booking platform providers to take payments and manage bookings

• Professional advisers and auditors, where necessary for advice, compliance and assurance

All sharing is limited to what is necessary and proportionate for the relevant purpose.
Where personal data is shared with Mid Suffolk District Council, each party acts as an
independent data controller. We do not sell personal data.

International transfers
We do not routinely transfer personal data outside the United Kingdom. If it becomes
necessary to use service providers whose support, backup or related services involve a
restricted transfer under UK GDPR, we will ensure appropriate safeguards are in place in
accordance with UK GDPR, such as adequacy regulations or standard contractual clauses.

Retention
We retain personal data only for as long as necessary for:
 

• Delivery of services

• Contractual administration

• Reporting and accountability

• Legal and financial record keeping

Retention periods are defined within our internal retention schedule and are reviewed
periodically. As an indication, financial records are normally retained for up to 7 years in line
with legal and accounting requirements. Other records are kept for the minimum period
needed to fulfil the purposes set out in this notice, after which they are securely deleted or
anonymised.

Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal or
similarly significant effects on individuals.

Your rights
Under UK GDPR you have the right to:
 

• Access your personal data

• Rectify inaccurate or incomplete data

• Request erasure of your data in certain circumstances

• Restrict processing in certain circumstances

• Object to processing based on our legitimate interests

• Withdraw consent where processing is based on consent

• Data portability where applicable

Requests should be made in writing using the contact details below. We may need to verify
your identity before responding.

If your request relates to tenancy or landlord matters, it may be handled by Mid Suffolk
District Council as the relevant controller. In such cases we may direct you to contact the
Council or share your request with them where appropriate.

Security
We implement appropriate technical and organisational measures to protect personal data.
These include access controls, system permissions, encryption where appropriate, secure
configuration of platforms and regular review of our security arrangements.

Changes to this privacy notice
We keep this privacy notice under regular review to ensure it remains accurate and reflects
how personal data is processed at the Stowmarket Innovation Gateway.
We may update this notice from time to time. The latest version will always be published on
our website and will include the effective date shown at the top of this document.
Where changes are material and affect how your personal data is used, we will take
reasonable steps to bring those changes to your attention.

Contact details
Hethel Engineering Centre
Chapman Way
Hethel
Norwich
NR14 8FB

Email: privacy@hethelinnovation.com
Telephone: 01953 859100

Hethel Innovation Ltd is registered with the Information Commissioner’s Office under
registration number ZA178658.

Data Protection Officer
Our Data Protection Officer is:
Keith Hebborn - Hebborn Consultancy Ltd
Email: keith@hebborn.co.uk

If you have concerns about how your personal data is handled, please contact Hethel
Innovation Ltd in the first instance using the details above.
You also have the right to lodge a complaint with the Information Commissioner’s Office if
you remain dissatisfied with our response:
Information Commissioner’s Office - www.ico.org.uk