Privacy Policy

1) Who we are (Data Controller & contact)

Data Controller: Manchester City Council (“the Council”) acting for the Shout Out North Manchester project.

Primary contact for data protection enquiries (including GDPR removal requests):
Name: Zoe Williams
Email: zoe.williams@manchester.gov.uk

If you make a request relating to your data (for example, to access or delete it), the Council will coordinate a response in line with UK GDPR.

2) Data we collect

We collect and process the following categories of personal data:

• Usage data (via Google Analytics): pages visited, approximate location (city/region), device/browser, session duration, and on-site interactions. This is aggregated, and we do not seek to identify you.
• Registration data you submit (see section 5): name, contact details, biography, images, creative discipline, links to websites and social media, and any optional information you choose to provide.
• Recommendations (“Shout Out”) data about another person or organisation that you submit: name, public profile links, and other publicly available information to support a recommendation.
• Communications: enquiries sent by email or via any site forms, including metadata necessary to deliver and protect our services (for example, timestamps and IP address for security and abuse prevention).
• Cookies and similar technologies (see section 4).

3) Why we use your data (lawful bases)

We rely on the following lawful bases under Article 6 UK GDPR:

• Consent — when you choose to register to be featured and permit us to publish your bio page and related media; when you accept non-essential analytics cookies.
• Legitimate interests — to run and improve the website; to review and verify recommendations (“Shout Outs”) about third parties; to prevent misuse and ensure security. We balance these interests against your rights and expectations.
• Contract — where processing is needed to provide features you request (for example, creating and maintaining your public profile page on the site).
• Legal obligation — to comply with applicable laws and to respond to valid requests from public authorities.
• Public task — where applicable to the Council’s public functions in promoting culture and community initiatives.

You can withdraw consent at any time (see Your rights).

4) Google Analytics (GA4) & cookies

We use Google Analytics 4 (“GA4”) to understand how visitors use the site. GA4 uses cookies or similar technologies to collect
aggregated usage data. We configure GA4 with IP anonymisation and do not enable Google Signals or Ads Personalisation.

• Legal basis: your consent under PECR for non-essential cookies.
• What’s collected: page views, on-site events, device/browser info, approximate geolocation (city/region), and referrers.
• Control: you can manage consent via our cookie banner and withdraw at any time; you may also block or delete cookies in your browser.
• Retention: GA4 event data is retained for up to 14 months (subject to Google configuration).

Essential cookies that are strictly necessary for site operation do not require consent. We do not use cookies to track you across other websites.

5) Registration forms (two pathways)

5.1 Register to be involved (create a public bio page)

You can submit your details to be listed on the site with a public bio page. This may include your name, photo, biography,
creative discipline, contact method(s), website and social links, and media you choose to share.

• Purpose: to publish and maintain a public profile for you on SONM.
• Legal basis: consent and/or contract (providing a requested service).
• Visibility: any information you mark for publication will be publicly visible.
• Your control: you can request edits or removal of your page at any time (see How to contact us).
• Images/media: by supplying media, you confirm you have the rights to share it and to grant us a licence to display it on the site. We may optimise or resize images for performance.

5.2 “Shout Out” (recommend someone else)

You may recommend another individual or organisation for inclusion. You should only submit information that is already publicly available (e.g., official website, public social profiles) and accurate to the best of your knowledge.

• Purpose: to assess and potentially feature creatives recommended by the community.
• Legal basis: legitimate interests (curating and showcasing local creativity). We assess necessity and balance with the recommended person’s rights.
• Verification: we may perform minimal checks to verify details and, where appropriate, contact the recommended person/organisation before publishing any personal data.
• Publication: we will not publish personal data from a recommendation without appropriate verification and, where needed, the individual’s permission.
• Responsibility of submitter: do not upload sensitive personal data or private contact details without clear permission. You are responsible for ensuring the links you provide are publicly available and accurate.
• Right to object/removal: any person or organisation recommended can object or request removal at any time (see Your rights).

6) Who we share your data with

We do not sell or rent your personal data. We do not share personal data with third parties for their own marketing.
We may share data with trusted service providers (“processors”) under written contracts that require them to keep data secure and use it only on our instructions, including:

• Website hosting and security providers;
• Content delivery/network and performance services;
• Email and form delivery services;
• Analytics provider (Google Analytics).

We may also disclose information if required by law, to protect vital interests, or to establish, exercise, or defend legal claims.

7) International data transfers

Some providers (including Google) may process data outside the UK/EEA. Where this occurs, we rely on appropriate safeguards such as
the UK International Data Transfer Agreement/Addendum and/or Standard Contractual Clauses, plus additional measures as needed.

8) How long we keep your data

• Public bio pages: for as long as the page remains published or until you request removal.
• Recommendations (“Shout Outs”): for up to 12 months while we review; if published, the information becomes part of the public listing and is retained as above.
• Enquiries (email/forms): typically up to 24 months after resolution.
• Analytics: GA4 event data retained up to 14 months (subject to Google configuration).

We may retain minimal records to demonstrate compliance (for example, proof of consent) where legally necessary.

9) How we keep your data secure

We use technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, least-privilege administration, and vendor due diligence. No method of transmission or storage is 100% secure; however, we continually work to protect your information.

10) Your rights

Under UK GDPR, you have the right to:

• Access your personal data and receive a copy;
• Correct inaccurate or incomplete data;
• Delete your data (in certain circumstances);
• Restrict or object to processing, including objecting to processing based on legitimate interests;
• Data portability (receive your data in a usable format and transfer it to another controller);
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with the UK Information Commissioner’s Office (ICO): https://ico.org.uk/.

To exercise any right, contact zoe.williams@manchester.gov.uk.
We may need to verify your identity before acting on a request.

11) Children’s privacy

Our services are intended for general audiences. If you are under 13, please obtain parental/guardian consent before submitting any personal data. If we learn that we have collected personal data from a child without appropriate consent, we will take reasonable steps to delete it.

12) Content responsibility & liability

User-submitted content: Profiles and recommendations may include links and information supplied by users. While we may
moderate, verify, or edit submissions, responsibility for the accuracy and lawfulness of user-submitted information lies with the submitter.
We do not endorse third-party content and are not responsible for external websites linked from this site.

Creators not liable: The site was created by Joe Hartley and Malandra Jacks; they have no operational responsibility and accept no liability for the website’s content or data processing.
Manchester City Council is responsible for data processing, storage, and enquiries.

No liability towards SONM / Manchester City Council & associates: Nothing in this policy limits your data protection rights under law. Subject to those rights, Shout Out North Manchester, Manchester City Council, and associates involved with the Creativity In Place project
are not liable for loss or damage arising from (i) reliance on user-submitted or third-party content, (ii) external links or services,
or (iii) any temporary unavailability or technical issues, except where such liability cannot be excluded by law.

13) Changes to this policy

We may update this Privacy Policy from time to time. We will post the latest version on this page and update the effective date above.
If changes are significant, we will provide a prominent notice on the website.

14) How to contact us

For any data protection enquiries (including GDPR-related removal requests), please contact:
Zoe Williams — zoe.williams@manchester.gov.uk

If you are not satisfied with our response, you can contact the UK Information Commissioner’s Office: https://ico.org.uk/.

Last reviewed: 31 August 2025