PRIVACY POLICY

National Institute of Medical Herbalists (NIMH)

Effective Date: June 2026 (Updated to comply with the Data (Use and Access) Act 2025 and UK GDPR)

1. Introduction

This privacy notice provides you with details of how we collect and process your personal data through your use of our website (www.nimh.org.uk), including any information you may provide through our site when you contact us, purchase a product or service, or engage with our membership services.

By providing us with your data, you warrant to us that you are over 16 years of age.

The National Institute of Medical Herbalists is the data controller and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).

Contact Details

National Institute of Medical Herbalists

Email address: info@nimh.org.uk

Postal address: Clover House, James Court, South Street, Exeter, EX1 1EE

Telephone number: 01392 426022

Formal Complaints Handling Procedure (DUAA 2025 Requirement)

We are committed to resolving any queries or concerns you may have regarding our processing of your personal data quickly and transparently. If you have a concern or complaint about how we handle your personal data, you have the right to submit a formal data protection complaint directly to us.

To lodge a complaint, please email us at info@nimh.org.uk with the subject line “Formal Data Protection Complaint” or write to us at our postal address above. Upon receipt of your complaint:

We will formally acknowledge receipt of your complaint within 30 calendar days.
We will investigate your concern thoroughly and respond to you without undue delay, outlining any corrective measures or findings.

You also retain the legal right to complain to the UK supervisory authority for data protection issues, the Information Commissioner (formerly the Information Commissioner’s Office or ICO), accessible at www.ico.org.uk. We would, however, appreciate the opportunity to address your concerns directly before you approach the Information Commissioner, so please contact us in the first instance.

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at info@nimh.org.uk.

2. What Data We Collect About You

Personal data means any information capable of identifying an individual. It does not include anonymized data.

We may process certain types of personal data about you as follows:

Identity Data: includes your first name, maiden name, last name, username, marital status, title, date of birth, gender, and professional membership details.
Contact Data: includes your billing address, delivery address, email address, and telephone numbers.
Financial Data: includes your bank account and payment card details.
Transaction Data: includes details about payments between us and other details of purchases or subscriptions made by you.
Technical Data: includes your login data, IP address, browser type and version, time zone setting, operating system, and platform used to access this site.
Usage Data: includes information about how you use our website, products, and services.

Special Category Data (Sensitive Data)

We do not collect Special Category Data about website visitors generally. Special Category Data refers to data including details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic/biometric data, and information about your health.

Where we are required to collect personal data by law, or under the terms of a contract between us and you do not provide that data when requested, we may not be able to perform the contract (for example, to deliver goods or services to you). In such cases, we may have to cancel a product or service, but we will notify you at the time.

3. How We Collect Your Personal Data

We collect data about you through a variety of methods, including:

Direct interactions: You may provide data by filling in forms on our site, subscribing to our services or newsletter, registering as a member, or communicating with us by post, phone, email, or otherwise.
Automated technologies or interactions: As you navigate our site, we automatically collect Technical Data about your equipment and browsing actions via cookies and server logs. Please refer to Section 11 and our Cookie Policy for details on low-risk analytics exemptions under PECR/DUAA rules.

4. How We Use Your Personal Data & Lawful Bases

We will only use your personal data when legally permitted under UK data protection legislation. Most commonly, we rely on the following legal bases:

Contractual Necessity: Where we need to perform the contract we are about to enter into or have entered into with you.
Compliance with Legal Obligation: Where we need to comply with a legal or regulatory obligation.
Legitimate Interests: Where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Under the DUAA 2025, this includes statutory Recognised Legitimate Interests (such as crime prevention, safeguarding, responding to emergency situations, and network security).
Consent: Where explicit consent is required, such as sending certain non-member direct marketing communications to individuals. You have the right to withdraw consent at any time by emailing info@nimh.org.uk.

Purpose / Activity	Type of Data	Lawful Basis for Processing
To register you as a member or customer	(a) Identity (b) Contact	Performance of a contract with you
To process and deliver your order or subscription	(a) Identity (b) Contact (c) Financial (d) Transaction	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you (notifying changes, updating terms)	(a) Identity (b) Contact	(a) Performance of a contract (b) Necessary to comply with a legal obligation
To ensure public safety, safeguarding, and professional standards compliance	(a) Identity (b) Contact (c) Professional details	(a) Recognised Legitimate Interest (DUAA 2025) (b) Compliance with legal and regulatory obligations
To administer and protect our business and website (troubleshooting, data analysis)	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (business administration, IT security) (b) Recognised Legitimate Interest (network/cybersecurity)
To send direct marketing or institute updates	(a) Identity (b) Contact	(a) Legitimate Interests (existing members/customers) (b) Consent (for non-member newsletter signups)

Purpose / Activity

Type of Data

Lawful Basis for Processing

To register you as a member or customer

(a) Identity

(b) Contact

Performance of a contract with you

To process and deliver your order or subscription

(a) Identity

(b) Contact

(d) Transaction

(a) Performance of a contract with you

(b) Necessary for our legitimate interests (to recover debts due to us)

To manage our relationship with you (notifying changes, updating terms)

(a) Identity

(b) Contact

(a) Performance of a contract

(b) Necessary to comply with a legal obligation

To ensure public safety, safeguarding, and professional standards compliance

(a) Identity

(b) Contact

(a) Recognised Legitimate Interest (DUAA 2025)

(b) Compliance with legal and regulatory obligations

To administer and protect our business and website (troubleshooting, data analysis)

(a) Identity

(b) Contact

(a) Necessary for our legitimate interests (business administration, IT security)

(b) Recognised Legitimate Interest (network/cybersecurity)

To send direct marketing or institute updates

(a) Identity

(b) Contact

(a) Legitimate Interests (existing members/customers)

(b) Consent (for non-member newsletter signups)

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal ground permitting the processing.

5. Disclosures of Your Personal Data

We may share your personal data with third parties for the purposes set out in Section 4 above, including:

Service Providers: IT systems providers, cloud storage, web hosting, and software administrators acting as data processors.
Professional Advisers: Lawyers, bankers, auditors, and insurers providing consultancy, legal, banking, and accounting services.
Regulators and Authorities: HM Revenue & Customs, legal authorities, and the Information Commission who require reporting of processing activities in specific circumstances.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow third-party service providers to use your personal data for their own purposes.

6. International Data Transfers

We process your data primarily within the United Kingdom (UK).

Where personal data is transferred, stored, or processed outside the United Kingdom (e.g., when utilizing global IT service providers or cloud platforms), we ensure a similar degree of protection is afforded to it in line with the Data Protection Test established under the DUAA 2025 and UK GDPR. Transfers outside the UK will only occur where:

The UK Government has deemed the recipient country to provide an adequate level of data protection; or
We have put in place approved standard contractual clauses, international data transfer agreements, or binding corporate rules providing adequate safeguards that meet UK legal standards.

7. Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your personal data to those employees, agents, contractors, and third parties who have a business need to know. They will process your personal data solely on our instructions and are subject to a strict duty of confidentiality.

We have procedures to deal with any suspected personal data breach and will notify you and the Information Commission where we are legally required to do so.

8. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

By law, we must keep basic information about our customers and members (including Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers/members for tax and legal compliance purposes.

In some circumstances, you can ask us to delete your data (see Section 9). In other circumstances, we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your Legal Rights

Under UK data protection laws (UK GDPR / DUAA 2025), you have the following rights in relation to your personal data:

Request access: Obtain a copy of the personal data we hold about you.
Request correction: Rectify incomplete or inaccurate data we hold about you.
Request erasure: Ask us to delete or remove personal data where there is no good reason for us continuing to process it.
Object to processing: Object where we are relying on legitimate interests or direct marketing.
Request restriction: Ask us to suspend the processing of your personal data.
Request transfer: Transfer your personal data to you or a third party in a structured, commonly used format.
Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

If you wish to exercise any of these rights, please email us at info@nimh.org.uk.

You will not have to pay a fee to access your personal data (or exercise any other rights). However, we may charge a reasonable fee or refuse to comply if your request is clearly unfounded, repetitive, or excessive.

We may need to request specific information from you to confirm your identity as a security measure. We aim to respond to all legitimate requests within one month. Occasionally, it may take longer if your request is particularly complex, in which case we will notify you and keep you updated.

10. Third-Party Links

This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

11. Cookies & Analytics

Our website uses cookies and similar technologies to distinguish you from other users. In accordance with the amended Privacy and Electronic Communications Regulations (PECR) under the DUAA 2025, low-risk, first-party web analytics cookies are used to help us improve our website’s performance, subject to clear information and an easily accessible opt-out mechanism.

For detailed information on the cookies we use and the purposes for which we use them, please see our Cookie Policy at nimh.org.uk/cookie-policy.