Privacy Notice

1. Who we are

St Michael's Cave is a visitor attraction within the Gibraltar Nature Reserve. For the purposes of applicable data protection law, the data controller is HM Government of Gibraltar, acting through the Gibraltar Nature Reserve and the department responsible for the Environment.

Website: www.stmichaelscave.com
General enquiries: info@stmichaelscave.com
Visitor address: St Michael's Road, Gibraltar GX11 1AA, Gibraltar

Questions about the use of personal data may also be addressed to the HM Government of Gibraltar Data Protection Officer at dpo@gibraltar.gov.gi.

2. The law that applies

We process personal data in accordance with the Gibraltar General Data Protection Regulation (Gibraltar GDPR), the Data Protection Act 2004 and other applicable Gibraltar data protection legislation.

3. Personal data we may collect

Depending on how you use the website or contact us, we may collect:

• your name
• your email address
• your telephone number
• the type or subject of your enquiry
• information contained in your message or correspondence
• information relating to group, school, educational or organised visits
• accessibility information that you choose to provide where it is needed to assist with your visit
• records of correspondence and follow-up communications
• technical information such as IP address, browser type, device type, operating system, date and time of access, pages requested, referring page, security logs and server logs
• information about your privacy or cookie preferences
• aggregated website usage information where privacy-compliant analytics are used

4. How we collect personal data

We may collect personal data:

• directly from you when you submit a form, email us, telephone us or otherwise contact us
• when you make an enquiry relating to a visit, school group, accessibility requirement or visitor service
• automatically through website infrastructure, security logs and permitted cookies or similar technologies
• from another person acting on your behalf, for example a teacher, tour organiser, parent, guardian or group leader
• from another HM Government of Gibraltar team where this is necessary to respond to your enquiry or administer a relevant public service

5. Why we use your personal data

We may use personal data to:

• respond to questions, requests and enquiries
• manage group, school and educational visit enquiries
• assist visitors with accessibility requirements
• provide information about St Michael's Cave, The Awakening and the Gibraltar Nature Reserve
• deal with visitor feedback, complaints or incidents
• manage, maintain, secure and troubleshoot the website
• prevent or investigate misuse, fraud, malicious activity or security incidents
• understand general website use and improve visitor information, where permitted
• maintain records required for operational, public administration, audit, legal or regulatory purposes
• comply with legal obligations and lawful requests from competent authorities
• establish, exercise or defend legal claims

6. Our lawful bases

We only process personal data where there is a lawful basis under the Gibraltar GDPR. The basis used will depend on the purpose and circumstances.

Public task — processing may be necessary for the performance of functions carried out in the public interest or in the exercise of official authority, including the administration of the Gibraltar Nature Reserve and the provision of visitor information and services.

Contract or steps before a contract — where you ask us to take steps in relation to a booking, organised visit or service, processing may be necessary to take steps at your request before entering into an arrangement or to perform an agreement.

Legal obligation — we may process personal data where this is necessary to comply with an obligation imposed by Gibraltar law.

Consent — we rely on consent where the law requires it, including for certain non-essential cookies or optional communications. Where processing is based on consent, you may withdraw that consent at any time.

Legitimate interests — where applicable to a particular activity and permitted for the controller concerned, we may rely on legitimate interests, for example to protect the security of the website or to manage limited administrative functions. We will consider the impact on your rights before doing so.

7. Contact forms and enquiries

When you submit an enquiry through www.stmichaelscave.com, we use the information you provide to deal with your enquiry and any necessary follow-up. Providing the information marked as required is necessary for us to respond properly.

Submitting an enquiry does not, by itself, subscribe you to marketing communications. You should not include sensitive information in a general enquiry unless it is genuinely needed for us to assist you.

8. Accessibility and special category information

You may choose to tell us about a disability, medical condition, mobility requirement or other accessibility need when planning a visit. Please provide only information that is relevant to the assistance you require.

Where such information constitutes special category personal data, we will process it only where an additional condition under applicable law is met, which may include your explicit consent or another condition permitted by Gibraltar law.

9. Tickets, bookings and payments

The website may provide links to ticketing, booking or payment services operated through the Gibraltar Nature Reserve or another authorised provider. Where you are redirected to another website or service, that service may process personal data under its own privacy information.

Unless the website expressly states otherwise at the point of payment, payment card details are not collected or stored directly by www.stmichaelscave.com.

10. Who we may share personal data with

Where necessary and lawful, personal data may be shared with:

• relevant teams within HM Government of Gibraltar
• the Gibraltar Nature Reserve and staff responsible for St Michael's Cave
• website hosting, security, maintenance and technical service providers
• email, communications and form-processing service providers
• authorised ticketing or booking providers where relevant to your request
• contractors who provide services on our behalf
• professional advisers and auditors
• regulators, law enforcement bodies, courts or other competent authorities where disclosure is required or permitted by law

Service providers acting on our behalf must process personal data only for authorised purposes and must apply appropriate safeguards. We do not sell personal data.

11. Website hosting and technical services

The website is supported by hosting, infrastructure, security and development services. These providers may process limited technical information, such as IP addresses, request data, device or browser information and server logs, where this is necessary to deliver, secure and maintain the website.

12. International transfers

Some service providers may process personal data outside Gibraltar. Where personal data is transferred internationally, we will ensure that the transfer is made in accordance with the Gibraltar GDPR and that an appropriate transfer mechanism or safeguard is in place where required.

You may contact the Data Protection Officer for further information about safeguards that apply to a particular transfer.

13. How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected and to meet applicable legal, regulatory, audit, records-management or operational requirements.

• Routine website enquiries will normally be retained for no longer than 12 months after the enquiry has been closed, unless there is a reason to keep them for longer.
• Records relating to organised visits may be kept for the period reasonably required to administer the visit and deal with any follow-up.
• Records connected with formal complaints, incidents, transactions, legal matters or statutory duties may be retained for longer where required.
• Technical and security logs are retained only for the period needed for security, troubleshooting, abuse prevention and incident investigation.
• Cookie or consent preference records are retained for the period needed to demonstrate and manage those preferences.

Where possible, information that is no longer required will be securely deleted, anonymised or otherwise disposed of in accordance with applicable requirements.

14. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access is limited to people who need the information for an authorised purpose.

15. Children

St Michael's Cave is visited by children and families, but this website is not intended to collect personal data directly from children without an appropriate reason. School or educational visit enquiries should normally be made by a parent, guardian, teacher or other responsible adult.

Where information about a child is required for a visit or accessibility arrangement, we will seek to collect only what is necessary for that purpose.

16. Cookies and similar technologies

The website may use cookies, local storage and similar technologies for essential functions, security and, where enabled, analytics or other optional features. Non-essential technologies will only be used where permitted by law and, where required, after you have made an affirmative choice.

Please see the separate Cookie Policy for more information.

17. Your data protection rights

Subject to the circumstances and any applicable exemptions, you may have the right to:

• be informed about how your personal data is used
• request access to personal data held about you
• ask for inaccurate or incomplete data to be corrected
• request deletion of personal data where the legal conditions are met
• request restriction of processing
• object to certain processing
• request data portability where that right applies
• withdraw consent at any time where processing is based on consent
• raise a complaint with the Gibraltar Regulatory Authority

To exercise a data protection right, contact dpo@gibraltar.gov.gi. We may ask for information needed to verify your identity before acting on a request.

18. Automated decision-making

We do not use information collected through this website to make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects.

19. Links to other websites

This website may link to other websites, including tourism, ticketing, Government or third-party services. This Privacy Notice does not govern the independent processing carried out by those external websites. You should review their privacy information when you leave www.stmichaelscave.com.

20. Changes to this Privacy Notice

We may update this Privacy Notice when the website, our services, service providers or applicable legal requirements change. The date shown at the beginning of the notice identifies the latest published version.

21. Contact and complaints

For general privacy questions or to exercise your rights:
HM Government of Gibraltar Data Protection Officer
Email: dpo@gibraltar.gov.gi

You also have the right to complain to the Gibraltar Regulatory Authority, which is Gibraltar's supervisory authority for data protection:

Gibraltar Regulatory Authority
Information Rights Division
2nd Floor, Eurotowers 4
1 Europort Road
Gibraltar GX11 1AA
Telephone: +350 200 74636
Email: privacy@gra.gi
Website: www.gra.gi