Privacy Policy

Last updated 6 October 2026

This website is operated by Hero Media & Entertainment Limited (company number SC869649), a company with a registered office address of 5 Redwood Place, East Kilbride, Glasgow, Scotland, G74 5PB (Hero Media & Entertainment).

This privacy policy explains how we use, collect, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR).

For the purposes of data protection legislation, the controller of your data is Hero Media & Entertainment.

For more information about Hero Media & Entertainment, please see the ICO register.

If you have any questions about our privacy policy, you may raise them with our data protection officer by contacting dpo@hme.global .

If you feel like we have mishandled your data in any way, or that you were unable to enjoy the full exercise of your rights and freedoms under the UK GDPR, you can make a complaint with us. For this purpose, and in line with the Data (Use and Access) Act 2025 (DUAA), we have included our ‘Data Protection Complaints Policy and Procedure’ at the end of this Policy.

You may also always contact the Information Commissioner’s Office at https://ico.org.uk/ if you wish to do so.

Information we may collect from you

We only collect and process your personal data where we are legally allowed to do so. We will rely on certain lawful bases for this. The most common bases we rely on are:

1. Contract – where we need to process your personal information in order to fulfil the contract we have, or are about to, enter into with you;
2. Legitimate Interests – Where it is in the legitimate interest of ourselves, or a third party, that the processing takes place and your data rights do not override these legitimate interests;
3. Legal – Where we need to comply with a legal or regulatory obligation;
4. Consent – where we seek your agreement that you would like to receive marketing material from us and to share details with third parties for this purpose.

We may collect and process the following data about you:

• Information that you provide by filling in forms on our site scottishbarandpubawards.com (“our site”). This includes information provided at the time of registering to use our site, subscribing to our service, posting material or requesting further services.
• We may also ask you for information when you report a problem with our site.
• If you contact us, we may keep a record of that correspondence.
• Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.
• Nomination details provided for the awards.

IP addresses

Your browser generates information, including which language the Website is displayed in, and your Internet Protocol address (“IP address”). An IP address is a set of numbers which is assigned to your computed during a browsing session. The IP address is generated whenever you log on to the internet via your internet service provider or your network. Your IP address is automatically logged by our revers and used to collect traffic data about visitors to our website. We also use your IP address to help diagnose problems with our servers, and to administer our website.

Cookies

Cookies are small text files that record Your preferences when You visit certain online pages, and are stored on Your computer or other connected device. We use a variety of first party and third party cookies, as well as both persistent and session cookies. We and (where relevant) our affiliates and third party service providers use cookies to:

1. track the use of the Service;
2. monitor traffic to the Service;
3. improve the Service by making it easier and more relevant for You;
4. obtain and pass on analytics regarding Your use of the Website and the Service;
5. to understand Your preferences for advertising purposes; and
6. to provide You with relevant advertising when visiting our Website.

Online browsers can usually be set to either accept or decline cookies. However, if cookies are declined You may not be able to fully experience the interactive features of the Service.

Where we store your personal data

The data that we collect from you is stored within the European Economic Area (“EEA”). By submitting your personal data, you agree to the storing and processing of this data. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. All information you provide to us is stored on our secure servers.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Uses made of the information

We use information held about you in the following ways:

• To ensure that content from our site is presented in the most effective manner for you and for your computer.
• To allow you to participate in interactive features of our service when you choose to do so.
• To notify you about changes to our service.
• To register your award nominations.

We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to that target audience.

Disclosure of your information

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We may disclose your personal information to third parties:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If Hero Media & Entertainment or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of Hero Media & Entertainment., our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Your rights

Under the UK GDPR, you, as a data subject have a number of rights which are detailed below. Some of these only apply in specific circumstances and are qualifies in several respects by exemptions which are provided for in data protection legislation. We will advise you in our response to your request if we are relying on any such exemptions.

Note that generally there will be no fee attached to your exercise of any of the rights below, unless your request is complex or the related information has to be delivered to you in an unusual manner. We may require proof of identity to verify that the individual making the request is entitled to copies of any personal data.

• Access to personal data: You have a right to request a copy of the personal information that we hold about you. Should you wish to make such a request, please email dpo@hme.global. You should include adequate information to identify yourself and relevant contact details that will reasonably assist is in fulfilling your request. Your request will be dealt with as soon as possible.
• Correction of personal data: You can request us to correct any personal data that we are processing about you with is incorrect. We provide you with online account settings and tools to access the information we hold on your account or email dpo@hme.global. Please remember to always ensure your data is current and updated.
• Right to withdraw consent: Where we have relied upon your consent to process your personal data, you have the right to withdraw that consent. To change your marketing preferences, you can visit the Account tab when you log into your account or email dpo@hme.global
• Right of erasure: You can request us to erase your personal data where there is no compelling or regulator reason to continue processing. This right is not a guaranteed or absolute right.
• Right to data portability: This right allows you to request that we transfer your personal data to a third party. This information will be provided in a machine-readable format such as .csv (readable on Microsoft Excel or equivalent) or .pdf (readable on Adobe Acrobat or equivalent). You have this right as it relates to data processing which you consented to, or which was necessary to fulfil a contract with you. To make a request, contact our Data Protection Officer at dpo@hme.global; we will seek to acknowledge your request within three working days, and to fulfil your request within one month. More complex request may take longer.
• Right to restrict processing of personal data: You have the right, in certain circumstances, to request that we suspend our processing of your personal data. Where we suspend our processing of your personal data we still be permitted to store your personal data, but any other processing of this information will require your consent, subject to certain exemptions.
• Right to object to processing of personal data: You have the right to object to our use of your personal data which is processed on the basis of our legitimate interests. However, we may continue to process your personal data, despite your objection, where there are compelling legitimate grounds to do so, or we need to process your personal data in connection with any legal claims.
• Right to object to direct marketing, which can be done by opting-out of direct marketing. You also have a right to object to any profiling to the extent that it relates to direct marketing only.
• Right to request an explanation of the logic involved where we make decisions about you solely though automated means.
• Right to complain to your national data protection regulator.

Raising a complaint

If you believe we have mishandled your data, or that you were unable to exercise your rights, you can make a complaint. Please follow the procedure set out at the end of this policy: ‘Data Protection Complaints Policy and Procedure’.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail.

Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to dpo@hme.global.

Data Protection Complaints Policy and Procedure

Last updated: 6 October 2026

Hero Media & Entertainment understands that there are occasions when things may go wrong, and that you may feel that we have not addressed a data protection concern appropriately or that you may feel that you have not enjoyed the full exercise of your rights and freedoms under the UK General Data Protection Regulation (“UK GDPR”) or General Data Protection Regulation (“GDPR”).

We take your data protection concerns seriously and, accordingly, have in place a process for dealing with complaints about this.

How to make a data protection complaint

Should you have a complaint about the way we have handled any aspect of data protection, or feel that we have infringed data protection laws, you can make a complaint to our Data Protection Officer at dpo@hme.global.

This is the best way to ensure your complaint reaches the appropriate person in a timely manner. Where other members of our team receive a complaint about data protection matters via some other mechanism, they will nonetheless pass this along as appropriate.

When we respond to a data subject access request, or other exercise of data rights, we will include details of how to complain to us within the response.

Our pledge on data protection complaints

We will acknowledge receipt of your complaint within 30 days of receiving it. For this purpose, the 30-day period begins on the day after we receive the complaint. If the final day falls on a weekend or public holiday, we will acknowledge it by the next working day

Where we will be able to respond to your complaint within thirty (30) days, we will simply do so rather than sending both an acknowledgement and then a final response.

We will take appropriate action to respond to your complaint, including any required investigation, and keep you informed during this process, particularly if there ae any undue delays in responding to the complaint.

We will inform you of the outcome of your complaint without undue delay.

Types of data protection complaint we can deal with

We can deal with any complaint that relates to data protection legislation and requirements, but some examples include:

• Cases in which you are dissatisfied with our response to your data subject access request (DSAR) or another request within which you sought to exercise your data rights;
• Instances in which you have concerns about the data security safeguards which we have in place;
• Any concerns or complaints you may have which relate to how we collected, recorded, used, or retained your personal information.

Cases which we will not consider to be a data protection complaint

Should you be complaining about some other aspect of Hero Media & Entertainment’s service, for instance a transaction or general communication with customer service personnel and seek to exercise your data rights in the process, we will not treat this as a data protection complaint.

What this means is that we will not treat, for example, a data subject access request which is made alongside a more general complaint as a data protection complaint.

Should you wish to make a data protection complaint, please let us know and give us details of your complaint so that we can begin addressing in as quickly as possible.

Where we are unsure about your intent, we may ask you to clarify whether you are making a data protection complaint.

Mixed complaints

Sometimes a complaint may include both data protection issues and wider customer service, account, transaction, gambling, or operational issues. Where this happens, we will identify and handle the data protection element under this procedure. If we can provide an outcome on the data protection element sooner than the wider complaint, we will do so unless there is a justified reason not to.

Proving your identity and making a complaint on behalf of another person

On occasion, your complaint may relate to a situation where we have not met your expectations due to uncertainty on our behalf that addressing your initial effort to exercise your data rights could result in sharing personal data with a person who should not have it.

In such cases, though we will also ask for this at the time of your initial request in any case, we may request proof of identity if this is what it will take for us to be sure we would not be committing such a breach in satisfying your complaint.

If you make a request on behalf of another person, we will again have to satisfy ourselves that you have the authority to do this. Ordinarily, we will ask for such proof at the time your initial query or request. However, there may be occasions upon which the person making the data protection complaint differs from the person who made initial contact with the request or query. In such cases, we will ask you to prove that you have authority to deal with the complaint ion behalf of the data subject before we fulfil the request.

Investigating your complaint

We may ask you to confirm what your complaint relates to if we are unsure.

We will consider any material held internally and any previous actions in relation to the matter you are raising, and will begin investigating it as soon as we become aware of it.

The amount of time it takes us to issue a final response to your complaint will depend on how complex it is and how much investigation is involved, but we will respond without any undue delay.

Informing you of the outcome of your complaint

We will let you know the outcome of your complaint and, in doing so, explain the steps we have taken to resolve it. If we take any actions following on from the investigation, we will inform you of these at the same time.

Where we believe that we have complied with data protection legislation, we will explain to you how we have arrived at that conclusion.

If you are still unhappy

Should you remain dissatisfied following our investigation, as always you have the right to complain to the Information Commissioner’s Office, who can be contacted at https://ico.org.uk/make-a-complaint/.