For the purpose of the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 (the GDPR), the Company is the controller of the personal data it processes about you. We are registered with the Information Commissioner’s Office with registration number: A8693901. We also control and operate (the Website). This policy sets out how we collect, process, store and protect your personal data.
This policy applies to customers, potential customers, sub-contractors, suppliers and advisers in relation to whom we process personal data.
2. How we collect your personal data
In relation to customers, potential customers, sub-contractors, suppliers and advisers we collect your personal data when you:
visit our Website;
when you register for an account;
contact us via post, email, telephone or otherwise; and
through automated technologies or interactions.
Where our client or potential client is a registered company, we will process personal data in relation to our relevant contacts at that client or potential client.
The personal data we collect from you may include:
your name, address, company address, telephone number(s) and email address;
records of written and verbal communications between us;
any personal data which you choose to include in communications you send to us including through the contact form on the Website or by post or email;
technical data such as your IP address, browser type and version, time zone setting and location; and
data about how you use our website, including pages you have clicked on and how long you have spent on them.
3. How we use your personal data
We use your personal data in the following ways:
to communicate with you by phone, email and post;
to ensure that the content of the Website is presented to you effectively;
to validate your user account;
for customers, we use your personal data to provide you with our services during your relationship with us and in order to obtain feedback from you about our services and your experience with us;
for sub-contractors, suppliers and advisors, we use personal data in relation to keeping in contact with you and maintaining a relationship with you.
4. Our legal basis for processing
We process your personal data on the basis that it is necessary for the following purposes:
for the performance of any contract that we enter with you or to take steps at your request prior to entering into a contract;
for the purposes of our legitimate interests in ensuring that we provide you with the best service possible in all our interactions with you, which if you are a client or potential client may include providing you with information about our services which may be of interest to you; and
for compliance with any legal obligation to which we are subject.
We may send emails to customers and potential customers in relation to services which we think they may be interested in, based on our knowledge of their business. Where we send such marketing emails we will first obtain your consent for us to do so. Please note that you are able to withdraw your consent at any time by contacting us using the details provided in the contact and complaints section below. This will not affect the lawfulness of any processing that was carried out based on your consent prior to it being withdrawn.
5. Sharing your personal data
We only share your personal data with third parties where it is necessary for us to do so in order to fulfil our obligations to you under our contract, or where we are required to do so in order to comply with a regulatory or legal provision. We will never sell your personal data for direct marketing.
The circumstances in which we may share your personal data with third parties includes:
where we use a provider of services, for example in relation to our computer systems or programmes which we use for our business operations;
payment providers such as stripe;
where we share your personal data with our professional advisers such as insurers and lawyers.
6. Transfers of your personal data
The personal data that we collect from you will not ordinarily be transferred to, or stored at, a destination outside the European Economic Area (EEA).
However, if we do need to transfer your personal data outside the EEA we will take all steps reasonably necessary to ensure that any such transfer is made securely and that there is adequate protection in place in order to protect your personal data.
Please contact us if you wish to find out more; if we ever transfer your Personal Data outside the EEA you can ask us for a copy of the relevant safeguards implemented in relation to the transfer.
7. How long we will retain your personal data
For customers, we will retain your personal data for as long as is necessary to manage our relationship with you and in order to contact you with any important information. We expect that we will retain personal for up to six (6) years following the end of our relationship with you.
8. Changes to this policy
9. Your rights
Your personal data is protected under data protection laws and you have a number of rights (explained below) which you can seek to exercise. Please contact us using the details provided in the contact and complaints section below if you have any queries in relation to your rights.
If you seek to exercise your rights, we will explain to you whether or not the right applies to you; these rights do not apply in all circumstances.
Right of access – You have a right to access the personal data we hold about you upon request. This is known as a "Data Subject Access Request". You can exercise this right by making a request in writing, by email or by telephone using the contact details in the contact and complaints section below.
Right of rectification – You can ask us to correct or update your personal data to ensure it is accurate and complete.
Right to erasure and right to restrict processing – You can ask us to stop processing and/or to delete your personal data in certain circumstances (for example, where it is processed with your consent, or it is no longer necessary for us to process it).
Right to data portability – You have a right to ask us to provide you with your personal data in a form that suits you, and/or to provide your information to a third party.
Right to object – You have a right to object to our processing of your personal data.
Profiling and automated decisions – You have a right not to be subject to automated decisions which have a legal effect and to be protected by safeguards in respect of any profiling. We do not undertake any automated decision making or profiling.
Right to object to direct marketing – Where you have consented to receive direct marketing, you can change your mind at any time by contacting us or following the link to "unsubscribe" provided in each email we send to you. Please allow a few days for us to action your request.
10. SMS Aware
In respect of SMS Aware we are a data processor and only act on the written instructions of our customers. Our customers who pay to use SMS Aware are data controllers and determine the purpose and the means of any processing.
We are not responsible for dealing with requests to exercise any of the data subject’s rights set out above where they relate to the processing of data in the context of SMS Aware. If you wish to make a complaint or request to exercise any of your rights in respect of processing in the context of SMS Aware, you should contact the relevant controller directly.
11. Contact and Complaints
You also have the right to lodge a complaint with a supervisory authority (the ICO) by writing to Information Commissioner's Office, Water Lane, Wilmslow, SK9 5AF or calling 0303 123 1113. Further information about how to do this can be found at: www.ico.org.uk.