This policy also applies to adults, who may wish to read further information. Any information targeted at adults will be displayed in a textbox like this. If you are under 18, please don’t feel like you have to read all of the information in these boxes – the most important information for you to know will be outside the box. However, if you do read something in a textbox which you don’t understand, please feel free to ask an adult to explain it to you or contact us using our contact details below.

For the avoidance of doubt, any information contained within a textbox forms part of this privacy policy.

We also collect, use and share aggregated data, such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data, but is not considered to be personal data in law as it will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate a percentage of users accessing a specific feature of our services. However, if we combine or connect your aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used solely in accordance with this policy.

We do not collect any information about criminal convictions and offences.

 IF YOU FAIL TO PROVIDE PERSONAL DATA

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel all or part of a service you have with us but we will notify you if this is the case at the time.

Legitimate Interest – detailed definition

Legitimate Interest – means in the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. Where we use legitimate interest we will record our decision on making this decision.  We rely on legitimate interest where processing of the data we hold on you does not, in our opinion, affect your rights or freedoms and is proportionate to our interests e.g. keeping you up to date with our latest services or obtaining your feedback on our service.

TYPES OF PEOPLE/ORGANISATIONS WE MIGHT SHARE YOUR PERSONAL INFORMATION WITH

IT Support Services

Email Provider

Website Provider

Secure document disposal service

Banks

Online payment providers

Accountants

Insurers

Solicitors

Software Providers

Feedback aggregators and collectors

Couriers

Marketing Agencies

 MARKETING

We may use your personal information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving that marketing.

We strive to provide you with choices regarding certain personal data uses, namely around marketing and advertising. In particular:

• We will always obtain your express opt-in consent before we share your personal data with any third party for marketing purposes; and
• You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Several of our external third parties are based outside the European Economic Area (EEA). Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented. We will either:

Transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission; or

Ensure that standard contractual clauses (SCCs) are in place and we have received assurances that an adequate level of protection of the personal data is achieved (based on a case by case assessment of the circumstances of the transfer), including adequate technical and operational measures in place to protect the personal data.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our customers for 6 years after they cease being customers.

In some circumstances you can ask us to delete your data (see below for further information).

We may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.