Lawful Basis

Data Controller/Processor

We are a 'data controller', which means that we (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed. We have overall control over the 'why' and the 'how' of our data processing activities.

We are a 'data processor', which means that we process personal data on behalf of a third-party (i.e. the 'data controller').

Data

Whose Data do we Collect?

needs to collect and use personal data in order to fulfill our obligations as an organisation. This policy describes how this personal data must be collected, handled and stored to meet our data protection obligations - and to comply with the law.

We only ask for information about you that helps us to help you, and we don't ask for any information that has no specific purpose.

We store information about:

• Customers
• Suppliers
• Business Contacts
• Employees
• Contractors

Use of Data for Specific Purposes

We may use the personal data you supply for our purposes where we deem it necessary in our legitimate interests.

We will need your consent for some of the activities that may not be covered by our legitimate interests, for example the collection of data via cookies and the delivery of direct marketing through digital channels such as email subscriptions. Where we need to obtain consent we do so in an open, transparent and clear way so that you know exactly what you are signing up for, why we need your information and how will intend to use it.

If you are not happy with the way we collect your personal data, you have several rights which you can exercise at any time. Please see the section on 'Your Rights' in this document.

We may use your personal information to help us to exercise or defend any legal claims that may arise.

Below are the ways that we may use and process your personal data, although please note that this list is not exhaustive.

• For carrying out our obligations and contracts with us and our customers
• For marketing purposes
• To send details of promotions, offers and events
• To communicate with individuals in the course of our business
• To enable us to develop and market other services and products
• To carry out satisfaction surveys and testimonial requests
• To conduct online training
• To facilitate our payroll and invoicing procedures
• To verify details that individuals have provided

Personal Data Types

We collect information to help provide our users with better services. The information we collect, and how we use that information you supply, depends on how you use our service(s), and how you manage your privacy controls. We collect and use the following personal data about our staff and/or customers:

• Email Address
• Telephone Number
• Fax Number
• Address
• Postcode
• Job Title

The Ways we Collect Data

CliqTo Ltd collects a limited amount of personal data to enable us to fulfill our contractual duties to you or to other organisations. Additional items of information may be needed to help us keep our relationship with you working smoothly.

In the event that you access our website, read an email, or click on a link in an email we send to you, we may also collect certain data automatically or through providing it to us, including data such as your IP address and cookies, the latter of which make your interaction with our website(s) smoother and more intuitive, providing you with a better, more customised experience.

We collect this information from the following sources:

• Directly from the individual
• From our website (including cookies)
• From individuals emailing us
• From the use of social media channels such as Facebook or Twitter

Third-Party Data

CliqTo Ltd does not purchase or use data that has originated from a third-party source.

Sharing of Personal Data

From time to time, CliqTo Ltd may share personal data with another organisation (another data controller). The circumstances and purpose of sharing this personal data may depend on the nature of the service provided, but we will be clear when this happens, and for what purpose. In all cases, the information sharing will be reasonable and expected, and will be clear who is involved.

If you are concerned about data sharing, get in touch with us and we will be able to tell you whether information is being shared with another organisation. We will explain what the information is, who it is being shared with, and why. Alternatively you can see our Privacy Statement. You also have additional rights under the GDPR, including the right to access your information, a right to rectification, a right to erase your data, a right to restrict processing and a right to object.

• Other organisations in our group of companies
• Third-party service providers where we have an appropriate protections in place
• Marketing technology platforms and suppliers
• The new or prospective owners of our business if it is acquired by another in the future
• Official authorities (e.g. HMRC) when asked to do so by law
• Other third parties who can fulfill a customer's request or order

Children's Data

General Data Protection Regulations state that organisations must take particular protection when collecting and processing personal data about children. CliqTo Ltd does not process any personal data of children under the age of 16.

Data Transfer

Data Portability

CliqTo Ltd does not transfer data out of the European Economic Area (EEA).

Consent

Information about individual's personal or sensitive information has been freely given by the data subject. We also take the following measures to ensure that we obtain explicit consent before using or storing their information:

• Consent was freely given at the point of purchase
• Consent was clearly distinguishable in an accessible, distinguishable manner
• We can demonstrate that the individual gave their consent
• Individuals have the ability to withdraw their consent at any time.

Website Data Collection

CliqTo Ltd may collect a limited amount of data from our website users which we use to help us to improve your experience when using our website, and help us to manage the services we provide.

We may also use data from your use of our websites to enhance other aspects of our communications (including marketing) with you. Any communications to and from CliqTo Ltd and you may be reviewed and monitored as part of internal or external investigations or for legal reasons as required to under law.

The data we collect may consist of the following information:

• IP Addresses
• Cookie Information
• Name
• Contact Details (including Email Address)
• User comments
• Logging tools and plugins

Individual Rights

Right to Object

• We will stop processing personal data upon receiving notification to do so
• If there are legitimate grounds which override the interests, rights and freedoms of the individual, we may refuse
• If the processing is for the establishment, exercise or defence of legal claims, we may refuse
• We inform individuals of their right to object at the point of first communication
• We stop processing data for direct marketing right away, and without charge
• Personal data may be in the interest of a public interest task, and we may not be required to comply

Article 21 of the GDPR gives you the right to object to the processing of your personal data, which effectively allows you to ask to stop processing any data we store about you. You can make an objection verbally or in writing, and we have one calendar month to respond to an objection.

Right to Access

• Individuals have the right to access their personal data
• We may store supplementary information, which we will supply when requested to do so
• A copy of the data can be provided free of charge
• We may charge a reasonable fee to comply with requests for further copies of the same information
• We will provide the information without delay, within one month of receipt of the request
• We may extend the period of compliance by an additional two months where requests are complex or numerous
• We may charge a reasonable fee if a request is manifestly unfounded or excessive
• We may refuse to respond if a request is manifestly unfounded or excessive
• If we refuse, we will explain why, and inform them of their right to complain
• We provide information in a commonly used electronic format
• We verify the identity of the person making the request using 'reasonable means'
• Where we process a large quantity of information about an individual, we may ask to specify the information the request relates to

You have the right to obtain a copy of the personal data we store about you, as well as any other supplementary information (also known as 'subject access'. This helps you to understand how and why we are using your data, and to ensure that we are using it lawfully. You can make a subject access request verbally or in writing, and we have one calendar month to respond to your request.

Right to Erasure

• We have a policy for how to record requests we receive
• We are able to recognise a request for erasure, and understand when the right applies
• We may refuse a request, and will provide details to individuals when we do so
• We respond to a request for erasure without undue delay, and within 1 month of receipt
• We may extend the time limit to respond to more complex requests
• We place particular emphasis on the right to erasure if it relates to data collected from children
• We inform recipients if we erase any data we have shared with them
• We have appropriate methods in place to erase information

Also known as 'the right to be forgotten', the right to erasure gives you the ability to request that your personal data is erased. You can make a request for erasure verbally or in writing to us, and we have one month to respond to your request.

Security

We have gone to lengths to consider the impact of security of the data we hold in our systems.

• We take into account the state of the art and costs of implementing security measures
• We review our information security policies and measures at regular intervals
• We make improvements to our security policies wherever necessary
• We understand the requirements of confidentiality, integrity and availability for the personal data we process
• We can restore access to personal data in the event of the loss of data
• We conduct regular testing and reviews of our measures to ensure they remain effective

Security Measures

has implemented adequate security measures to protect personal information from unlawful access, theft, disclosure or loss.

If you suspect an loss, unauthorised access or misuse of your personal information we hold about you, please let us know immediately. Our details can be found on this document.

The following measures have been implemented:

• Data encryption
• Server maintenance
• Software version updates
• Data integrity and resilience
• Restoration of data in a timely manner

Data Anonymisation

Data anonymisation is a process where steps are taken to de-identify personal data to make it impossible to connect that data to an individual. CliqTo Ltd does not undertake data anonymisation on personal data.

CCTV and Cameras

CliqTo Ltd does not store personally-identifiable video or images from CCTV cameras, body cameras, unmanned aerial systems or other systems that capture information of identifiable individuals or information relating to individuals.

Wifi and Remote Access

We may transmit data through a WiFi network to and from a remote location where necessary. This may include information and data about our staff and customers.

Storage

Storage Location

• Emails
• Documents
• Limited Access
• Databases
• Paper Files

CliqTo Ltd take every precaution when it comes to storing your data to ensure that it is protected against unauthorised or unlawful access, loss, destruction or damage. We use the following methods to store personal information, ensuring that we protect it at all times:

If CliqTo Ltd has no meaningful contact with you (or, our partners) for a total period of time as outlined below, we will delete the personal data we store about you from our systems, unless we have reason to believe that laws require CliqTo Ltd to retain it, including any anticipated legal action.

We delete personal data from our systems after the following period of inactivity:

• We delete personal data from our systems after a set period time of 'inactivity'
• We delete personal data from our systems after a set period of time, regardless of activity and recency
• We retain all personal data indefinitely in an archive, separate from 'live' data
• We delete personal data from our systems after (please state below):
• 2 years
• f

Storage Limitations

Data Breaches

Breach Identification

We have taken steps to prepare a series of actions in the event of a breach of personal data from our systems.

• We know how to recognise a personal data breach
• We have prepared a response plan for addressing any personal data breaches that occur
• We have allocated responsibility for managing breaches to a dedicated person or team
• Our staff know how to escalate a security incident to the appropriate person or team
• We document all breaches, even if they don't all need to be reported

Data Breach Procedures

has procedures in place to report a breach of data security to the regulator within 72 hours of becoming aware of any breach. We undertake the following procedures:

• Breaches are investigated at the earliest opportunity
• We pass details of the breach to the regulator, including the nature, consequences and mitigations taken to address it
• We may require assistance from data processors
• We notify individuals if there is a significant risk to their rights and freedoms

Accountability

Our Accountable Practices

New GDPR legislation by the Information Commissioner's Office state that accountability should be high on the list of priorities for organisations. At we take accountability seriously, and take responsibility for complying with with GDPR at the highest management levels and throughout our organisation.

• We take responsibility for complying with the GDPR at the highest management and throughout our organisation
• We keep evidence of the steps we take to comply with the GDPR
• We adopt and implement data protection policies where proportionate
• We take a 'data protection by design' approach, putting data protection measures in place from the outset
• We have written contracts in place with organisations that process personal data on our behalf
• We maintain documentation of our processing activities
• We implement appropriate security measures to protect data
• We record and report personal data breaches to the appropriate authorities
• We carry out data protection impact assessments on high-risk personal and sensitive data
• We have appointed a Data Protection Officer
• We adhere to relevant codes of conduct and sign up to certification schemes where possible
• We review and update our accountability measures at appropriate intervals

Privacy - You Right to be Informed

An important part of the GDPR is the Right to be Informed about what information we have. The following data types are stored and used by CliqTo Ltd as part of our normal business activities:

Getting in touch

Should you wish to discuss any aspect of our policies, please get in touch with us using the details below:

CliqTo Ltd, Unit 8, Palmbourne Industrial Park, Castle Street, Stafford, United Kingdom, ST16 2TB