This policy was last updated in May 2020.
WHO WE ARE
The Exemplas Privacy Notice (Notice) below gives you further information about the way Exemplas collects and uses personal information about you (which is known as “personal data” under data protection legislation).
The Exemplas Group of Companies means Exemplas Holdings Limited; Exemplas Limited; Exemplas Trade Services Limited; and Enterprise Growth Solutions Limited (“Exemplas Group”). References in this Notice to “we” or “us” are to the entities listed.
We are Exemplas Limited and our address is College Lane, Hatfield, Hertfordshire, England, AL10 9AB (referred to as "we" or "us" or "our"). We are the providers of the online platform Hertfordshire Growth Hub (referred to as the "Site").
For the purposes of all applicable data protection and privacy legislation in force in the UK from time to time (including Data Protection Act 2018 and the General Data Protection Regulations as applicable) (collectively “GDPR”), unless otherwise stated, we are the data controller responsible for, and control the processing of, your personal data during your use of the Site.
This Policy sets out why we collect personal data about individuals and how we use that data. It explains the legal basis for this and the rights you have over the way your data is used.
We may change this Policy from time to time.
Our Site, products and services are not intended for use by or relating to children or persons under 18 years of age and we do not knowingly collect data from or relating to them.
We are a part of the Exemplas Group of companies, meaning Exemplas Holdings Limited; Exemplas Limited; Exemplas Trade Services Limited; and Enterprise Growth Solutions Limited (the “Exemplas Group”).
If different Exemplas Group companies act as joint controllers, Exemplas Holdings Limited is designated as a single point of contact for data subjects under GDPR.
If you have any queries about the Site, this Policy, our use of your personal information, or would like to submit a subject access request or exercise your other data subject rights, please contact us by:
email to: firstname.lastname@example.org; or
The Head of Legal and Data Privacy (Group General Counsel)
3rd Floor, Titan Court
3 Bishops Square
THE DATA WE COLLECT ABOUT YOU
The type and amount of data we collect depends on the reasons for which it is provided to us. The data we may collect includes:
- Identity Data includes title, first name, last name, date of birth, and username or similar unique identifier.
- Contact Data includes billing address, delivery address, email address and telephone numbers.
- Financial Data includes bank account and payment card details.
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
- Technical Data includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Site or products.
- Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
- Usage Data includes information about how you use the Site, applications, products and services.
- Marketing and Communications Data includes your preferences in receiving marketing information from us and our third parties and your communication preferences.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any data about criminal convictions and offences.
HOW WE COLLECT YOUR DATA
We use different methods to collect data from and about you including through:
- Direct interactions. You may give us your Identity, Contact, Financial and Profile Data by filling in forms, using our products or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
- apply for our products or services;
- create an account on the Site;
- subscribe to our services or publications;
- request marketing to be sent to you;
- enter a competition, promotion or survey; or
- give us feedback or contact us.
- Automated technologies or interactions. As you interact with our Site, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookies Policy and “Cookies” below for further information.
- Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources:
- Technical Data which may include your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Platform.
- Contact, Financial and Transaction Data from providers of technical, payment and delivery services.
- Identity and Contact Data from our clients, data brokers or aggregators.
- Identity and Contact Data from public authorities or government departments or third parties offering you funded business support services.
- Identity and Contact Data from publicly available sources such as social media, HMRC, Companies House and the Electoral Register based inside the EU.
WHERE WE COLLECT DATA FROM
We collect data:
- From you when you give it to us directly: you may provide your details when you visit the Site, use our products, ask us for information, attend our events, or contact us for any other reason. Your data may be collected by an organisation we are working with, but we are still responsible for your data.
- When you have given other organisations permission to share it: your data may be provided to us by other organisations if you have given them your permission. This might for example be a business or organisation working with us or when you buy a product or service from a third party organisation. The data we receive from other organisations depends on your settings or the optional responses you have given them.
- When you use the Site: data about you is recorded and stored when you use the Site. Please see our Cookies Policy and “Cookies” below for further information.
- When it is available on social media: depending on your settings or the privacy policies of social media and messaging services you use, like Facebook, Instagram or Twitter, you might give us permission to access data from those accounts or services.
HOW WE USE YOUR DATA
We will use your personal data in a number of ways including:
- providing you, our customers or their customers with the information or services that have been requested;
- where it is lawful for us to do so, sending you communications that may be of interest, including marketing information about our services and activities;
- when necessary, for carrying out the obligations under any contract between us, or between us and our customers;
- seeking your views on the services or activities we carry on, so that we can make improvements;
- maintaining our organisational records and ensuring we know how you prefer to be contacted; and
- analysing the operation of the Site and analysing your use of the Site to improve the Site and its usefulness.
OUR LEGAL BASIS FOR PROCESSING YOUR DATA
The use of your data for the purposes set out above is lawful because one or more of the following applies:
- where you have provided data to us for the purposes of requesting information or requesting that we deliver a product or carry out a service for you, we will proceed on the basis that you have given consent to us using the data for that purpose, based on the way that you provided the data to us. You may withdraw consent at any time by using the method stated on the Site but the withdrawal of your consent may result in certain functions of the Site not being available to you. This will not affect the lawfulness of processing of your data prior to your withdrawal of consent being received and actioned;
- where the purpose of our processing is the provision of information, products, or services to you or our customers, we may also rely on the fact that it is necessary for our legitimate interests in relation to providing the information, product or service requested;
- it is necessary for us to hold and use your data so that we can carry out our obligations under a contract entered into with you, or to take steps asked of us prior to entering into such contract;
- it is necessary to comply with our legal obligations (other than under a contract); and
- it is necessary to protect your or another individual’s vital interests.
You have the right to withdraw consent to receiving marketing communication from us at any time by contacting us. If you want to contact us about your marketing preferences please email us on email@example.com.
USE OF AGGREGATED DATA
We also collect, use, share and supply Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature.
However, if we combine or connect Aggregated Data with other data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Policy.
HOW WE KEEP YOUR DATA SAFE
We understand the importance of keeping your personal data secure and take appropriate steps to safeguard it.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and third parties who have a business need to know.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
No data transmission over the internet can be guaranteed to be completely secure. We strive to safeguard your data, however we cannot guarantee the security of any data you provide online and you do so at your own risk.
WHO HAS ACCESS TO YOUR DATA
The following persons or entities may have access to your data:
- Third parties granted access to our services, for example other users of the Site, such as the Marketplace or Events functions.
- Third parties who provide services for us, for example IT service providers, professional advisors, or HM Revenue & Customs. We select our third party service providers with care. We provide these third parties only with the data necessary to provide the service.
- Analytics and search engine providers that help us to improve the Site and its use.
- Third parties in connection with restructuring or reorganisation of our operations, for example if we merge with another organisation. In such event, we will take steps to ensure your privacy rights will be protected by the third party.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
For financial or technical reasons, the data you provide to us may be transferred to countries outside the European Economic Area (EEA), which are not subject to the same data protection regulations as apply in the UK.
We meet our obligations under GDPR by ensuring that the data that we transfer to countries outside of the EEA has equivalent protection. We do this by ensuring that any third parties processing your data outside the EEA either benefits from an adequacy determination for GDPR purposes and/or, where appropriate, we have entered into a data processing agreement which contains model EU clauses.
We may also disclose your personal data if we are required to do so under any legal obligation. We may use your data for the purposes of fraud prevention and credit risk reduction, or where doing so would not infringe your rights, but is necessary for a legal reason and/or in the public interest.
Other than this, we will not share your data with other organisations without your consent.
For more information about the cookies we use, please see our Cookies Policy.
KEEPING YOUR DATA CURRENT
Please let us know if your contact details change. You can do so by contacting us at firstname.lastname@example.org; or updating your profile within your user area on our Site
HOW LONG WE RETAIN YOUR DATA
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you, or other reasons we believe would warrant a longer retention period.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances you can ask us to delete your data. See “Your Rights” below for further information.
Where we rely on your consent to contact you for direct marketing purposes, we will treat your consent as lasting only for as long as it is reasonable to do so. We may periodically ask you to renew your consent. If you ask us to stop contacting you with marketing materials, we will keep a record of your contact details and limited information needed to ensure we comply with your request.
You have the right to request details of the processing activities that we carry out with your personal data through making a subject access request. Such requests have to be made in writing. To make a request, please contact us by email to email@example.com.
You also have the following rights:
- the right to request rectification of data that is inaccurate or out of date;
- the right to erasure of your data (known as the “right to be forgotten”);
- the right to restrict the way in which we are dealing with and using your data;
- the right to request that your data be provided to you in a format that is secure and suitable for re-use (known as the “right to portability”);
- rights in relation to automated decision making and profiling including profiling for marketing purposes.
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. The IPO’s website is www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns directly before you approach the ICO so please contact us in the first instance.
SURVEYS AND USER GROUPS
We always aim to improve the services we offer. As a result, we may occasionally canvass our customers and users using surveys (where the customer has opted in for this). Participation in surveys is voluntary, and you are under no obligation to reply to any survey you might receive from us. Should you choose to do so, we will treat the information you provide with the same high standard of care as all other customer information.
This Policy may be changed from time to time. We recommend that you read this Policy each time you consider giving us your personal data.