Privacy Policy

PRIVACY POLICY

This policy explains how the Cirtec group of companies collects and uses your personal information.

OUR DETAILS

The data controllers with conduct of your personal information are Cirtec Group Ltd (UK company number 14949623).

You can contact us by post to: Compliance Manager, 85 Great Portland Street, First Floor, London, W1W 7LT. You can also contact us by email to accounts@cirtecgroup.co.uk.

HOW WE USE YOUR PERSONAL INFORMATION 

This table explains how we use your personal information in our business. 

Situation	Types of information	Purpose and lawful basis for processing
We monitor how users interact with our website through the use of cookies.	IP address, approximate location, employer interactions with our website.	After obtaining your consent to setting the cookies, we have a legitimate interest in monitoring how you interact with our website in order to improve it and to troubleshoot issues. We also have a legitimate interest in carrying out a reverse look-up on your IP address to identify prospective customers so that we may contact your organisation about our products and services.
You make an enquiry regarding our products or services. This may be by contacting us directly or via a third-party comparison site which we are affiliated with.	Name, contact information, employer, details of your enquiry.	We have a legitimate interest in responding to your enquiry and in keeping a record of our correspondence with you. This helps us efficiently operate our business.
We send you marketing communications regarding our products and services.	Name, contact information, job title, marketing preferences.	If you are a sole trader or partner in a legal partnership then we have a legitimate interest in contacting you about similar goods/services to those which you have purchased from us or have enquired about. In other circumstances, we have a legitimate interest in contacting you about our full range of products and services in order to promote our business. If you have opted in to receiving marketing communications from us then we process your information for that purpose based on your consent.
You or your organisation buys goods or services from us.	Name, job title, contact information, payment details, contract details.	Where you are our customer, this processing is necessary for us to perform our contract with you. Where your organisation is our customer, we have a legitimate interest in processing your personal information for the purpose of managing the contractual relationship your organisation and us. We have a legitimate interest in keeping a record of the contract and related correspondence between you and us (or your organisation and us) for the administration of our business and to address any disputes which may arise.
You or your organisation supplies goods or services to us.	Name, job title, contact information, payment details.	Where you are our supplier, this processing is necessary for us to perform our contract with you. Where your organisation is our supplier, we have a legitimate interest in processing your personal information for the purpose of managing the contractual relationship between your organisation and us. We have a legitimate interest in keeping a record of the contract and related correspondence between us (or your organisation and us) for the administration of our business and to address any disputes which may arise.
We speak to you over the phone	A recording of what is said on the call	We have a legitimate interest in recording our telephone calls for training and monitoring purposes. We will tell you if your call will be recorded at the outset of the call or when we start recording.

HOW LONG WE KEEP YOUR INFORMATION FOR

We only keep your information for so long as is reasonably necessary. Generally speaking, we keep your information for the following periods of time:

• General enquiries – two years from when we resolve your enquiry, unless you go on to become a customer or supplier of ours.
• Customers and staff of customers – seven years from the date of expiration or termination of the contract.
• Suppliers and staff of suppliers – seven years from the date of expiration or termination of the contract.
• We keep outbound call recordings for two years from the date of the call and inbound call recordings for three years from the date of the call.

WHO IS YOUR INFORMATION SHARED WITH?

We share your personal information between our group companies where necessary for the effective operation of our business. 

We also share your personal information with third parties where we are required to do so by law, to protect our rights, to perform our contractual obligations or to efficiently operate our business. In order to achieve these purposes, we share your data with the following people or group of people:

• If you are an employee or representative of a customer or supplier of ours then we may share your information with your employer for the purpose of manging the business relationship between your organisation and us.
• We share your information with our outsourced service providers (including our professional advisers) where it is necessary for us to receive goods/services from those providers.
• Potential purchasers of, and investors in, our business may be given access to redacted information about our customers, suppliers and their staff/representatives as part of the sale/investment process. Before sharing your redacted information we ensure that the recipient has signed a confidentiality agreement which ensures your information is legally protected.

If the recipient of your personal information is based outside of the UK and is not in a country which has received an adequacy regulation from the UK government, we will safeguard the transfer of your personal information. Typically this will involve the recipient and us entering into the standard contractual clauses (SCCs) which is a legal contract which ensures that your data continues to be protected to the same high standard as under UK law.

AUTOMATED DECISION MAKING

We do not make automated decisions about you based on your information. If this changes in the future then we will let you know.

YOUR RIGHTS

Under data protection law you have the following rights:

• the right to be informed about what we do with your information. This policy provides you with this information.
• if we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by and notifying us using the details set out at the start of this policy.
• the right to access a copy of your information which we hold. This is called a ‘data subject access request’. Additional details on how to exercise this right are set out in the ‘Access to Information’ section below.
• the right to prevent us processing your information for direct marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data or by contacting us using the details set out at the start of this policy.
• the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing.
• the right to object to us processing your personal information in certain other situations.
• the right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate.
• the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law.
• the right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.

You have the general right to complain to us in the first instance if you are not happy with how we are processing your personal information. If you are not satisfied by our response then you can complain to the UK regulator which is the Information Commissioner’s Office (ICO). The ICO’s website is www.ico.org.uk.

ACCESS TO INFORMATION

Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. You must send us proof of your identity, or proof of authority if making the request on behalf of someone else, before we can supply the information to you. Requests should be sent to us using the contact details set out at the start of this policy.

You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are entitled to refuse to comply with your request if it is particularly onerous.

In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form.

CHANGES TO OUR PRIVACY NOTICE

This policy was last updated on 04 July 2023. Any changes we make to our privacy policy in the future will be uploaded to our website. If we significantly change how we process your personal data then we will notify you of the changes by email.