| Version Control | |
|---|---|
| Approved By | Rohan Lumer-Raybould |
| Version | 1.2 |
| Policy became operational on: | May 2018 |
| Next Review Date | March 2025 |
Privacy and Cookies Policy
We understand that your privacy is important to you, and you care about the use of your personal data. We respect and value the privacy of all individuals whose data we process; this privacy statement explains what personal data or information we collect from you at various points in our relationship with you, and from people who visit our website, and how we use it. We would encourage you to read the information below.
Who are we?
Get Support IT Services Limited are a registered company in England and Wales (07003640) and our registered office address is: Unit B Oakwood, Oakfield Industrial Estate, Eynsham, OX29 4TH. Get Support IT Service Limited is a registered Data Controller (ICO registration number ZA392775).
What is Personal Data?
“Personal data” is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data means, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
What personal data or information do we collect?
We collect personal data about our clients and prospective clients, employees, job applicants and visitors to our website. The personal information we collect may include your name, postal address, email address, phone number, IP address, and information regarding what pages you access on this website and when. We provide greater detail about the data collected about our clients below and encourage you to read this detail.
How do we collect data or information from you?
- We collect personal information about you when:
- You contact us for any reason
- You place an order for products or services
- When we deliver products or services to you
- You voluntarily complete customer surveys, provide feedback or participate in competitions.
- You visit our website
- You apply for a job
- You work for us as an employee or contractor
- You sign up to receive updates from Get Support IT Services Limited
- You request a downloadable ebook from Get Support IT Services Limited
- You visit us at our offices
How is your information used?
We collect your personal data or information to operate the business effectively and provide you with a high-quality service. We may use your information:
- To answer enquiries that you make prior to any agreement or contract
- To provide quotations
- To process orders for products and services that you have requested from us
- To manage your account
- To deliver our services to you
- To keep you informed about our services and insight into industry best practice, if you have not opted out of receiving these communications.
- To fulfil our obligations as a responsible business
- To manage our agreement or contract with you
- To maintain security of our website and IT infrastructure, and for access control purposes
- To maintain security of our premises
- To invoice you and to track payments you make or payments made to you
- To help us understand our business, maintain quality and inform our decisions to help improve the services we deliver, including our website.
- To manage the recruitment and employment process
- To enable us to run credit checks and use fraud prevention agenices.
We believe that all these purposes are justified on the basis of our legitimate interests in running and promoting the business, our contractual requirements to deliver the agreed services to you, and our legal obligations, both as a business and responsible employer. If you would like to know more, please read below:
- Clients
- Prospective Clients
- Job Applicants
- Employees
- Associates
- Suppliers
Client
As a client, we will hold the following information about you:
- Name and business contact information.
- Financial information
- Information and documents relating to the products and services we are providing, including communications with you.
- Billing and payment information.
- CCTV imagery, if you visit us at our premises.
- Voice and communication on our call recording system.
We store your information using our productivity applications, including communications with you which will be stored in our email system, our Customer Relationship Management (CRM) and Ticketdesk system and our Financial Management Software. We have a call recording system for training and monitoring purposes; all calls into and out of the office are recorded.
We use CCTV at offices to make sure we provide a safe and secure environment for all visitors to our premises and to ensure the protection of our employees and property. Your image may be captured if you visit us at our office. We retain the data for 30 days, and will use it if we need to investigate specific incidents further.
As our customer, we may send you monthly newsletter updates to keep you informed about relevant insights that could be helpful to your business. We will always give you the opportunity to opt-out of receiving these communications each time we send them.
We will retain your details for the duration of our relationship with you, and for a minimum period of 7 years after the end of the contract. We will retain financial records for 6 years, following the end of the current financial year.
Prospective Customers
As a prospective client, we may hold the following information about you:
- Name and business contact information.
- Information and documents relating to the products or services you require, including communications with you.
- CCTV Image, if you visit us at our office
- Voice and communications on our call recording system.
We store your information in our productivity applications, our Customer Relationship Management System and potentially our marketing platform. Communications with you will be stored in our email system. We have a call recording system for training and monitoring purposes; all calls into and out of the office are recorded.
We use CCTV at offices to make sure we provide a safe and secure environment for all visitors to our premises and to ensure the protection of our employees and property. Your image may be captured if you visit us at our office. We retain the data for 30 days, and will use it if we need to investigate specific incidents further.
Where our relationship with you does not progress beyond the enquiry or proposal stage, we will retain your details for a maximum period of 2 years since the last meaningful communication we had with you.
Job Applicants
When you apply for a job with us, we may hold the following information about you:
- Name, date of birth, and contact information.
- Information relating to your qualifications and experience
- Demographic information such as postcode
- References where we take them up
- Information and documents relating to the review, interview and selection process, including communications with you.
- CCTV Imagery, if your interview takes place at our office.
We store your information on our productivity applications and our communications with you relating to the interview process in our email system, and our candidate management platform.
We use CCTV at offices to make sure we provide a safe and secure environment for all visitors to our premises and to ensure the protection of our employees and property. Your image may be captured if you visit us at our office. We retain the data for 30 days, and will use it if we need to investigate specific incidents further.
We will retain your personal data relating to the review, interview and selection process for a period of 6 months after the interview date. If you are successful in your application, your information is transferred to our People Management Systems, as detailed in the ‘Current and Former Employees’ section below.
Current and Former Employees
When you work for us, we may hold the following information about you:
- Name, date of birth, and contact information
- National insurance number
- Information relating to your qualifications and experience
- Demographic information such as postcode
- Information and documents relating to your performance and supervision as an employee of the business, including communications with you
- Your training records
- Your attendance records, including sickness
- Your photograph, including Passport and Driving Licence
- Financial information, such as bank details, pension scheme and salary details
- Information about your next of kin
- CCTV Imagery, if you are based at our office or visit our offices
- Voice and communications on our call recording system.
We store your information on our People Management Systems to help us manage performance, development, attendance, and supervision; on our payroll system to allow us to manage, track and process salaries and pensions. We will also store communications with you in our email system. We have a call recording system for training and monitoring purposes; all calls into and out of the office are recorded. Your photo documentation is collected to comply with our legal obligation to undertake Right to Work checks prior to employing you.
We use CCTV at offices to make sure we provide a safe and secure environment for all visitors to our premises and to ensure the protection of our employees and property. Your image may be captured if you visit us or work at our office. We retain the data for 30 days, and will use it if we need to investigate specific incidents further.
We will share your personal information as required with HMRC, pension providers and with our external HR consultancy. We retain your personal information for 7 years after the end of your employment with us.
Suppliers
When you work with the business as a supplier, we may hold the following information about you:
- Name and business contact information.
- Information relating to your qualifications and experience, if relevant
- Information relating to your business activities.
- Information and documents relating to the services or products you offer, including our communications with you.
- Financial information
- CCTV Imagery, if you visit our offices.
- Voice and communications on our call recording system.
We store your information in our productivity applications and our Financial Management Software. Communications with you will be stored in our email system. We have a call recording system for training and monitoring purposes; all calls into and out of the office are recorded.
We use CCTV at offices to make sure we provide a safe and secure environment for all visitors to our premises and to ensure the protection of our employees and property. Your image may be captured if you visit us at our office. We retain the data for 30 days, and will use it if we need to investigate specific incidents further.
We will retain your information for the duration of our relationship with you and for 2 years after the last purchase we made with you. We retain financial information for 6 years, after the end of the current financial year.
Our role as a Data Processor
We also act on behalf of some of our clients in the capacity of a data processor, this is for services where our clients determine the purposes and means of processing personal data. When working exclusively as a data processor:
- we will be acting on the instruction of our client and will process their data in accordance with GDPR requirements
- people processing the data are subject to a duty of confidence
- the data is stored and processed securely
- we will only engage a sub-processor with the prior consent of the data controller and a written contract. A list of current sub-processors for a client’s current services is available by emailing privacy@getsupport.co.uk
- we will assist the data controller in providing subject access and allowing data subjects to exercise their rights under the GDPR
- we will assist the data controller in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments
- we will delete or return all personal data to the controller as requested at the end of the contract
- we submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their Article 28 obligations
Who has access to your information?
We limit access to your personal data to those employees, associates, and third-party processors (see below) who have a legitimate need to know and ensure that they are aware of their duty of confidentiality.
We do not sell or rent your personal data or information to any third party or share your information with third parties for their own marketing purposes.
In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
We may pass your information on to third party service providers, agents or subcontractors for the purposes of completing a task or providing services to you on our behalf (e.g. processing payments). However, we disclose only the personal information necessary to deliver that service and have a contract in place that requires them to keep your information secure and not to use it for other purposes.
Third party service providers who act as data processors on our behalf where we are the Data Controller:
| Service Provider | Activity Carried Out | Sector | Location |
|---|---|---|---|
| Customer Relationship Management Software (data processor) | Provision of software to manage current, previous and prospective clients | Information Technology (software) | UK |
| HR Software (data processor) | Provision of software to manage current and previous employees | Information Technology (software) | UK (may transfer to US) |
| HR Consultancy (data processor) | Provision of HR Consultancy Services | HR | UK |
| Marketing Communications Software (data processor) | Provision of software to manage newsletter creation and distribution | Information Technology (software) | UK |
| Holiday Management Software (data processor) | Management of Annual Leave | Information Technology (software) | UK |
| Call Recording System (data processor) | Provision of telephone recording for training and monitoring purposes | Telephony | UK |
| Candidate Management Platform (data processor) | Provision of software to manage our recruitment process | Information Technology (software) |
If any of your personal data are shared with a third party, as described above, we will take steps to ensure that your personal data are handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above.
If you are our client, you can ask for a list of current sub-processors for your current services by emailing privacy@getsupport.co.uk
Transfers outside of the UK and European Economic Area
We will store or transfer some or all of your personal data to countries that are not part of the UK or European Economic Area (the “EEA” consists of all EU member states, plus Norway, Iceland, and Liechtenstein). These are known as “third countries” and may not have data protection laws that are as strong as those in the UK and/or the EEA. This means that we will take additional steps in order to ensure that your personal data are treated just as safely and securely as they would be within the UK and under our Data Protection Legislation as follows:
- We share your data with external third parties, as detailed in the table above, that are based outside of the UK & EEA. The following safeguards are applied to such transfers:
- We will only transfer your personal data to third countries whose levels of data protection are deemed ‘adequate’ by the Information Commissioner’s Office.
- We use specific contracts with external third parties that are approved by the Information Commissioner’s Office and European Commission for the transfer of personal data to third countries. These contracts require the same levels of personal data protection that would apply under the Data Protection Legislation. More information is available from the European Commission.
- Where we transfer your data from the UK to a third party based in the US additional steps have been taken to ensure your personal data will be treated as securely and safely as it would be in the UK and under the GDPR. We check whether or not the US-based organisation is certified to the UK extension to the EU-US Data Privacy Framework. If not, we continue to rely on signed Data Processing Agreements with our data processors based on model contract clauses provided by the Information Commissioner’s Office and European Commission (also known as ‘standard contract clauses’), which impose suitable data protection standards on a contractual basis.
Please contact us using the contact details provided below for further information about the particular data protection mechanisms used when transferring your personal data to a third country.
What are my rights?
Under Data Protection Legislation, you have the following rights, which we will always work to uphold:
- The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the contact details provided at the end of this policy.
- The right to access the personal data we hold about you. The section “How Can I Access My Personal Data?” will tell you how to do this.
- The right to have your personal data rectified if any of your personal data held by us are inaccurate or incomplete. Please contact us using the contact details provided at the end of this policy.
- The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold, in certain circumstances. Please contact us using the contact details provided at the end of this policy to find out more.
- The right to restrict (i.e. prevent) the processing of your personal data.
- The right to object to us using your personal data for a particular purpose or purposes.
- The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
- The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data are processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
- Rights relating to automated decision-making and profiling. We do not use your personal data in this way.
For more information about our use of your personal data or exercising your rights as outlined above, please contact using the contact details provided at the end of this policy.
It is important that your personal data are kept accurate and up-to-date. If any of the personal data we hold about you change, please keep us informed for as long as we have those data.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first using the contact details provided at the end of this policy.
How you can update your information
The accuracy of your information is important to us. If you change your contact details or if you want to update any of the information we hold on you, please email us at: privacy@getsupport.co.uk or by post at: Unit B Oakwood, Oakfields Industrial Estate, Eynsham, OX29 4TH.
How you can access your personal information
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
All subject access requests can be made in writing, either via email or via the postal addresses shown below, or verbally, either in person or on the phone.
There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will respond to your subject access request within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data, within that time. In some cases, however, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
You also have the right to lodge a complaint about our processing of your personal data with the UK’s Information Commissioner’s Office
Keeping your data secure
The security of your personal data is essential to us, both as a data controller and a data processor. To protect your data, we take a number of important measures, including the following:
- Encrypting data at rest and in transit
- Enabling multi-factor authentication for remote access
- Physical access control
- Logging and monitoring of access to networks and data
- Adhering to our policies and processes including, physical security, adopting a zero-trust approach, back-up, encryption, access control and password protocols.
- Systems are patched to protect against known vulnerabilities
- Limiting access to your personal data to those associates and third-party processors with a legitimate need to know and ensuring that they are subject to duties of confidentiality.
- Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so.
Contacting us via email
We use Transport Layer Security (TLS) to encrypt and protect email traffic in line with government standards. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.
We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
Children’s Privacy
We do not provide services to anyone under the age of 13 and do not knowingly collect their data. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us at the details at the end of the policy. If we become aware that we have collected personal data from anyone under the age of 13 without verification or parental consent, we will take the appropriate steps to remove that information from our systems.
Visitors to Our Website
When you visit our website, we will collect information about your visit which may be indirectly attributable to you (e.g. if we were to link it with other publicly available data which allowed us to identify you). However, we do not attempt to identify you as an individual, but use the aggregated data collected from all visitors to our website to understand how we can improve the service. Further information about the technical information we collect and what choice you have is available in our Cookie Policy and the ‘Usage Data’ section below.
We also collect information about you via our website if you choose to use the online form or chat function to contact us. In order to be able to deal with your enquiry effectively, we ask you to provide us with the following information:
- Name
- Contact Email
- Contact Telephone
- Brief details of your enquiry
We only use this information to respond to your enquiry and will handle it in line with the ‘Prospective Clients’ and then ‘Client’ data described earlier in this policy, depending on how your relationship with us progresses.
Usage Data
We collect usage data automatically when you use our website. This may include information such as your device’s Internet Protocol address (i.e. IP address), browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When you access the website using a mobile device, we may collect certain information automatically, such as the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data.
We may also collect information that your browser sends whenever you visit our website or access it using a mobile device.
Links to other websites
Our website may contain links to other websites run by other organisations. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website.
In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that third party site.
How do I contact you?
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details for the attention of:
Data Protection Lead: Rohan Lumer-Raybould
Email address: privacy@getsupport.co.uk
Postal address: Unit B Oakwood, Oakfields Industrial Estate, Eynsham, OX29 4TH
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 01/03/2024