About this privacy notice
This privacy notice describes how Experio Summer Ltd (‘Experio’ or ‘we’) collects and uses your personal information during and after your relationship with us.
We are a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you, and for explaining this clearly to you.
This notice applies to individual and business contacts and prospects; any person who provides services to us, either as an individual or as the employee or representative of a corporate service provider; and users of our websites.
It is important that you read this notice, together with any other privacy information or notices we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Information we collect and process
We collect personal information direct from you when you enquire about our products and services, where we enter into a contract to receive services from you or when you use our site.
We collect further information from you during the period of our relationship.
We may also be provided with, or collect, information about you from third parties’ sites where this is permitted, or where you have given permission for a site or social media platform to allow us access.
In summary, we use your personal data for the following purposes:
- to carry out obligations arising from any contracts between us and you; with suppliers; or with third parties;
- to communicate with you, including to provide you with information, products or services; and
- where it is necessary for our business or our customers’ business.
We set out below further information and our lawful basis for processing such information.
Suppliers, third party business contacts and prospects:
We process names, job titles and business contact information including addresses, telephone numbers and email addresses for your employees and representatives and other information to maintain and manage our relationship with you. Such processing is necessary for the performance of the contract between us.
Where you are an employee of a corporate client or contractor, we process this information for the legitimate interest of performing our contract with your employer.
If there is a problem, for example, if we have a complaint about a service you have provided then we have a legitimate interest in using personal information in connection with that complaint, for example, so that we can tell you what happened so that you can put things right.
We may perform due diligence in the form of credit checks on companies, including checking photographic identification and proof of address of directors and, in some cases, your shareholders, and verification of the company registration details. We do this to comply with our legal obligations, and as necessary for our legitimate interests of checking that the entities we contract with are financially viable and would not cause us reputational damage.
Users of our sites:
When you browse our sites we may collect information about your preferences.
We also collect technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
We also collect information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
This is for our legitimate interest in giving you content which is bespoke to you and making sure that our website runs smoothly.
If you create a profile, we will collect and hold the information that you have provided to us, and use this information for the purposes of contacting you in the means requested, about the services you have expressed an interest in. Where required, we will have sought specific consent to such communications, but if we have not sought consent, then we use this information on the basis that it is a legitimate interest of ours or yours to contact you in the way that you have asked.
We may use your information to ask for your views on our services. This is so that we can make improvements and is a legitimate interest of ours.
Other uses
Regardless of the relationship we have with you, we may need to use your personal information for legal reasons such as fraud prevention and to check that you are complying with our terms and conditions and to enforce our legal rights.
Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.
We may contact you about our products and services by email, telephone, post or by text message but we will only do this where we are allowed to under data protection law. If you tell us that you do not want to be contacted for any of these purposes then we will of course respect that. Sometimes we will need your consent before contacting you for these reasons. If you give us your consent then you have a right to withdraw that consent at any time. Any use of your personal information before you withdraw consent remains valid. We will also retain a record of any preferences, to ensure that we only contact you in the manner you have requested, and with the information that you are happy to receive.
Sharing your information
We may share your information with third parties as follows:
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
If we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets.
If we have a legal obligation to do so or for the purposes of fraud protection and credit risk reduction.
We may share your personal data with third party service providers who act on our behalf such as IT services providers. This notice also covers third party service providers we may engage with.
We use third party search engines and analytics providers to help us improve our website and its use.
Where will we store your personal information?
The information you provide to us may be transferred to countries outside the European Economic Area (EEA), which are not subject to the same data protection regulations as apply in the UK. This may be because data is stored on servers outside the EEA or we use suppliers based outside the EEA. We meet our obligations under GDPR by ensuring that the information has equivalent protection as if it were being held within the EEA. We do this by ensuring that any third parties processing your data outside the EEA either benefits from an adequacy determination for GDPR purposes and/or, where appropriate, we have entered into a data processing agreement which contains model EU clauses.
How long will we use your personal information for?
We only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. A copy of our records retention policy is available on request.
If you have a contact with us then we will typically keep information for six or twelve years after the contract is finished.
Your rights in relation to our processing of your personal information
You have the right to:
- be informed about what we are doing with your personal information – we do this by providing you with this privacy notice;
- object to the processing of your personal information;
- request a copy of the personal information we hold about you and to check that we are lawfully processing it;
- request correction of the personal data that we hold about you if it is incorrect;
- ask us to delete the information that we hold about you where there is no good reason for us continuing to process it;
- to ask us to stop processing personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground;
- ask us to restrict how we use your personal information for a period of time if you claim that it is inaccurate and we want to verify the position, or if our processing is unlawful but you do not want us to erase your personal information, or for some other limited circumstances; and ask us to send another organisation information that you have provided to us in a format that can be read by computer.
If you want to exercise any of your rights, please contact us using our contact page.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
If you ask us to restrict our use of your personal information or delete it, we will not be able to provide you with our products or services.
You have a right to lodge a complaint with a data protection supervisory authority. The supervisory authority in the UK is the Information Commissioner’s Office – ico.org.uk. If you do have any concerns about how we have handled your personal information we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.