Privacy Policy

1. Introduction

1.1  We are committed to safeguarding the privacy of [our website visitors  and customers]; in this policy we explain how we will handle your  personal data.

1.2 This policy  applies where we are acting as a data controller with respect to [your  personal data]; in other words, where we determine the purposes and  means of the processing of that personal data.

1.3  We use cookies on our website. Insofar as those cookies are not  strictly necessary for the provision of [our website and services], we  will ask you to consent to our use of cookies when you first visit our  website.

1.4 Our website  incorporates privacy controls which affect how we will process your  personal data. By using the privacy controls, you can [specify whether  you would like to receive direct marketing communications and limit the  publication of your information]. You can access the privacy controls  via [URL].

1.5 In this policy, "we", "us" and "our" refer to [data controller name].[ For more information about us, see Section 18.]

2. How we use your personal data

2.1 In this Section 2 we have set out:

(a) the general categories of personal data that we may process;

(b) [in the case of personal data that we did not obtain directly from you, the source and specific categories of that data];

(c) the purposes for which we may process personal data; and

(d) the legal bases of the processing.

2.2 We may process [data about your use of our website and services] ("usage data").  The usage data may include [your IP address, geographical location,  browser type and version, operating system, referral source, length of  visit, page views and website navigation paths, as well as information  about the timing, frequency and pattern of your service use]. The source  of the usage data is [our analytics tracking system]. This usage data  may be processed [for the purposes of analysing the use of the website  and services]. The legal basis for this processing is [consent] OR [our  legitimate interests, namely [monitoring and improving our website and  services]] OR [[specify basis]].

2.3 We may process [your website user account data] ("account data").[  The account data may [include your name and email address].][ The  source of the account data is [you or your employer].] The account data  may be processed [for the purposes of operating our website, providing  our services, ensuring the security of our website and services,  maintaining back-ups of our databases and communicating with you.] The  legal basis for this processing is [consent] OR [our legitimate  interests, namely [the proper administration of our website and  business]] OR [the performance of a contract between you and us and/or  taking steps, at your request, to enter into such a contract] OR [[specify basis]].

2.4 We may process [information that you post for publication on our website or through our services] ("publication data").  The publication data may be processed [for the purposes of enabling  such publication and administering our website and services]. The legal  basis for this processing is [consent] OR [our legitimate interests,  namely [the proper administration of our website and business]] OR [the  performance of a contract between you and us and/or taking steps, at  your request, to enter into such a contract] OR [[specify basis]].

2.5 We may process [information contained in any enquiry you submit to us regarding goods and/or services] ("enquiry data").  The enquiry data may be processed [for the purposes of offering,  marketing and selling relevant goods and/or services to you]. The legal  basis for this processing is [consent] OR [our legitimate interests,  namely [the proper administration of our website and business]] OR [the  performance of a contract between you and us and/or the taking steps, at  your request, to enter into such a contract] OR [[specify basis]].

2.6 We may process [information relating to our customer relationships, including customer contact information] ("customer relationship data").[  The customer relationship data may include [your name, your employer,  your job title or role, your contact details, and information contained  in communications between us and you or your employer].][ The source of  the customer relationship data is [you or your employer].] The customer  relationship data may be processed [for the purposes of managing our  relationships with customers, communicating with customers, keeping  records of those communications and promoting our products and services  to customers]. The legal basis for this processing is [consent] OR [our  legitimate interests, namely [the proper management of our customer  relationships]] OR [[specify basis]].

2.7  We may process [information relating to transactions, including  purchases of goods and/or services, that you enter into with us and/or  through our website] ("transaction data").[  The transaction data may include [your contact details, your card  details and the transaction details].][ The source of the transaction  data is [you and/or our payment services provider].] The transaction  data may be processed [for the purpose of supplying the purchased goods  and/or services and keeping proper records of those transactions]. The  legal basis for this processing is [the performance of a contract  between you and us and/or taking steps, at your request, to enter into  such a contract; providing that, if you are not the person contracting  with us, the legal basis for this processing is our legitimate  interests, namely [the proper administration of our website and  business]] OR [[specify basis]].

2.8  We may process [information that you provide to us for the purpose of  subscribing to our email notifications and/or newsletters] ("notification data").  The notification data may be processed [for the purposes of sending you  the relevant notifications and/or newsletters]. The legal basis for  this processing is [consent] OR [our legitimate interests, namely  [communications with our website visitors and customers]] OR [the  performance of a contract between you and us and/or taking steps, at  your request, to enter into such a contract] OR [[specify basis]].

2.9 We may process [information contained in or relating to any communication that you send to us] ("communication data").  The communication data may include [the communication content and  metadata associated with the communication].[ Our website will generate  the metadata associated with communications made using the website  contact forms.] The communication data may be processed [for the  purposes of communicating with you and record-keeping]. The legal basis  for this processing is [our legitimate interests, namely [communications  with our website visitors and customers and the proper administration  of our website and business]] OR [[specify basis]].

2.10 We may process [identify general category of data].[ This data may include [list specific items of data].][ The source of this data is [identify source].] This data may be processed for [specify purposes]. The legal basis for this processing is [consent] OR [our legitimate interests, namely [specify legitimate interests]] OR [the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract] OR [[specify basis]].

2.11  We may process [any of your personal data identified in this policy]  where necessary for [the establishment, exercise or defence of legal  claims, whether in court proceedings or in an administrative or  out-of-court procedure]. The legal basis for this processing is our  legitimate interests, namely [the protection and assertion of our legal  rights, your legal rights and the legal rights of others].

2.12  We may process [any of your personal data identified in this policy]  where necessary for [the purposes of obtaining or maintaining insurance  coverage, managing risks, or obtaining professional advice]. The legal  basis for this processing is our legitimate interests, namely [the  proper protection of our business against risks].

2.13  In addition to the specific purposes for which we may process your  personal data set out in this Section 2, we may also process [any of  your personal data] where such processing is necessary[ for compliance  with a legal obligation to which we are subject, or] in order to protect  your vital interests or the vital interests of another natural person.

3. Automated decision-making

3.1 We will use your personal data for the purposes of automated decision-making in relation to [specify automated decisions].

3.2 This automated decision-making will involve [provide meaningful information about the logic involved].

3.3 The significance and possible consequences of this automated decision-making are [specify significance and consequences].

4. Providing your personal data to others

4.1  We may disclose [your personal data] to any member of our group of  companies (this means our subsidiaries, our ultimate holding company and  all its subsidiaries) insofar as reasonably necessary for the purposes,  and on the legal bases, set out in this policy.[ Information about our  group of companies can be found at [URL].]

4.2  We may disclose [your personal data] to [our insurers and/or  professional advisers] insofar as reasonably necessary for the purposes  of [obtaining or maintaining insurance coverage, managing risks,  obtaining professional advice, or the establishment, exercise or defence  of legal claims, whether in court proceedings or in an administrative  or out-of-court procedure].

4.3 [Your personal data held in our website database] OR [[Identify personal data category or categories]] will be stored on the servers of our hosting services providers[ identified at [URL]].

4.4 We may disclose [specify personal data category or categories] to [our suppliers or subcontractors][ identified at [URL]] insofar as reasonably necessary for [specify purposes].

4.5 Financial transactions relating to [our website and services] [are] OR [may be] handled by our payment services providers, [identify PSPs].  We will share transaction data with our payment services providers only  to the extent necessary for the purposes of [processing your payments,  refunding such payments and dealing with complaints and queries relating  to such payments and refunds]. You can find information about the  payment services providers' privacy policies and practices at [URLs].

4.6  We may disclose [your enquiry data] to [one or more of those selected  third party suppliers of goods and services identified on our website]  for the purpose of [enabling them to contact you so that they can offer,  market and sell to you relevant goods and/or services].[ Each such  third party will act as a data controller in relation to the enquiry  data that we supply to it; and upon contacting you, each such third  party will supply to you a copy of its own privacy policy, which will  govern that third party's use of your personal data.]

4.7  In addition to the specific disclosures of personal data set out in  this Section 4, we may disclose your personal data where such disclosure  is necessary for compliance with a legal obligation to which we are  subject, or in order to protect your vital interests or the vital  interests of another natural person.[ We may also disclose your personal  data where such disclosure is necessary for the establishment, exercise  or defence of legal claims, whether in court proceedings or in an  administrative or out-of-court procedure.]

5. International transfers of your personal data

5.1  In this Section 5, we provide information about the circumstances in  which your personal data may be transferred to [countries outside the  European Economic Area (EEA)].

5.2 We[ and our other group companies] have [offices and facilities] in [specify countries].[  The European Commission has made an "adequacy decision" with respect to  [the data protection laws of each of these countries].][ Transfers to  [each of these countries] will be protected by appropriate safeguards,  namely [the use of standard data protection clauses adopted or approved  by the European Commission, a copy of which can be obtained from [source]] OR [the use of binding corporate rules, a copy of which you can obtain from [source]] OR [[specify appropriate safeguards and means to obtain a copy]].]

5.3 The hosting facilities for our website are situated in [specify countries].[  The European Commission has made an "adequacy decision" with respect to  [the data protection laws of each of these countries].][ Transfers to  [each of these countries] will be protected by appropriate safeguards,  namely [the use of standard data protection clauses adopted or approved  by the European Commission, a copy of which you can obtain from [source]] OR [[specify appropriate safeguards and means to obtain a copy]].]

5.4 [Specify category or categories of supplier or subcontractor] [is] OR [are] situated in [specify countries].[  The European Commission has made an "adequacy decision" with respect to  [the data protection laws of each of these countries].][ Transfers to  [each of these countries] will be protected by appropriate safeguards,  namely [the use of standard data protection clauses adopted or approved  by the European Commission, a copy of which can be obtained from [source]] OR [[specify appropriate safeguards and means to obtain a copy]].]

5.5  You acknowledge that [personal data that you submit for publication  through our website or services] may be available, via the internet,  around the world. We cannot prevent the use (or misuse) of such personal  data by others.

6. Retaining and deleting personal data

6.1  This Section 6 sets out our data retention policies and procedure,  which are designed to help ensure that we comply with our legal  obligations in relation to the retention and deletion of personal data.

6.2  Personal data that we process for any purpose or purposes shall not be  kept for longer than is necessary for that purpose or those purposes.

6.3 We will retain your personal data as follows:

(a) [usage data will be retained for a minimum period of [period] following the date of collection, and for a maximum period of [period] following that date];

(b) [account data will be retained for a minimum period of [period] following the date of closure of the relevant account, and for a maximum period of [period]following that date];

(c) [publication data will be retained for a minimum period of [period] following the date when the relevant publication ceases to be published  on our website or through our services, and for a maximum period of [period] following that date];

(d) [enquiry data will be retained for a minimum period of [period] following the date of the enquiry, and for a maximum period of [period] following that date];

(e) [customer relationship data will be retained for a minimum period of [period]following the termination of the relevant customer relationship, and for a maximum period of [period] following that date];

(f) [transaction data will be retained for a minimum period of [period] following the date of the transaction, and for a maximum period of [period] following that date];

(g) [notification data will be retained for a minimum period of [period] following the date that we are instructed to cease sending the notifications, and for a maximum period of [period] following that date (providing that we will retain notification data  insofar as necessary to fulfil any request you make to actively suppress  notifications)];

(h) [communication data will be retained for a minimum period of [period] following the date of the communication in question, and for a maximum period of [period]following that date]; and

(i) [[data category] will be retained for a minimum period of [period]following [date], and for a maximum period of [period] following [date]].

[additional list items]

6.4  In some cases it is not possible for us to specify in advance the  periods for which your personal data will be retained. In such cases, we  will determine the period of retention based on the following criteria:

(a) the period of retention of [personal data category] will be determined based on [specify criteria].

[additional list items]

6.5  Notwithstanding the other provisions of this Section 6, we may retain  your personal data where such retention is necessary for compliance with  a legal obligation to which we are subject, or in order to protect your  vital interests or the vital interests of another natural person.

7. Security of personal data

7.1  We will take appropriate technical and organisational precautions to  secure your personal data and to prevent the loss, misuse or alteration  of your personal data.

7.2 We will  store [all your personal data] on [secure servers, personal computers  and mobile devices, and in secure manual record-keeping systems].

7.3  The following personal data will be stored by us in encrypted form:  [your name, contact information, password(s) and cardholder data].

7.4  Data[ relating to [your enquiries and financial transactions]] that is  sent from your web browser to our web server, or from our web server to  your web browser, will be protected using encryption technology.

7.5  You acknowledge that the transmission of unencrypted (or inadequately  encrypted) data over the internet is inherently insecure, and we cannot  guarantee the security of data sent over the internet.

7.6  You should ensure that your password is not susceptible to being  guessed, whether by a person or a computer program. You are responsible  for keeping the password you use for accessing our website confidential  and we will not ask you for your password (except when you log in to our  website).

8. Your rights

8.1  In this Section 8, we have summarised the rights that you have under  data protection law. Some of the rights are complex, and not all of the  details have been included in our summaries. Accordingly, you should  read the relevant laws and guidance from the regulatory authorities for a  full explanation of these rights.

8.2 Your principal rights under data protection law are:

(a) the right to access - you can ask for copies of your personal data;

(b) the right to rectification - you can ask us to rectify inaccurate personal data and to complete incomplete personal data;

(c) the right to erasure - you can ask us to erase your personal data;

(d) the right to restrict processing - you can ask use to restrict the processing of your personal data;

(e) the right to object to processing - you can object to the processing of your personal data;

(f) the right to data portability - you can ask that we transfer your personal data to another organisation or to you;

(g) the right to complain to a supervisory authority - you can complain about our processing of your personal data; and

(h)  the right to withdraw consent - to the extent that the legal basis of  our processing of your personal data is consent, you can withdraw that  consent.