Privacy Notice

ECCTIS Ltd is a limited company registered in England with company number 2405026.

Our address is:

ECCTIS Ltd
Suffolk House
68-70 Suffolk Road
Cheltenham
Gloucestershire
GL50 2ED
UNITED KINGDOM

ECCTIS Ltd may operate as the controller of your data, or we may process your data on behalf of another controller. For more information on our role, please see the service specific information below, but generally the following applies:

We act as the controller of your personal data when you contact us regarding, or apply for, our individual services, including:

Statement of Comparability
English Language Assessment
Career Path Report
Statement of Comparability for Construction Skills
Early Years Service
UK Qualification Reference Statement

The exception to this rule is the Visas and Nationality Service. For this service, we operate as a processor on behalf of the Home Office, who tell us what to do with your data, and how. Please see the service specific information below for more detailed information.

Where we offer services to organisations, we may process information a) submitted directly to us by you in your capacity as an organisation representative, or b) submitted by your employer to allow you to access our services. In these circumstances we usually operate as a processor, with your employer being the Controller. Where this is not the case, we will let you know in the service specific information below.

Data Protection Officer’s contact details

Our Data Protection Officer is Frazer Wallace. You can contact him at dpo@ecctis.co.uk or via our postal address. Please mark postal communication with ‘Data Protection Officer’

How do we get your information?

Most of the personal information that we process is provided for one of the following reasons:

You have enquired about, and/or applied for, one of our services for individuals.
You or your employer has subscribed to one of our services for organisations and either you, or your employer, has submitted your data to us to allow you to access or make use of those services.
An organisation has submitted an application for one of our services for individuals on your behalf.

Where we do not receive information from you directly, we will endeavour to contact you to let you know we are processing your data unless to do so would be:

Prejudicial e.g. to law enforcement or national security.

Your data protection rights

Under data protection law, you have the following rights. These rights may or may not be applicable or available to you depending on our reasons for processing your information:

The right to be informed about our collection and use of personal data – this Privacy Notice is our way of complying with this.
The right of access – you have the right to ask us for copies of the information that we hold about you.
The right to rectification if any of the information we hold about you is inaccurate or incomplete.
The right to erasure – you can ask us to delete your information in certain circumstances.
The right to restrict (prevent) processing of your information in certain circumstances.
The right to object to us using your information for particular purposes e.g. direct marketing.
The right to data portability, in which case where appropriate, and technically feasible, we will provide your information in a commonly used, machine readable format.
Rights related to automated decision making and profiling – though please note that ECCTIS Ltd does not perform any automated decision making or profiling.

To make a request related to any of these rights, please contact the Data Protection Officer, or one of our customer services team. We will respond within one month.

Complaints

If you have any cause for complaint about our use of your personal data, please contact us using the details above and we will do our best to help.

Should you remain dissatisfied, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.

Children’s information

We do not provide services directly to children, nor do we proactively collect children’s personal information. Anyone applying for our services must be over 16 years of age.

Changes to our Privacy Notice

We may change this Privacy Notice from time to time (for example if the law changes, or our services change). Any changes will be immediately posted on our website, and changes will be deemed accepted each time you use our services.

Business transfers

Should there be a sale and/or transfer of control of all or part of our business, any personal data that we hold will, where it is relevant to any part of the business that is being transferred, be transferred along with that part of the business.

The new owner or newly controlling party will be permitted to use that data for the same purposes as those for which it was originally collected.

Sharing your information

We may need to share your personal data with third parties in order to deliver a service to you. This might be for the following general reasons:

Data processors who provide part of our IT infrastructure. This may include, for example, off-site back-up providers, telephone recording, web, WebChat and email servers.
Data processors who perform elements of our services for us. These will usually depend on the service you have applied for and more information can be found in the service specific information provided below.
Other third parties with whom we are required to share the information in order to deliver the service. Examples include organisations that issued your qualifications, or UK Government departments. Where this is the case, we will provide more information in the service specific information.
Organisations to whom a Statement has been disclosed by you if they wish to confirm its authenticity – for more information see the section below entitled “Confirming the content of a statement to a third party”.
Where we are obliged to share your data by law, for example where we are involved in legal proceedings, or where we are complying with legal requirements, a court order, or the orders of a government authority.

Where the party is a processor (points 1 & 2 above), we will have a contract in place with them to ensure that they cannot do anything with your personal data unless we have instructed them to do so. They will not share your data with anyone else unless we give them permission to do so. We will only give permission if we are satisfied that the sub-processors will also comply with our instructions.

We will not share your information with any third parties for the purposes of direct marketing.

Service specific information

Services for Individuals:

The following information relates to current services and applies where you apply directly to us via our website, or by post:

Statement of Comparability (Including Fast Track services and Translation Waiver)

Our role	We are the controller of your information where you apply to us directly.
Purpose and Lawful Basis for Processing	We process your personal data for the purposes of delivering the service to you, including communicating with you. We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you – it is necessary for the performance of a contract that we have with you. We retain your personal data for a period of time following delivery of the service, and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so. This is because it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.
What information we need, and why we need it	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application. We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and to optimise our services for your needs. We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.
What we do with it	Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.
How long we keep it	We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period. Scanned documents submitted in support of applications are deleted within 12 months of either the service being completed, or the last action on an account. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with	We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.

Industry Skills Statement with Skills Mapping / Industry Skills Statement for Academically Qualified Persons

Our role	We are the controller of your information where you apply to us directly.
Purpose and Lawful Basis for Processing	We process your personal data for the purposes of delivering the service to you, including communicating with you. We also process your personal data for the purposes of verifying that the qualification information you provided us with is accurate. We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you – it is necessary for the performance of a contract that we have with you. We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.
What information we need and why we need it	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, confirm the accuracy of information provided by you, and communicate with you regarding your application. We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and to optimise our services for your needs. We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.
What we do with it	Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you. It is also used to check that qualification information provided by you is accurate, and that you hold the qualifications submitted to us for comparison.
How long we keep it	We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period. Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with, and international transfers	We share your information with third parties mentioned in the section “Sharing your Information” above. We also share your personal data with the qualification issuing body that issued your qualification in order to confirm that the information provided is accurate. This may be done directly by us, but often we use a third party “Primary Source Verification” provider. Currently we use Qualification Check. You can review their privacy notice at https://www.qualificationcheck.com/gdpr/. You should note that minimal information will be transferred outside of the UK. Where an adequacy decision exists with the country of transfer, we will rely on this when making the transfer (Article 45 of the GDPR). Otherwise we will rely on Article 49(1)(b) of the GDPR, which allows the transfer if it is necessary for the performance of a contract with you. The qualification issuing body will be a Controller of your information in their own right, and you will be asked to complete a “Letter of Authorisation” instructing them to provide us with the information necessary to confirm the accuracy of your qualification information.

UK Qualification Reference Statement

Our role	We are the controller of your information where you apply to us directly.
Purpose and Lawful Basis for Processing	We process your personal data for the purposes of delivering the service to you, including communicating with you. We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you – it is necessary for the performance of a contract that we have with you. We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.
What information we need, and why we need it	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application. We collect and process information relating to your qualifications (including copies of documentation) in order to provide the requested service to you.
What we do with it	Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.
How long we keep it	We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period. Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with	We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.

Visas and Nationality Service

Our role	We act as a processor of your personal data. The Controller of your information is the Home Office. We act only on the instructions of the Home Office and your information is shared between the Home Office and us. There is a contract between the Home Office and us, which governs the agreement.
Purpose and Lawful Basis for Processing	These are determined by the Home Office – you should refer to their privacy notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice
What information we need and why we need it	This is determined by the Home Office, but it includes: Information including your name, contact details, date of birth and nationality in order to deliver the service to you, identify you, and communicate with you regarding your application. We collect and process information relating to your qualifications (including copies of documentation) in order to provide the requested services to you on behalf of the Home Office.
What we do with it	This is determined by the Home Office – please refer to their Privacy Notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice
How long we keep it	This is determined by the Home Office and is up to 25 years from completion of the service. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with	This is determined by the Home Office. Please refer to their Privacy Notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice

VETASSESS

Our role	We are joint controllers with VETASSESS. This means that we are jointly responsible for why and how we process your personal data.
Purpose and Lawful Basis for Processing	We collect and process your information on behalf of VETASSESS in order to help you to apply for their services and to respond to any queries you might have in relation to ongoing services being delivered to you by them. We also undertake checks with your UK employers or prior employers on behalf of VETASSESS. We rely on Article 6(1)(f) of the GDPR as the lawful basis for providing these services, since it is the interests of you, us, and VETASSESS to provide this service to you.
What information we need and why we need it	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application. We may also process information relating to your qualifications and/or employment history in order to deliver services and undertake employment checks.
What we do with it	Your information is accessed from VETASSESS servers and used by staff to communicate with you, identify you from other applicants, respond to enquiries and deliver services on behalf of VETASSESS.
How long we keep it	No information is stored by us. All data is stored on VETASSESS servers. VETASSESS determine how long they store your information for.
Who we share it with	All data can be jointly accessed via VETASSESS servers based in Australia. We have a contract with VETASSESS that governs this relationship and we rely on Standard EU Contractual Clauses to ensure transfers outside of the UK meet the requirements of data protection laws. You can find the VETASSESS Privacy Notice here: https://www.vetassess.com.au/privacy

The following information (6, 7 and 8) relates to historical, discontinued services (which we no longer offer) and applies where you applied directly to us via our website, or by post:

English Language Assessment

Our role	We are the controller of your information where you applied to us directly.
Purpose and Lawful Basis for Processing	We process your personal data for the purposes of delivering the service to you, including communicating with you. We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you – it is necessary for the performance of a contract that we have with you. We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.
What information we need and why we need it	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application. We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and optimising our services for your needs. We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.
What we do with it	Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.
How long we keep it	We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period. Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with	We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.

Career Path Report

Our role	We are the controller of your information where you apply to us directly.
Purpose and Lawful Basis for Processing	We process your personal data for the purposes of delivering the service to you, including communicating with you. We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you – it is necessary for the performance of a contract that we have with you. We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary.
What information we need and why we need it	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application. We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and optimising our services for your needs. We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.
What we do with it	Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.
How long we keep it	We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period. Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with	We do not share your information with third parties except those mentioned in the section “Sharing your Information” above.

Early Years Service

Our role	We are the controller of your information where you apply to us directly. A limited amount of data will be shared with the Department for Education, who will be joint controllers of that data.
Purpose and Lawful Basis for Processing	We process your personal data for the purposes of delivering the service to you, including communicating with you. We rely on Article 6(1)(b) of the GDPR as the lawful basis for delivering the service to you – it is necessary for the performance of a contract that we have with you. We retain your personal data for a period of time following delivery of the service and we rely on Article 6(1)(f) of the GDPR as the lawful basis for doing so, since it is the interests of you, us, and the general public to be able to re-issue statements and/or confirm the contents of our statements if necessary. We share limited information with the Department for Education in order to confirm the contents of a Statement presented to them. We also rely on Article 6(1)(f) for this purpose in that it is the interests of you, us, the Department for Education and the general public for the information to be shared for this purpose.
What information we need	We collect and process information including your name, contact details, date of birth in order to deliver the service to you, identify you, and communicate with you regarding your application. We collect and process information relating to the reasons for your application (including refugee status) in order to ensure we are delivering the correct service to you and optimising our services for your needs. We collect and process information relating to your qualifications (including copies of documentation) in order to provide requested comparison services to you.
What we do with it	Your information is collected, stored, and used by staff to communicate with you, identify you from other applicants, and deliver our services to you.
How long we keep it	We keep your personal data for as long as we need it. For completed applications, this is usually for a period of 25 years. This allows us to confirm the contents of statements should you seek to rely on it within this time period. Scanned documents submitted to support applications are deleted within 12 months of either the service being completed, or the last action on an account. We actively discourage applicants sending original paper documentation to support their application as it is unnecessary. Paper documentation will be confidentially destroyed within a maximum of 12 months from completion of the service or the last action on an account.
Who we share it with	We share your information with third parties mentioned in the section “Sharing your Information” above. We also share your personal data with the Department for education for the purposes of verifying the content of the Statement. We share the minimum information necessary do this.

Confirming the content of a statement to a third party

On occasion we will be asked to confirm that a Statement issued by us is genuine, and/or accurate. This might be, for example, where you have presented your statement to a third party whom you wish to be able to rely on the contents.

Where we are asked to do so, we will confirm whether or not the statement was issued, and whether or not the information contained in the statement is accurate.

Our role	We will be the controller of the data
Purpose and Lawful Basis for Processing	We will confirm whether or not information provided to us matches our records. We will never volunteer any personal data to anyone. The lawful basis that we will rely upon in this instance will be Article 6(1)(f) of the GDPR since it is in the interests of us, you, and the general public for statements to be able to be relied upon and checked for accuracy.
What information we need and why we need it	No further information will be collected.
What we do with it	N/A
How long we keep it	N/A
Who we share it with	We will confirm with the enquirer whether or not information matches our records.

Communications regarding a service or general enquiry

We may communicate with you in relation to general enquiries, or in relation to applications for our using the following electronic communication methods:

Telephone

When you call our mail helpline we will:

Collect Calling Line Identification (CLI) information – this is the phone number you are calling from. This is to help us to identify you, to understand demand for our services, improve how we operate, and call you back if we need to. We keep this information for a maximum of 6 months before being permanently deleted
Record the audio of your telephone conversation. This is for training purposes, in order to improve the way in which our staff deal with enquiries and complaints. We rely on Article 6(1)(f) of the GDPR since it is in the interests of us, you, and the general public for our staff to provide training and improve the way in which our enquiries are managed. Recordings are kept for a maximum of 6 months before being permanently deleted.

Live Chat

We offer the LiveChat facility as an alternative to telephoning us to:

Get general information about our services
Discuss an application you may have submitted to us (whether live or historical).

We use a third-party provider, Click4Assistance, to supply and support our live chat service. The following relates to the use of LiveChat:

Our role	It depends on the purpose of your enquiry: · If it is a general enquiry, then we will be the controller of your personal data. · If you are contacting us about an existing application for our services, then we will usually be the controller, unless we act as a processor for the service you have applied for.
Purpose and Lawful Basis for Processing	We will process your information for the purpose of dealing with your enquiry, whatever that may be. Usually this will fall into two categories: · A general enquiry about our services, or; · An enquiry relating to an existing application you have with us. The lawful basis that we will rely upon will depend on the reason for your enquiry: · For general enquiries we will rely on Article 6(1)(f) of the GDPR since it is in the interests of us and you to process such data as is necessary to deal with your enquiry. · Where you are enquiring about an existing application, we will rely upon the legal basis relevant to the processing of that application. You should check the section of this document relevant to the service, but usually this will be Article 6(1)(b) of the GDPR - that we need to process the information to provide the service to you.
What information we need and why we need it	We will collect sufficient information to allow us to deal with your enquiry. · For general enquiries, we may not need to collect any information that identifies you, though you should be aware that the software we use may collect information to identify your general location information (for statistical purposes) such as your IP address. A transcript of the conversation will also be recorded. · For enquiries relating to an existing application, we may process any information relevant to your application and/or enquiry. For more information on what this may include, please see the information provided in this document that is relevant to the service you have applied for.
What we do with it	We will use the information to answer your enquiry and may record details of the enquiry on your file for future reference.
How long we keep it	Transcripts are kept for a maximum of 3 months before being permanently deleted. Where enquiries relate to an existing enquiry, the transcript, or parts of it, may be transferred onto the permanent file associated with your application, and kept for the retention periods relevant to that service.
Who we share it with	Our LiveChat provider is Click4Assistance. Data is held on servers based in the European Union. Their privacy notice can be found here: https://www.click4assistance.co.uk/click4assistance-web-chat-software-cookie-policy

Marketing Emails to the general public

We will not send marketing communications to individuals unless we have consent to do so. You may be asked to opt-in to marketing emails.

We will not share your email address or any other personal information with any third party for the purposes of direct marketing save as mentioned in the table below.

Where we do send you marketing emails, you can withdraw your consent at any time. There will be a link in any marketing communications we send that will to allow you to do so easily.

The following relates to our direct email marketing activities:

Our role	We will be the controller of the data
Purpose and Lawful Basis for Processing	We may send marketing emails relating to services that might be useful for you. The lawful basis that we will rely upon in this instance will be Article 6(1)(a) of the GDPR since you will have consented to our sending you marketing emails either by opting in via our website or in some other way, such as at an event.
What information we need and why we need it	Ordinarily we will already have collected your data, since you will have applied for one of our services. Alternatively, you may have volunteered your email address in some other way, for example at an event.
What we do with it	We will use your email address to send you marketing emails relating to our services.
How long we keep it	Where you have applied for a service previously, we will keep your information for retention period relevant to that service. Otherwise we will keep your details for no longer than we feel necessary. This will not exceed 1 year.
Who we share it with	We share your information with third parties mentioned in the section “Sharing your Information” above. We may also use a third-party online marketing platform to manage our marketing emails, specifically MailChimp. Their privacy notice can be found here: https://mailchimp.com/legal/privacy/ Since Mailchimp are based in the United States of America (USA), your data may be transferred out of the UK and European Union to the USA, however Appropriate safeguards are in place to ensure this is done in compliance with privacy laws, specifically through the use of the European Commission’s standard EU Contractual Clauses.

Surveys

We may send communications to individuals containing satisfaction surveys. We only do this in order to ascertain satisfaction levels with a view to improving our services.

Where we send out surveys, we do not rely on your consent, but we do not want to send these emails if you do not wish us to. We There will be a link in any survey communications we send that will to allow you to opt out of them easily.

The following relates to our satisfaction survey communications and activities:

Our role	We will be the controller of the data
Purpose and Lawful Basis for Processing	We may send survey emails relating to services that you have utilised, in order that we can ascertain levels of satisfaction and improve our services. The lawful basis that we will rely upon in this instance will be Article 6(1)(f) of the GDPR in that we have a legitimate interest in getting your feedback so that we can improve our services.
What information we need and why we need it	We will already have collected your data, since you will have applied for one of our services.
What we do with it	We will use your email address to send you satisfaction surveys relating to our services.
How long we keep it	Where you have applied for a service previously, we will keep your information for the retention period relevant to that service.
Who we share it with	We share your information with third parties mentioned in the section “Sharing your Information” above. We may also use a third-party online marketing platform to manage our marketing emails, specifically MailChimp. Their privacy notice can be found here: https://mailchimp.com/legal/privacy/ Since Mailchimp are based in the United States of America (USA), your data may be transferred out of the UK and European Union to the USA, however appropriate safeguards are in place to ensure this is done in compliance with privacy laws, specifically through the use of the European Commission’s Standard EU Contractual Clauses. We may also use a third-party survey software provider called SurveyMonkey to manage surveys. Their privacy notice can be found here: https://www.surveymonkey.co.uk/mp/legal/privacy/ Since SurveyMonkey are based in the United States of America (USA), your data may be transferred out of the UK and European Union to the USA, however Appropriate safeguards are in place to ensure this is done in compliance with privacy laws, specifically through the use of the European Commission’s Standard EU Contractual Clauses.

Restricting Contact

We may impose a restriction on your access to our services if it is necessary to protect our staff from unacceptable behaviour. The restriction will be recorded on your file.

The lawful basis we will rely upon when doing this is Article 6(1)(f) of the GDPR since we have a legitimate interest in protecting our staff from abusive behaviour.

Before we take such action, we will contact you to explain why we have done so, and why it is necessary.

Card Payment Details

When you make a payment for one of our services, whether on the website or over the telephone, this is done using an independent third-party card processing company, WorldPay. We do not have access to your banking or payment card information.

This privacy notice does not cover how WorldPay processes personal information. We encourage you to read their privacy notice which can be found here: https://www.fisglobal.com/en-gb/privacy.

We do not encourage you to send payment card details to us in any format. Any payment card details received by us will be destroyed immediately.

Where you provide payment card information to us over the telephone, staff are trained to switch off any telephone recording software or equipment. We do not record the information in any other way.

Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes your personal information. We encourage you to read the privacy notices on the other websites you visit.