Smallworld IT - Privacy Statement and GDPR

Privacy Statement

This Privacy Statement is effective from 25th May 2018

1. Who is Smallworld IT (UK) Limited

1.1 Smallworld IT (UK) Limited (“Smallworld”) of 9 Highview, High Street, Bordon, Hampshire, GU35 0AX, United Kingdom is committed to protecting and respecting your privacy. For the purpose of applicable data protection legislation, the data controller of your personal information is Smallworld with whom you have contracted with and / or to whom you have granted consent.

2. What does this statement do?

2.1 Smallworld provides this privacy statement because you should feel confident about the privacy and security of your personal information. Smallworld takes all reasonable care to prevent any unauthorised access to your personal information.

2.2 When “personal information” is referred to in this privacy statement, it means information that relates to you in circumstances where you can be directly or indirectly identified. Smallworld may hold and use personal information about you in your capacity as a consumer, a business customer or as an individual when you visit its websites.

2.3 This privacy statement only applies to how Smallworld deals with your personal information. It does not apply to your use of services, products or websites made available to you by third parties, even if you access them via Smallworld. Please review the applicable privacy policies of such third parties to understand how they use your personal information.

3. What personal information does Smallworld collect from you and how does it get used?

3.1 Smallworld may collect and process the following personal information about you:

a. Personal information that you provide by filling in forms that Smallworld provides on various websites. This includes personal information provided at the time of subscribing to Smallworld’s services, posting material or requesting further services. Smallworld may also ask you for personal information when you report a problem with a Smallworld website.

b. This information is used to provide the services to you that you have requested, and which it has been agreed to provide to you. The lawful grounds for processing your personal information for this purpose is that the processing is necessary to deliver Smallworld’s services to you, it is necessary for the performance of a contract.

c. Smallworld also collects personal information about your use of its services (such as the amount of time you spend on a Smallworld website), which is used to manage the network, and for billing purposes. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

d. You may be asked from time to time about what use you make of the services that Smallworld provides, what other services you would like to be provided in the future, and other personal information, such as lifestyle data. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

e. Smallworld collects personal information about your use of the Smallworld websites and services for the purpose of improving the sites and to the services. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

f. Smallworld may also monitor and record communications with you, including e-mails and phone conversations which may then be used for training purposes, quality assurance, to record details about the products and services that you order, and in order to meet the legal and regulatory obligations generally. The lawful grounds for processing your personal information for training purposes and quality assurance purposes is that it is in Smallworld’s lawful and legitimate business interests to do so. The lawful grounds for processing your personal information, when your details are recorded about the products and services that you order, is that the processing is in Smallworld’s lawful and legitimate business interests.

g. Smallworld receives information about you from other telecommunications operators where you are also Smallworld’s customer. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

4. How else is your personal information used?

4.1 Marketing and Advertising

Smallworld may need your personal data to send you marketing materials which you may be interested in.

The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

Where appropriate, Smallworld strives to obtain your consent if it is intended to use your personal information for certain other marketing purposes.

(i) Where you have consented to Smallworld doing so, we may use personal information that you provide directly, which is collected about your use of the site and via services for marketing purposes, either alone or in combination with personal information that is received about you from third party companies and organisations. Where personal information about you is received from such third parties which Smallworld uses for marketing purposes, this is on the basis that such third parties have obtained your consent to such disclosure to, and for use by Smallworld.

(ii) Where you have consented to Smallworld doing so, Smallworld may also share your personal information about your use of its site and services with advertisers and other companies which offer their goods or services on Smallworld websites.

4.2 Credit checking and account management

a. When you order goods and services from Smallworld, enquiries may be made about you for credit reference purposes. These enquiries include searching your records held by a Credit Reference Agency (CRA) and checking any details held on you by Fraud Prevention Agencies (FPAs). When CRAs receive a search from Smallworld, they will place a footprint on your credit file that may be seen by other organisations. At all times where your personal information is disclosed to Smallworld, it will be protected in accordance with this privacy statement. This is done to help protect you from identity theft and fraud, and to prevent and detect crime and money laundering. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

b. Personal information on applications sent to CRAs and will be recorded by them. Smallworld may also give them details of your accounts and billing information, including how you manage it / them to the CRAs. Smallworld may tell them about payments you make, your account balances, and payment defaults. Smallworld may also give them historical information about your payment history. If you do not pay your bills on time, CR’s will record this information and it may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

5. Is your personal information shared with anyone else?

5.1 Smallworld sometimes uses other companies to provide the services that Smallworld has agreed to supply to you. To enable them to do this, your personal information may be required to be shared with them, either verbally or in written form. When this occurs, these companies are required to act in accordance with the instructions that Smallworld gives them and they must meet the requirements of applicable data protection legislation when processing your personal information. The lawful grounds for processing your personal information for these purposes is that the processing is in Smallworld’s lawful and legitimate business interests.

5.2 Smallworld may provide your personal information, in response to lawful requests, for the purposes of the prevention and detection of crime, and the apprehension or prosecution of offenders. Information may also be provided for the purpose of safeguarding national security. In either case, it is done in accordance with applicable data protection legislation. Your personal information will be provided to third parties when it is required by law: for example, under a court order, or in response to lawful demands, under powers contained in the governing legislation. The lawful grounds for processing your personal information for these purposes is because such processing is necessary for Smallworld to comply with its legal obligations as defined in the Data Protection Act 2018 Part 3.

6. For how long does Smallworld keep your personal information?

Unless there is a specific legal requirement to keep your personal information, it will be retained for no longer than is necessary for the purposes for which the data was collected or for which it is to be further processed.

7. How is your data protected when it is transferred outside the EEA?

Smallworld complies with the rules in applicable data protection legislation governing the transfer of your personal information from countries in the European Economic Area (EEA) to countries outside the EEA. Smallworld does sometimes transfer your personal information to a country outside the EEA but before doing so steps will be taken to ensure that your personal information is only transferred in accordance with applicable data protection legislation.

8. How is your personal information protected?

8.1 Smallworld is serious about keeping your personal information secure. Appropriate organisational and technical security measures are taken to protect your personal information against unauthorised disclosure or processing.

8.2 Where you have been given or you have chosen a password which enables you to access certain parts of a Smallworld website, you are responsible for keeping this password confidential. You are asked to not share such a password with anyone.

8.3 Various security measures are used to protect the information that Smallworld collects, as appropriate to the type of information. These measures include encryption, firewalls, and access controls. Smallworld company databases are accessible only by persons who have entered into and are bound by a confidentiality and nondisclosure agreements with Smallworld.

8.4 Unfortunately, the transmission of information via the internet is not completely secure. Although Smallworld will do its best to protect your personal data, the security of your information transmitted to our site cannot be guaranteed: any transmission is at your own risk. Once your information has been received, strict procedures and security features will be used to try to prevent unauthorised access.

9. How to access your personal information and your other rights?

9.1 You have the following rights in relation to the personal information that Smallworld holds about you:

a. Your right of access. Upon request, Smallworld will confirm whether it’s processing your personal information and, if so, provide you with a copy of that personal information (along with certain other details). If you require additional copies, a reasonable fee may be chargeable.

b. Your right to rectification. If the personal information held about you is inaccurate or incomplete, you’re entitled to have it rectified. If Smallworld has shared your personal information with others, it will let them know about the rectification where possible. If you ask, where it is possible and lawful to do so, you will be informed as to whom your personal information has been shared with so that you can contact them directly.

c. Your right to erasure. You can ask to have your personal information deleted or removed in some circumstances such as where it is no longer needed or where you withdraw your consent (where applicable). If your personal information has been shared with others, Smallworld will let them know about the erasure where possible. If you ask, where it is possible and lawful to do so, Smallworld will also tell you who your personal information has been shared with so that you can contact them directly.

d. Your right to restrict processing. You can ask to have the processing of your personal information ‘blocked’ or suppressed in certain circumstances such as where you contest the accuracy of that personal information or object to it being processed. It won’t stop your personal information from being stored though. Smallworld will tell you before any restriction is lifted. If we’ve shared your personal information with others, we’ll let them know about the restriction where possible. If you ask, where it is possible and lawful to do so, Smallworld will also tell you who your personal information has been shared with so that you can contact them directly.

e. Your right to data portability. You have the right, in certain circumstances, to obtain personal information you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or ask for it to be transferred to a third party of your choice.

f. Your right to object. You can ask Smallworld to stop processing your personal information, and this will occur if Smallworld is:

relying on its own or someone else’s legitimate interests to process your personal information except if Smallworld can demonstrate compelling legal grounds for the processing;

processing your personal information for direct marketing; or

processing your personal information for research unless such processing is necessary for the performance of a task carried out in the public interest.

g. Your rights in relation to automated decision-making and profiling. You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, and it produces a legal effect, or it similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and Smallworld.

h. Your right to withdraw consent. If Smallworld relies upon your consent as the legal basis for processing your personal information, you have the right to withdraw that consent at any time.

i. Your right to lodge a complaint with the supervisory authority. If you have a concern about any aspect of Smallworld’s privacy practices, including the way that your personal information has been handled, you can report it to the UK Information Commissioner’s Office (ICO). You can find details about how to do this on the ICO website at https://ico.org.uk/ or by calling the ICO helpline on 0303 123 1113.

10. Changes to Smallworld’s privacy statement

Any changes Smallworld may make to the privacy statement in the future will be posted on this page and, where appropriate, you may be notified by e-mail.

11. When does Smallworld use cookies?

11.1 Smallworld may collect information about your computer, including where available your IP address, operating system and browser type, for system administration and to report aggregate information to advertisers. This is statistical data about users’ browsing actions and patterns and does not identify any individual.

11.2 Cookies cannot be executed as code or used to deliver a virus. Cookies help to improve websites and to deliver a better and more personalised service. Cookies enable Smallworld:

a. To estimate its audience size and usage pattern

b. To store information about your preferences, and so allow the site to be customised according to your individual interests;

c. To speed up your searches;

d. To recognise you when you return to the site.

12. What type of cookies does Smallworld use?

12.1 Two types of cookies may be used on Smallworld websites: session cookies, which are temporary cookies that remain in the cookie file of your browser until you leave the site, and persistent cookies, which remain in the cookie file of your browser for much longer (though how long will depend on the lifetime of the specific cookie and your browser preferences).

12.2 Smallworld may use a third party to serve advertisements on its websites. Cookies may be associated with these advertisements to enable the advertiser to track the number of anonymous users responding to the campaign. Smallworld does not have access to, or control of, cookies placed by third parties.

12.3 Third party internet sites that you can link to from Smallworld’s websites are not covered by this privacy statement, so you are urged to be careful when you enter any personal information online. Smallworld accepts no responsibility or liability for your interactions with these sites.

12.4 Other companies which advertise or offer their products or services on Smallworld’s websites may also allocate cookies to your PC. The types of cookies they use and how they use the information generated by them will be governed by their own privacy policies and statements and not Smallworld’s.

12.5 You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of Smallworld’s websites. Unless you have adjusted your browser setting so that it will refuse cookies, they will be issued when you visit Smallworld’s websites.

13. Contact

Questions, comments and requests regarding this privacy statement are welcomed and should be addressed in writing to:

The Data Protection Officer, Smallworld IT, 9 Highview, High Street, Bordon, Hampshire, GU35 0AX, United Kingdom

or by email at dataprotection @ smallworld.com.