Privacy Policy

Privacy Policy for Iscaware Ltd

1. Introduction

• 1.1. This document applies to clients (you/your) of Iscaware Ltd (we/our), a company registered in England and Wales (registration number 1418882). Our registered office is located at Orchard House, Clyst St Mary, Exeter EX5 1BR.
• 1.2. We are committed to the principles of privacy by design and compliance with the General Data Protection Regulation and Data Protection Act 2018.
• 1.3. This privacy policy provides detailed information on our information security policies.

2. How we get your information

• 2.1. We only collect information that you voluntarily give us or that is publicly available. This includes information that you may provide when:
• 2.1.1. Creating an account with us to access one of our products or services.
• 2.1.2. Communicating with us via telephone, email, post, or other communication method.
• 2.1.3. Using our products or services on a day-to-day basis.

3. Why we process your information

• 3.1. It is mutually beneficial to us and you, because it allows us to:
• 3.1.1. Provide you with products and services that you wish to use.
• 3.1.2. communicate with you effectively.
• 3.2. We rely on the following legal bases for processing your data:
• 3.2.1. You gave us your consent to process it.
• 3.2.2. We have legitimate interests to process it.
• 3.2.3. It is necessary for the fulfilment of a contract.
• 3.2.4. In order to take steps to entering into a contract.

4. What we do with your information

• 4.1. We may use your information for the following purposes:
• 4.1.1. To create, maintain, and administer our own login account that controls and gives access to your overall organisation and its users.
• 4.1.2. To create, maintain, and administer user accounts under your organisation’s account.
• 4.1.3. To provide software support, troubleshoot reported issues, or monitor our system's performance.
• 4.1.4. To contact you with transactional or other general information about your account.
• 4.1.5. To process payments and other accounting-related tasks.
• 4.1.6. To respond to enquiries that you have sent to us.
• 4.1.7. To contact you with marketing materials, unless you have asked us not to.
• 4.1.8. To contact you for any other legitimate reason.

5. How we store your information

• 5.1. We take all appropriate measures to ensure that physical and digital data remains safe and accessible to authorised persons.
• 5.2. We set suitable access controls and policies, so that only those who have a valid reason to view personal information can view it.
• 5.3. We maintain a detailed list of our mitigation measures for known web-based vulnerabilities, which forms the basis of all our web software's security.
• 5.4. We limit the usage of third-party software providers, except where strictly necessary for performance or functionality reasons.
• 5.5. We may share your information in a controlled way with trusted software partners, and if so:
• 5.5.1. We will not give permission for any shared information to be processed outside the bounds of our own policies.
• 5.5.2. We will not give permission for any shared information to be processed for reasons beyond your relationship with us.
• 5.6. Other than trusted software partners, your information is not shared with anyone else.
• 5.7. Access to data stored on physical media (paperwork, hard drives, etc.) is strictly controlled to minimise the risk of loss or theft.
• 5.8. Information sharing policies may cease to apply where there is a legal obligation (or another overriding legitimate reason) to share such data.

6. How long we keep your information

• 6.1. As a general rule, as long as you remain our client, any personal information you provide to us will be kept for the duration of our relationship.
• 6.2. Notwithstanding 6.1, your personal information will not necessarily automatically be deleted if our relationship ceases.
• 6.3. Unless by law we are required to keep your data for longer, we will not keep any personal data for longer than is necessary given the purposes for which we collected and use that information.

7. What rights you have

• 7.1. You should expect transparency and honesty about how your data is collected, stored, and used. You have a legal right to be informed about this, and our privacy policy covers this right.
• 7.2. We will verify the identity of the individual exercising any of the rights below appropriately before we take any further action.
• 7.3. You have the right to ACCESS:
• 7.3.1. You can ask for copies of personal information that we hold about you.
• 7.3.2. If we receive any such request, we will:
• 7.3.2.1. Respond without undue delay (at most 1 month, or 2 months if you make multiple or complex requests).
• 7.3.2.2. Use all reasonable efforts to search for the information requested.
• 7.3.2.3. Provide the information in a concise, intelligible format.
• 7.3.2.4. Send the information in a secure manner.
• 7.3.2.5. Not charge a fee, except where the request is unfounded, excessive, or a duplication of a previously granted request.
• 7.4. You have the right to CORRECTION:
• 7.4.1. You should expect that information we hold about you is correct and complete. Where personal information that we hold about you is concerned, you can ask us to correct errors or complete missing information.
• 7.4.2. If we receive any such request, we will:
• 7.4.2.1. Consider whether the request for information to be corrected or completed is justified.
• 7.4.2.2. Bear in mind that, even if the information was accurate when we first collected it, we are obliged to reconsider its accuracy.
• 7.4.2.3. Correct or complete the information without delay if necessary.
• 7.5. You have the right to DELETION:
• 7.5.1. You can ask us to delete personal information that we hold about you if:
• 7.5.1.1. There is no real reason for us to hold onto it.
• 7.5.1.2. It would be against the law for us to keep it without your consent and you withdraw your consent.
• 7.5.1.3. We are only holding the information for direct marketing purposes and you object to this.
• 7.5.1.4. We have processed the information unlawfully.
• 7.5.1.5. It must be deleted to comply with a legal obligation.
• 7.5.2. There are some situations where we do not have to delete your information. This would be the case if the information is needed to:
• 7.5.2.1. Exercise the freedom of expression or information.
• 7.5.2.2. Comply with a legal obligation.
• 7.5.2.3. Carry out a task that is in the public's interest.
• 7.5.2.4. Establish, exercise, or defend legal claims.
• 7.5.3. If we receive any such request, we will:
• 7.5.3.1. Check that you have the right to have your information deleted, and if so:
• 7.5.3.1.1. Use all reasonable efforts to delete all copies of the information, including from back-ups.
• 7.5.3.1.2. Fully anonymise the data (instead of deleting it) where we need it for statistical reasons.
• 7.6. You have the right to RESTRICTION:
• 7.6.1. In certain situations, you can ask us to limit the ways in which we process your data. This restriction is usually temporary and is an alternative to deleting your data. You need to have a valid reason for requesting this, which can be one of the following:
• 7.6.1.1. You think the information we hold about you is somehow incorrect, and you want to check it.
• 7.6.1.2. We have processed your information unlawfully, but you don't want it to be deleted.
• 7.6.1.3. We no longer need to the data, but it needs to be kept to establish, exercise, or defend a legal claim.
• 7.6.1.4. You have objected to us processing your data, but we are still considering whether we do have a legitimate reason to process it.
• 7.6.2. If there is a genuine reason for restricting processing, then we can:
• 7.6.2.1. Temporarily move the information out of one system into another.
• 7.6.2.2. Make the information unavailable to certain users.
• 7.6.2.3. Temporarily remove any information that is publicly available.
• 7.6.3. In any case, we will not process the information in any way beyond storing it, except if:
• 7.6.3.1. You allow us to.
• 7.6.3.2. It is necessary to establish, exercise, or defend legal claims.
• 7.6.3.3. It is necessary to protect the rights of another person.
• 7.6.3.4. It is in the public's interest to do so.
• 7.6.4. No charge shall be associated with restriction. We will inform you before the restriction on processing is lifted.
• 7.7. You have the right to PORTABILITY:
• 7.7.1. Upon request, we will provide the personal information that you have given us in a commonly used format that can be read by a computer. This may consist of multiple computer files.
• 7.8. You have the right to OBJECTION:
• 7.8.1. You can ask us to stop processing your personal information if we are only holding the information for direct marketing purposes and you object to this.
• 7.8.2. We will either restrict processing of your information or delete it entirely, depending on your wishes. No charge will be associated with this.

8. How to make a complaint

• 8.1. If you have a complaint about how we are using your personal information, then please contact us in the first instance by writing to our registered office address (see 1.1).
• 8.2. If you are still unhappy, then you can complain to the Information Commissioner’s Office, which is located at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.

Published: 17th September, 2022.