This Privacy Notice sets out when and how we use your Personal Data that you or others provide to us, including through https://holray.co.uk/ (the “Website”) and/or the Holray booking platform (the “System”). We want to make sure you fully understand the terms and conditions surrounding the capture and use of that information.
This Privacy Notice describes what information we collect about you, how we use it, and the rights you have in relation to that collection and usage.
If you have any questions about this Privacy Notice, please contact email@example.com.
HOLRAY SYSTEMS LIMITED is a company incorporated and registered in England and Wales with company number 03237283 and with its registered office at Evolution House Iceni Court, Delft Way, Norwich, Norfolk, England, NR6 6BB (referred to as “Holray” / “we” / “us”).
For the purposes of the Data Protection Act 2018, the UK General Data Protection Regulations and any other applicable data protection and privacy laws and regulations (“Data Protection Legislation”), Holray will be the ‘data controller’ for all Personal Data that we determine the means and purpose of processing for, and we have registered with the Information Commissioner’s Office under registration number: ZA232427.
By “Personal Data” we refer to information collected or held by Holray that identifies and relates to you as an individual.
INFORMATION WE MAY COLLECT
We will be required to collect Personal Data about you in the following circumstances.
When you use our Services and the System
When you become a Holray client, we will collect the information required to set up an account including your name, email address, telephone number, business address, your role within the business that contracts Holray and any additional information we need to identify what services you will require from us.
We collect transactional information informing us of the services you have purchased from Holray and we will also need to collect payment and invoice information to collect fees for our services.
We may collect additional information you volunteer to us when calling our support staff regarding any elements of our service. We will only retain the personal information pertinent to delivering your services.
We require of all this information to process the contract you have us asked to perform for you.
Our clients may populate the System with end-users’ personal data and we do not have control over this. We process this information solely as a data processor and our clients’ own Privacy Notices will govern the use of such end-users’ personal data.
When you contact us / submit feedback
When you contact us through our Website or submit feedback via our Website, we collect your name and email address so that we can reply to you. By submitting feedback, you are providing your consent for us to contact you in relation to your message.
When you visit our Website and/or the System
We may also collect technical information about you when you visit the Website and/or the System. This information may include the Internet protocol (IP) address used to connect your computer to the Internet, your browser type and version, time zone setting, operating system and platform, browser plug-in types and version, the full URL clickstream to, through and from the Website / the System, page response times, download errors, length of visits to certain pages, page interaction (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page.
The collected information is used to provide an overview of how people are accessing and using the Website and/or the System. It is not used for any additional purpose, such as to profile those who access the Website and/or the System.
When you phone us
When you phone us, we may also handle your personal information (your name, contact details and the other details you provide to us during the call) in order to service your enquiry or provide the customer services you have asked us to perform.
If you apply to join us, become a member of our staff or provide services to Holray
If you apply for a role with us, we may receive personal information directly from you or via a third party (such as a recruitment specialist) which we will only use for the purposes of helping you progress your application. This information will usually include your name and contact details, CV and job history information, your qualifications, information regarding your suitability for the role (such as work eligibility and DBS status) and potentially third party references regarding your previous experience.
We have to collect personal information from and on behalf of our staff to enable us to provide them with adequate employment conditions and payment for their services. This information will always include the application information (listed above) as well as payment and tax information (bank account and NI number), next of kin details, work performance (development reviews, achievements) and HR information (absence records, relevant health/sickness information).
We collect personal information from our providers to ensure they meet our criteria for fitness to work with our clients (such as qualifications and professional experience) as well as invoice details to allow us to pay you for your services to Holray.
We will process this information under the lawful basis of requirement to perform the terms of your employment contract or service the agreement between yourself and Holray. If we are collecting sensitive information from or about you, we will always ensure that an exemption to the prohibition to processing such data always applies.
Where you have opted-in to receive marketing communications from us
If we have permission to contact you with marketing communications, we will process your Personal Data (for example, your name and email address) to provide you with newsletters of product updates in line with any preferences you have told us about.
Every communication we send to you for marketing purposes will also contain instructions on how to unsubscribe from receiving them.
You are not under any obligation to provide us with your Personal Data for marketing purposes.
Where you have opted-in previously, you can tell us that you do not want your Personal Data to be processed in this way at any time by contacting firstname.lastname@example.org, where relevant, by following the unsubscribe link shown in every marketing communication you receive from us. We will retain your data for as long as we have your consent and delete your Personal Data used for marketing purposes as soon as you withdraw your consent or unsubscribe from our newsletters and marketing information.
If you fail to provide us with Personal Information
You always reserve the right to withhold your personal information, but this may affect how we provide our services
Where we need to collect Personal Information by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.
LEGAL BASIS OF PROCESSING
We will only process your information for as long as we have a relevant legal basis to do so. Unless stated above in the “Information we may collect” section, this is necessary in order to provide you with the contractual services you have requested from Holray or if you have provided us with adequate consent to process your information for other purposes.
Sometimes we must process your Personal Data in order to comply with a legal or regulatory obligation. For example, we may be required to give information to legal authorities if they so request or if they have the proper authorisation such as a search warrant or court order.
If we choose to process your information under the legal basis of legitimate interests, we will always inform you of our legitimate business interest and your right to object. We may process your data on this basis for the purposes of, for example:
- record-keeping for the proper and necessary administration of our business;
- responding to new enquiries and any other unsolicited communication from you to which we believe you would expect a response;
- protecting and asserting the legal rights of any party;
- insuring against or obtaining professional advice that is required to manage organisational or business risk; or
- protecting your interests where we believe we have a duty to do so.
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If your Personal Data has been used for a purpose other than its initial intended use and you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact email@example.com.
RETAINING YOUR PERSONAL DATA
We will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
PROTECTING YOUR PERSONAL DATA
We are committed to ensuring that your information is secure and we are ISO 27001 accredited.
However, you should be aware that providing information over the internet can never be guaranteed as being completely safe and if you choose to send such information to us via the internet, you do so at your own risk.
SHARING YOUR INFORMATION WITH OTHERS
Please be assured that we will not share your information for any other reason unless we are required by law or permitted to do so under this Privacy Notice. The main circumstances in which we will be permitted or required to disclose this is by law will be by court order, to government bodies and law enforcement agencies. However, sometimes we may share your information with third parties in the following ways:
- we may use carefully selected sub-processors to help us collect, store or manage your information. This may include, without limitation, Hubspot, Amazon, Microsoft, Linode Xero, third party e-commerce providers, agents and IT support providers.
- analytics and search engine providers that assist us in the improvement, security and optimisation of the Website and the System; or
- if Holray is acquired by a third party, in which case Personal Data held by it about its customers will be one of the transferred assets. We process your Personal Data for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. If you object to our use of your Personal Data in this way, the relevant seller or buyer of our business may not be able to provide services to you.
We will only ever disclose the information necessary for our third party provider to perform their specific services and this will be conducted under a written agreement governing the usage of Personal Data.
TRANSFER OF DATA OUTSIDE OF THE UK AND/OR THE EEA
The servers which we store Personal Data on are in the United Kingdom.
We shall not transfer any Personal Data to any country outside of the UK and/or the EEA unless we ensure that such Personal Data is subject to an adequate level of protection and appropriate legal safeguards in accordance with Data Protection Legislation (which may include the implementation of an international data transfer agreement, where required by law).
YOUR RIGHT TO OBJECT UNDER DATA PROTECTION LAWS
You have the right to object to us handling your Personal Data when:
- we are handling your Personal Data based on our legitimate interests. If you ask us to stop handling your Personal Data in this way, we will stop unless we can show you that we have compelling grounds as to why our use of your Personal Data should continue; or
- where we process Personal Data for marketing purposes. If you ask us to stop handling your Personal Data on this basis, we will stop.
YOUR RIGHTS UNDER DATA PROTECTION LAW
You can exercise the following rights to your data by contacting firstname.lastname@example.org. We will only take instructions from you or your legal representative and we will protect your privacy when you contact us by asking specific and relevant questions to make sure we are speaking to you or your legal representative and not to an unauthorised person.
Right of access
You are entitled to receive confirmation as to whether your Personal Data is being processed by us, as well as various other information relating to our use of your Personal Data. You also have the right to a copy of the Personal Data which we are handling regarding you.
Right to rectification
You have the right to require us to rectify any inaccurate Personal Data we hold about you. You also have the right to have incomplete Personal Data we hold about you completed, by providing a supplementary statement to us.
Right to restriction
You can restrict our processing of your Personal Data where:
- you think we hold inaccurate Personal Data about you;
- our handling of your Personal Data breaks the law, but you do not want us to delete it;
- we no longer need to process your Personal Data, but you want us to keep it for legal reasons; or
- we are handling your Personal Data because we have a legitimate interest you and are in the process of objecting to this use of your Personal Data.
Where you exercise your right to restrict us from using your Personal Data, we will then only process your Personal Data when you agree, except for storage purposes and to handle legal claims.
Right to data portability
You have the right to receive the Personal Data we hold about you in a structured, standard machine readable format and to send this to another organisation controlling your Personal Data.
Right to erasure
You have the right to require us to erase your Personal Data which we are handling in the following circumstances:
- we no longer need to use your Personal Data for the reasons we told you we collected it for;
- where we needed your consent to use your Personal Data and you have withdrawn your consent;
- you object to our use of your Personal Data and we have no compelling reason to carry on handling your Personal Data;
- our handling of your Personal Data has broken the law; or
- we must erase your Personal Data to comply with a law we are subject to.
Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact email@example.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
INFORMATION REGARDING CHILDREN
We do not intentionally market our services or collect information via the Website from data subjects under the age of 18. We do not collect information regarding children for the provision of our services and will erase any data collected if informed by the parent or legal guardian of a child whose data we have erroneously collected.
CHANGES TO THIS PRIVACY NOTICE
We may change this Privacy Notice at any time to ensure it always accurately reflects the way we collect, use and safeguard your Personal Data.
Please check this notice from time to time to ensure you are aware of any updates we may have made to our Personal Data handling practices. The date of the changes will be listed in the ‘Last updated’ section below. We will endeavour to notify all of our current clients of any updates to this notice via email and we will post the relevant announcement on our website homepage.
We recommend that you print a copy of this page for your reference.
HOW CAN YOU MAKE A COMPLAINT?
Please note that if you are not satisfied with the processing of your Personal Data as set out in this Privacy Notice, please contact firstname.lastname@example.org.
You have the right to issue a complaint directly with the Information Commissioners Office, the data protection supervisory authority for England and Wales (https://ico.org.uk/concerns/).
Please contact email@example.com if you have any questions, comments or requests regarding this Privacy Notice.
Last updated: April 2023