Privacy Notice
This information is our Privacy Notice. It explains what we do with your personal information, why we want to use it, how we protect it, and what rights you have to control our use of your personal data.
The most important fact is that it’s your personal data. We respect your rights and we will only use your data where necessary to deliver our services to you or your employer, and to keep you up to date about developments in our products.
tl;dr
We take data protection and governance seriously. If you have questions, contact us at privacy@weft.org.uk
Information about the data controller
The data controller is WEFT Limited, our company number is 15742197 and our registration number with the Information Commissioner’s Office is ZB744859.
If you want to contact us about any of the points on this notice, or just generally about how we protect your privacy, please email us at privacy@weft.org.uk. We use this email address for all data protection and data access matters.
Purpose and lawful basis
We use information for a few different purposes and each purpose has a different lawful basis. This section describes these in detail and, although it’s technical, we’re required by law to explain this to you.
What purpose?
What lawful basis?
How long do we keep it?
Industry professionals: sending you news and information about our services to your email address. You will always be able to opt out of these emails.
Legitimate interests because we are sending you information related to your profession that we believe is useful.
3 years from our last contact with you. If you ask to unsubscribe from our emails we’ll delete your information within 1 year.
Client employees: using your contact information to conduct business with your company
Legitimate interests because we need your details to fulfil our contract with your company
7 years from our last invoice to your company (for legal and tax purposes)
WEFT supplier or other associated business: using your contact information to conduct business with your company
Legitimate interests because we need your details to fulfil our contract with your company
7 years from our last invoice to your company (for legal and tax purposes)
Website users: Measuring your use of our website to help improve it
Legitimate interests because we want to keep out site relevant to the sector
1 year from your last visit.
You may ask us to stop emailing you at any time – usually this is easiest by choosing the “unsubscribe” option at the bottom of information we send to you. You can also email us at privacy@weft.org.uk any time. Please note that if you do this, we will delete your records on our mailing lists but may need to retain financial or legal records.
Who receives your personal data?
We use standard business software to process your personal information – like Google Workspace, and Microsoft. We also use some specialist subcontractors for certain activities (marketing, data analysis etc.). If you’d like a full list of our processors and partners please contact us at privacy@weft.org.uk.
International transfers and safeguards
The business services we use are all “cloud-based systems”, which means the information is held in information data centres in different locations. This section explains the impact of these “international transfers” and how your personal information is protected.
All the cloud-based systems we use reserve the right to hold copies of your personal information outside the UK and the European Economic Area (EEA.) They may choose to do this to hold back-up copies, so they can guarantee recovery.
WEFT ensures that either:
-
destination countries’ data protection laws are deemed “adequate” by the ICO (see this article for a full list of adequate countries); or
-
we enforce your rights under GDPR through “standard contractual clauses” approved by the UK and EU governments.
If you’d like a full list of our international transfers and safeguards please contact us at privacy@weft.org.uk.
Your personal data rights
The personal data we hold about you is your data, so you have rights over them. This section summarises your rights. You can exercise any or all these rights when you choose, and the easiest way is by dropping us an email at privacy@weft.org.uk
You have the right to request a copy of all personal data we hold relating to you and we must provide it within 30 days. You also have the right to require us to correct any records that are wrong.
You have the right to require us to erase personal data and we must comply unless we need it for one of the purposes described above (for example, this might include the fact that we need to demonstrate that we have met our mutual contractual obligations.) We also retain the right to keep data that is needed to establish, exercise or defend a legal claim.
Where we process your data based on a “legitimate interest” (as explained in the section on Purpose and Lawful Basis, above) you still have the right to object to our processing of that data. From that point, we must stop processing your data until we have determined whether your rights override our interests.
Finally, you have the right to have your personal data transferred to another organisation, and we’re obliged to provide it to you in a clear and reasonable format.
Your rights to lodge a complaint with the Regulator
At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113.
Of course, we believe that we can resolve your issue quickly and fairly – you can always contact us at privacy@weft.org.uk.
Our contractual requirements to use your personal data
If you’re an WEFT customer, it’s a requirement that we collect personal information from you so that we can enter into a contract with your company. If you’re an employee or agent of a WEFT customer, we have a legitimate interest in using your personal data so we can meet our contractual obligations.
Automated processing of your personal data
We do not carry out any automated decision making based on your personal data.
Other purposes for processing personal data
We don’t process your personal data for any other purpose than those we’ve described here.
Should we decide that we want to develop a new processing purpose, we will contact you to let you know what we intend to do, the lawful basis we will use, and your rights over our intended new processing. We’ll also publish information about it here.
If you have any questions, concerns or just want some more information about our privacy management, drop us a line at privacy@weft.org.uk.