Professional Services Privacy Notice

Introduction

Revell Research Systems Limited (the Company, we, us, our) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal information.

This notice relates to the personal data of client personnel that we process in performing our contract with the client to deliver various professional services. It may also apply during pre-contractual negotiations with the client.

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police and law enforcement agencies
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• The client and third parties in connection with the client's instructions
• Agents acting on our behalf
• Service providers (including associates)
• Our accountants, auditors and other financial advisers
• Accreditation assessors and auditors
• Other professional advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We are collecting this information to properly record our work in executing a client's instructions.

The exact nature of our processing will depend on the professional service we are delivering. For instance, we may keep a record of the training you have received or your interactions with our service desk.

We only use your personal details in the context of the professional service we are delivering or have delivered.

We may directly collect personal data about you that we may subsequently share with your organisation, our client.

We will routinely disclose your data to our service providers, including associates, to expedite our client's instructions.

We will periodically give access to our business records to our accountants, auditors and other financial advisers and may occasionally furnish other professional advisers with access. Your personal data may be incidentally disclosed to them in the course of their work for us.

We may occasionally provide access to our records to training assessors and assurance auditors so they can inspect work to accredit staff and confirm our adherence to standards. It is possible that personal details of client personnel may be disclosed but such agencies strictly observe their duty of confidentiality.

We may process this data for the purpose of the proper administration of our business and in communicating with you as well as maintaining backups.

We may share data with the courts and associated professionals in establishing, exercising or defending our legal rights. We may share data in reporting crime to or when co-operating with the police and law enforcement agencies.

What is the legal basis for processing?

Our lawful bases are Contract, Legal Obligation and Legitimate Interests.

• contract - the Company may process your personal data to perform its contract with the client.
• legal obligation - the Company may be required from time-to-time to share personal data to comply with legal obligations.
• legitimate interests - the Company has legitimate interests in monitoring, securing, protecting and improving its computing and communication facilities as well as its business processes; in protecting and asserting our legal rights, your legal rights and the legal rights of others; and in properly administering its business and maintaining backups.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b)).
• processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

How are we collecting this information?

We collect personal data from our clients concerning those people working for or on their behalf who will in some way be subject to the professional services we are delivering.

For instance, a client will provide us with details about you to set you up on their and our systems or because you are attending a training programme that we are delivering.

We also collect personal details directly from data subjects working for or on behalf of a client as they interact with us. Personal data may therefore be collected directly from the individual, indirectly from the client organisation or generated through the individual's interactions with our systems and services.

What information are we collecting?

We will collect, process, hold and share the following categories of personal data:-

• personal information (such as name and style of address)
• business address and other business contact details
• private address and contact details (only where necessary)
• job title and role details
• IP addresses related to private Internet connections (only where necessary)
• usernames, credentials and other client identifiers
• qualifications and experience (where appropriate)
• interactions with us (including correspondence) in any form
• the individual's association with any client equipment or service
• time, expense and disbursement records where they are involved in some way

If we are instructed to provide professional services that require us to know the individual's private contact details (eg: in supporting them while working at home) or IP address then we will not rely on consent but on contract to process these details.

Where private contact details are volunteered for convenience rather than being required for delivery of the professional service, we will rely upon consent as our lawful basis. Consent may be withdrawn at any time.

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

Will your personal data be transferred outside of the United Kingdom?

We do not routinely transfer personal data outside the United Kingdom. However, some professional services, communication, collaboration, document management, hosting and cloud service providers used by the Company may process personal data outside the United Kingdom. Where this occurs, we will ensure that appropriate safeguards recognised by the UK General Data Protection Regulation (UK GDPR) are in place before the transfer occurs.

These safeguards may include transfers to countries recognised as providing an adequate level of protection for personal data or the use of approved contractual arrangements between the parties involved in the transfer.

How long is your information kept?

We will only keep your information for as long as necessary. Different categories of records may be retained for different periods depending upon legal, regulatory, contractual and operational requirements. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

We typically retain personal data relating to client instructions for six years after the financial year in which our instructions ceased based on the Limitation Act 1980.

How secure is your information?

We take appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

You are responsible for keeping your personal details up-to-date. Please advise the Company of any changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information