v2_0, last updated 29 October 2021
This Policy sets out what personal data we might collect, how we process and protect that data, the lawful grounds for that processing, and your related rights. We always seek to comply with the data protection laws applicable to our processing of personal data. For example, the EU General Data Protection Regulation 2016/679 (‘EU GDPR’) may apply and, as a UK company, the UK Data Protection Act 2018, the UK e-Privacy Regulations (‘PECR’), and the UK-adopted version of the EU GDPR (‘UK GDPR’) apply directly to all our processing.
We use ‘GDPR’ to refer to either the EU or UK version as they’re almost identical. The GDPR is the world-standard for data protection laws, inspiring legal developments around the world.
‘Personal data’ is a defined term in EU and UK law. We also use it here to cover ‘personally identifiable information’ as defined in US law, and other similar legal definitions. Essentially ‘personal data’ means any information relating to an identified or identifiable natural person, namely one who can be identified, directly or indirectly from that information alone or in conjunction with other information.
In most cases, the lawful ground (or legal basis) for our processing will be that the processing is necessary: (i) for our legitimate interests in carrying out our business, including to secure, manage, grow and improve our Services, provided those interests are not outweighed by your rights and interests (‘Legitimate Interests’), (ii) to perform a contract with you (‘Contract’), or (iii) to comply with our legal obligations (‘Legal Obligation’). Where processing is based on your consent (‘Consent’), we will identify the processing purposes and provide you with relevant information to make the processing fair and transparent when we ask for your consent.
As data protection law and practice are constantly developing, we’ll need to update this policy from time to time, which we’ll do by posting a new policy on the Website that takes effect from the date stated. It is your responsibility to return to the Website from time to time and check for changes.
We collect or are provided personal data in the normal course of business. For example:
In GDPR’s terms, we are the ‘controller’ of Account, Marketing, Website, Service and Recruitment Data as we determine the purposes (the ‘why’) and the essential means (the ‘how’) of the collection and processing. We are the ‘processor’ of Customer Data as the customer remains the ‘controller’ of Customer Data and we only process Customer Data to fulfil our contract with the customer and on their instructions.
When you provide us with personal data about yourself or another person, for example a colleague or a contact, you are confirming to us that you have their consent or are otherwise authorised to provide us with that information and that any personal data you give us is accurate and up-to-date.
Provision of personal data to us is never a requirement, however if you do not provide us with the personal data necessary for us to carry out an action at your request or under a contract with or relating to you, for example to respond to your query or provide Services to you, we may not be able to respond to your query or provide Services to you.
Given the nature of our business, we do not ask for ‘special categories of personal data’ such as information about your health, political opinions, racial origins or sexual life, or personal data relating to criminal convictions and offences – and we would ask you not to send any to us or upload any into the Services.
We do not collect or process any bank or debit or credit card data ourselves. Any such data is collected and processed by our payment processor, to process the relevant payments, as an independent controller. We will at all times comply, and choose payment providers who comply, with the applicable industry codes and laws regarding security and retention of such data, for example the Payment Card Industry Data Security Standard.
Our payment processor is GoCardless Limited, a company registered in England and Wales (company # 07495895), registered office Sutton Yard, 65 Goswell Road, London EC1V 7EN, UK.
We use personal data in the normal course of our business, including to provide, secure, manage and improve our Services and to meet any binding contractual or legal obligations. This includes:
Where we carry out electronic direct marketing – including phone calls, automated phone calls, emails, SMS and IM – we will comply with the relevant, applicable laws including the EU e-Privacy Directive, which has been implemented by national laws across the EEA and in the UK. This means for example that we will, where required, check national do-not-call registers and obtain your prior specific and informed consent.
Joint Controller for Electronic Direct Marketing
We work with Prospect Global Ltd, a company incorporated in England (#09648733), registered office 1st Floor Front Office, 27-29 North St, Brighton, BN1 1EB (‘SoPro’) on certain defined electronic direct marketing activities for which we are joint controllers with SoPro, namely to: identify legal entities we believe would benefit from our services, identify the roles for whom our services are relevant and the individuals holding those roles, and introduce our services to those individuals by email, at all times in accordance with applicable law. Accordingly, the personal data processed is limited to ‘business profile data’ of name, email, job title and employer details and the legal basis is legitimate interests. No other personal data is processed under this joint controller arrangement, which is limited to the above process and data.
As required by GDPR, we have a written agreement with SoPro setting out our respective duties, including that each party undertakes to comply with GDPR (and other applicable laws such as PECR) at all times, including in the security and safeguarding of personal data during processing. Each email complies with relevant laws including providing a free and simple opt-out mechanism (which each of Keepabl and SoPro shall honour promptly), and the information required by Article 14 of GDPR.
We will not share, sell or rent your personal data to third parties so they can market their services to you. Nor do we accept advertising from third parties on the Website. We may share personal data in the following limited circumstances.
In limited situations, your personal data may be collected by or shared with third parties, who will act as separate or joint controllers:
For provision of the Services, and for our own disaster recovery and business continuity purposes, we may store or transmit personal data to or through third party providers such as our cloud service provider, Google, with whom we have entered into the EC standard contractual clauses for transfers and GoCardless, our payment processor as above. We only share the minimal personal data required to help us operate, secure and analyse our business. Lawful basis: Legitimate Interests or Contract.
We may be obliged to disclose your personal data to comply with a law, order or request of a court, government authority, other competent legal or regulatory authority or any applicable code of practice or guideline. Lawful basis: Legal Obligation.
In each case, we have written contracts in place incorporating relevant wording to safeguard that personal data and comply with applicable laws, and we will only share such data as is necessary for the purpose in question. Our starting position is always to keep personal data within the UK or European Economic Area (‘EEA’) where the UK GDPR or EU GDPR applies respectively. However, in order to carry out the above purposes, we may use third parties and their facilities outside the UK or EEA. In all such cases we will ensure that appropriate security measures are in place to protect your personal data and a valid legal basis for the transfer applies.
As a default position, we will only retain personal data for any statutory retention period, then a reasonable period (if any) necessary for the above purposes. This is subject, for example, to any valid opt-out or withdrawal of consent where processing is based on consent, or other valid exercise of your data subject rights.
The security of data is very important to our business. In accordance with our legal obligations, we take appropriate technical and organisational measures to protect your personal data and keep those measures under review. However, we can only be responsible for systems that we control and we would note that the internet itself is not inherently a secure environment.
We also receive aggregate reporting from YouTube when you access Privacy Kitchen’s videos online or visit our channel on YouTube. YouTube, as a controller, collects certain information such as your region, watch time, and number of videos watched per visit to provide us with aggregate reports. We receive similar aggregated reports on use of the privacykitchen.tv branded links for the videos from Bitly, whom we use to create those links.
Under the UK and EU GDPRs, you have the following rights (some of which may be subject to conditions set out in the relevant GDPR):
You have the right, at any time, to object to the processing of your personal data for direct marketing.
The Website and Services do not use technologies that respond to ‘Do-Not-Track’ signals communicated by your internet browser.
If you’ve any question you can always contact us at the address above or by email to firstname.lastname@example.org. You have the right, at all times, to notify a complaint to the regulator. Our supervisory authority, or regulator for data protection, is the UK ICO. We always welcome the opportunity to discuss and resolve any complaint with you first.