Commhoist Ltd
Pocket Nook Lane
Lowton
Warrington
WA3 1AB
enquiries@commhoist.co.uk
01942 269 335
Commhoist Ltd (trading name Commhoist) is a company registered in England and Wales with company number 03209155. Registered VAT number 678360500.
Commhoist Ltd is registered with the ICO – Reference number ZA641377
We gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection regulation and law (GDPR May 2018). This notice provides you with the necessary information regarding your rights and obligations, and explains how, why and when we collect and process your personal data.
Definitions
Consent: agreement which must be freely given, specific, informed and be an unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear positive action, signifies agreement to the Processing of Personal Data relating to them.
Data Controller: the person or organisation that determines when, why and how to process Personal Data. It is responsible for establishing practices and policies in line with the GDPR. We are the Data Controller of all Personal Data relating to our Company Personnel and Personal Data used in our business for our own commercial purposes.
Data Subject: a living, identified or identifiable individual about whom we hold Personal Data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.
Personal Data: any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.
Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Personal Data is a Personal Data Breach.
Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
Data Processing, Consent and Retention
We collect some or all of the following information about you when you use our services, or register on our website:
- Your name
- Your company name
- Your business address
- Your mobile telephone number and/or your preferred contact number
- Your preferred email address
- Your project information
- Your account information
Commhoist understands that, under GDPR, data controllers should not retain personal data for any longer than necessary.
On collection of data, Commhoist will obtain consent permission before retaining personal data. If data is held to fulfil a business need there is a legitimate interest for Commhoist to process this data via the contract lawful basis for processing.
Furthermore, the GDPR gives data subjects rights to require the erasure of their personal data (also known as “the right to be forgotten”). To request erasure of your personal data please contact jane.billows@commhoist.co.uk
We will retain the personal data provided by you in line with the below retention schedule. A Data Controller must only process Personal Data on the basis of one or more of the lawful bases set out in the GDPR, which include Consent.
| Data | Lawful basis for processing | Retention Trigger | Retention Period | Action |
| Customer Data – Engaged in services | Contract | End of Contract/ Last Action | 6 years | Destroyed |
| Name & Email – Website sign up | Consent | Last action | 6 years | Destroyed |
| Internal business activities. Research to shape business decisions | Legitimate Interest | Last action | 6 years | Review |
| Audits & Inspections | Legal Obligation | Last action | 6 years | Review |
| Reception Sign-in book | Legal Obligation | End of year | 1 year | Destroyed |
| Employee files | Contract | End of employment | 6 years | Destroyed |
Protecting Personal Data
Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful Processing, and against accidental loss, destruction or damage.
We will develop, implement and maintain safeguards appropriate to our size, scope and business, our available resources, the amount of Personal Data that we own or maintain on behalf of others and identified risks (including use of encryption and Pseudonymisation where applicable). We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our Processing of Personal Data.
We will maintain data security by protecting the confidentiality, integrity and availability of the Personal Data, defined as follows:
(a) Confidentiality means that only people who have a need to know and are authorised to use the Personal Data can access it.
(b) Integrity means that Personal Data is accurate and suitable for the purpose for which it is processed.
(c) Availability means that authorised users are able to access the Personal Data when they need it for authorised purposes.
We will comply with and not attempt to circumvent the administrative, physical and technical safeguards we implement and maintain in accordance with the GDPR and relevant standards to protect Personal Data.
Data Subjects
Data Subjects have rights when it comes to how we handle their Personal Data. These include rights to:
(a) withdraw Consent to Processing at any time;
(b) receive certain information about the Data Controller’s Processing activities;
(c) request access to their Personal Data that we hold;
(d) prevent our use of their Personal Data for direct marketing purposes;
(e) ask us to erase Personal Data if it is no longer necessary in relation to the purposes for which it was collected or Processed or to rectify inaccurate data or to complete incomplete data;
(f) restrict Processing in specific circumstances;
(g) challenge Processing which has been justified on the basis of our legitimate interests or in the public interest;
(h) request a copy of an agreement under which Personal Data is transferred outside of the EEA;
(i) prevent Processing that is likely to cause damage or distress to the Data Subject or anyone else;
(j) be notified of a Personal Data Breach which is likely to result in high risk to their rights and freedoms;
(k) make a complaint to the supervisory authority; and
(l) in limited circumstances, receive or ask for their Personal Data to be transferred to a third party in a structured, commonly used and machine-readable format.
We will verify the identity of an individual requesting data under any of the rights listed above.
Reporting a personal data breach
The GDPR requires Data Controllers to notify any Personal Data Breach to the applicable regulator (ICO) and, in certain instances, the Data Subject.
Commhoist have put in place procedures to deal with any suspected Personal Data Breach and will notify Data Subjects or any applicable regulator where we are legally required to do so.
Direct marketing
Commhoist are subject to certain rules and privacy laws when marketing to our customers.
We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, visit the website, or use certain other site features in the following ways:
- To quickly process your transactions.
- To send periodic emails regarding products and services.
A Data Subject’s prior consent is required for electronic direct marketing (for example, by email, text or automated calls). The limited exception for existing customers known as “soft opt in” allows Commhoist to send marketing texts or emails if contact details have been obtained in the course of a sale to that person/ organisation, they are marketing similar products or services, and Commhoist gave the person an opportunity to opt out of marketing when first collecting the details and in every subsequent message.
The right to object to direct marketing must be explicitly offered to the Data Subject in an intelligible manner so that it is clearly distinguishable from other information. Commhoist provide this both at a contract and consent data processing level.
A Data Subject’s objection to direct marketing must be promptly honoured. If a customer opts out at any time, their details will be suppressed promptly. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.
If at any time users want Commhoist to stop sending such communications, they should email jane.billows@commhoist.co.uk or write to:
The Database Manager
Commhoist Group
Pocket Nook Lane
Lowton
Warrington
WA3 1AB
Amendment of personal data takes place within 2 working days of receipt of the request if made online and 10 working days if made offline.
IP addresses and cookies
This website utilises a standard technology called ‘cookies’ and web server log files to collect information about how this website is used. A ‘cookie’ is a small piece of information sent from our website to your computer to help us to identify you quickly. The information we collect allows us to monitor website traffic and to personalise content of the website for you. The information we collect is anonymous.
View our Cookie Policy here.
If you choose to have your browser refuse cookies it is possible that some areas of this website will not function as effectively when viewed. You change your cookies settings at any time here.
Security
We employ security measures to protect the information provided by you from access by unauthorised persons and against unlawful processing, accidental loss, destruction or damage.
Your rights
You may ask us to make changes to the information provided by you and/or held about you, to ensure that it is accurate and kept up to date. You may also request that we cease from processing your personal information and that we delete your data from our database or records.
We will only perform the activities outlined above to the extent that such activities will not compromise privacy, security or any other legal interests.
Sharing personal data
Generally, we are not allowed to share Personal Data with third parties unless certain safeguards and contractual arrangements have been put in place.
We will only share the Personal Data we hold with third parties, such as our service providers if:
(a) they have a need to know the information for the purposes of providing the contracted services;
(b) sharing the Personal Data, if required, the Data Subject’s Consent has been obtained;
(c) the third party has agreed to comply with the required data security standards, policies and procedures and put adequate security measures in place.
Our responsibility for website links:
This Privacy Policy is limited to the personal information which we collect and use via this website. We do provide links within this site to other websites, including social media sites such as Twitter and LinkedIn. If you follow these links, you should use these sites in conjunction with their privacy policies as their data practices fall outside the scope of this Privacy Policy. Further, we can have no responsibility for or control over the information collected by any third party website and we cannot be responsible for the protection and privacy of any information which you may provide on such websites.
Commhoist third party providers:
Hootsuite – manage social media interactions.
If you send us a private or direct message via social media the message will be stored by Hootsuite for three months. It will not be shared with any other organisations.
MailChimp – E-Newsletter
We use a third-party provider, MailChimp, to deliver our monthly e-newsletters. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter.
WordPress – Website & Blog
We use a third-party service, WordPress.com, to publish our blog, and our website. These are hosted at WordPress.com, which is run by Automattic Inc. We use a standard WordPress service to collect anonymous information about users’ activity on the site, for example the number of users viewing pages on the site, to monitor and report on the effectiveness of the site and help us improve it.
Marketing Management – Sixothree Marketing
We use a third-party provider, Sixothree Marketing, to supply and support our marketing. No specific data is collected or stored by Sixothree Marketing. View their privacy policy here.
Website Management – Platform81
We use a third-party provider, Platform81, to support the management of our website. No specific data is collected or stored by Platform81. View their privacy policy here.
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
Changes to this Privacy Policy
We reserve the right to change this Privacy Policy at any time without notice. We will endeavour to notify all data subjects of the policy changes. We last revised this Privacy Standard on 21st January 2020.
This Privacy Standard does not override any applicable national data privacy laws and regulations in countries where the Company operates.
Contact
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to jane.billows@commhoist.co.uk
