Privacy Policy
At Cambridge Risk (“Cambridge Risk”, “we” or “us”), we work hard to keep the information you give us safe. We follow strict security procedures on how your personal information is stored and used, to help stop any unauthorised person getting hold of it. Please take the time to read this privacy policy, which is part of our terms of use.
We work in line with the UK General Data Protection Regulations and the Data Protection Act 2018.
This policy describes how we collect, use and look after the information you provide us with when you use Cambridge Risk products and services.
Our website contains links to other websites, which may well have different privacy and security policies to us. Please remember, we don’t have any control over these websites, so we can’t take responsibility for any information you give them.
Contact Details
Cambridge Risk Solutions is the controller for the personal information we process, unless otherwise stated, and the contacts are the Directors, Helen Molyneux and Patrick Roberts.
There are many ways you can contact us, including by phone, email and post.
Our postal address is:
Whitehough Cottage
Whitehough Head Lane
Whitehough
High Peak SK23 3BX
Our phone number is 0800 035 1231
Our email address is [email protected]
How do we get information?
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- You have made an enquiry to us;
- You have requested to receive our newsletters;
- You are completing our eLearning, whether arranged by your or your employer;
- You have made an information request to us; or
- You have applied for a job or secondment with us.
Your Data Protection Rights
Under data protection law, you have rights we need to make you aware of the rights available to you depend on our reason for processing your information.
Your right of access
You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can make the request verbally or in writing.
More about ‘your right of access’ on the ICO website.
Your right to rectification
You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
More about ‘your right to get your data corrected’ on the ICO website.
Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances.
More about ‘your right to get your data deleted’ on the ICO website.
Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain circumstances.
More about ‘Your right to limit how organisations use your data’ this on the ICO website.
Your right to object to processing
You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests.
More about ‘the right to object to the use of your data’ on the ICO website.
Your right to data portability
This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you.
The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
More about ‘your right to data portability’ on the ICO website.
You are not required to pay any charge for exercising your rights. We have one month to respond to you.
Your Right To Complain
We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us at [email protected] and we’ll respond.
If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Informaiton Commissioners Office; please visit the ICO website to make a complaint.
What information do we collect?
This is what we normally collect about you to help us provide you with Cambridge Risk services and information, and to improve them even more, where we can:
- Contact details such as name, address, email and telephone number.
- In order to help us develop and improve our website we collect information about how you use the site.
- Other data we occasionally ask you to provide us with, for example now and again we might ask you to fill in a questionnaire, just so you can let us know how we’re doing.
We hold the names and contact details of individuals acting in their capacity as representatives of their organisations, across the business.
If the interactions relate to contracts or potential contracts for work to be conducted by us, or for any eLearning, then the legal basis is Article 6(1)(b) because the processing is necessary for the performance of a contract, or to take steps to enter into a contract. Additionally, if the interactions relate to suppliers, buildings management, IT services, accounts, the legal basis is also Article 6(1)(b) because the processing is necessary for the performance of a contract, or to take steps to enter into a contract. For receipt of our newsletter, this is under Article 6(1)(f) Legitimate Interest, as you have requested to receive the newsletter, and it is in our and your interest to receive the newsletter. You can opt out from receiving the newsletter at any time.
Disclosing your information
We will not pass on your personal information to third parties except in accordance with this policy and our Terms and Conditions or where we are required by law to disclose that information. As an example, you may wish us to share your contact details with selected third parties. An example may be a third party who provides services such as certification as part of a project with a specific objective of obtaining certification. This will only be carried out following discussion with you, and if you grant specific permission to do this.
Marketing our products and services
Cambridge Risk Solutions Ltd does not undertake direct marketing, and will therefore not use your data for any marketing purposes.
Visitors to our Website
Analytics
When you visit www.cambridge-risk.com, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
If we do collect personal data through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it. This may be, for example, when you complete the Contact Us form.
Cookies
You can read more about how we use cookies on our Cookies page. In recognition of the fact that the implementation date for the revised e-Privacy Regulation remains unknown, we are taking reasonable steps now to align our use of cookies the standard of consent required by GDPR.
Purpose and legal basis for processing
The purpose for implementing all of the above is to maintain and monitor the performance of our website and to constantly look to improve the site and the services it offers to our users. The legal basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.
What are your rights?
As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.
Applying for a Job and CVs
Occasionally, we are sent speculative approaches for work, which may include CVs. We do not retain this information.
Retention Policy
We have strict guidelines on how long we will retain personal data.
| Retention Trigger | Retain for | Information Asset Owner | |
|---|---|---|---|
| Clients | Last contact | Hard copy – 1 year Electronic – 12 years | Directors |
| Client documentation | Last contact | Hard copy – 1 year Electronic – 12 years Or on client request | Client |
| Potential Clients | Last contact | Hard copy – 1 year Electronic – 12 years | Directors |
| Suppliers | Last contact | Hard copy – 1 year Electronic – 12 years | Directors |
| Applicants | On receipt | Deleted | Directors |
| Associates | Last Contact | Electronic – 6 years | Directors |
| Professional Organisations | Last Contact | Hard copy – 1 year Electronic – 12 years | Directors |
| Employees | Directors’ information held only | Directors | |
| eLearning | Last contact or based on contract with employer | 2 years Or as per contract | Directors |
| Client |
We keep our privacy notice under regular review to make sure it is up to date and accurate.