Definitions and interpretation
In this policy the following terms are used:
Content: means any text, graphics, images, audio, video, software, data compilations and any other form of information capable of being used as part of a website, or included in an email, blog, social media, etc.
Cookie: means a small text file placed, on acceptance, in a browser by AuraQ when an AuraQ website is visited. This allows AuraQ to identify recurring visitors and to analyse their browsing habits within its websites.
PID: means collectively all information that is submitted via an AuraQ website or other channels (e.g., LinkedIn, Twitter, email, etc.). AuraQ regard this as data relating to an identified or identifiable living natural person, that can be processed by AuraQ or its external third parties.
AuraQ Ltd: means AuraQ Ltd located at Clanmere, 33 Graham Road, Malvern, Worcestershire WR14 2HU, otherwise referred to as AuraQ.
Service: means collectively any online facilities, tools, services, or information that AuraQ makes available through its websites either now or in the future.
System: means any online communications infrastructure (e-communication) that AuraQ makes available either now or in the future. This includes, but is not limited to, email, blogs, live chat, etc.
Website: means an AuraQ website (e.g., www.auraq.com).
AuraQ websites can be visited anonymously, without providing any information. There are times, however, when certain PID will be required, such as name, email address and company name, or when registering with AuraQ in order to download, subscribe or access premium content (products, services, and/or information). AuraQ may also use PID to help understand who is using the website, optimise and monitor the website activity, and to help manage business development activities.
AuraQ may collect various information, depending on the manner in which AuraQ is contacted. Without limitation, any of the following data may be collected:
▪ job title
▪ contact information such as email addresses and telephone numbers
▪ IP address *
▪ web browser type and version *
▪ date and time *
▪ device type (e.g., laptop, tablet, mobile phone, etc.) *
▪ operating system *
▪ a list of URLs starting with a referring site, individual activity on the website, and the site exited to *
* Automatically collected
AuraQ may receive data from other sources; marketing partners, social media platforms, recruitment agencies, co-workers, as well as from other third parties. AuraQ may also receive data from publicly available sources via data enrichment services. AuraQ collects anonymous information from visits to its websites to help provide a better user experience, service and to make the website as friendly and purposeful as possible.
This policy details how AuraQ will collect and use PID to provide a positive experience on AuraQ websites and in using products and services. Wherever PID is required to be submit, options to restrict use of that PID will be provided. AuraQ uses different methods to collect data from and about individuals through:
Direct interactions – Identity and contact details provided by filling in forms or by corresponding with AuraQ by post, telephone, email etc. This includes personal data provided when:
▪ enquiring about products or services
▪ subscribing to services or publications
▪ opt-in to marketing communications
▪ entering a competition, promotion, or survey
▪ submitting feedback or contacting AuraQ
Third-parties or publicly available sources – AuraQ may receive personal data about an individual from various third parties as set out below:
▪ Website analytics providers
▪ Identity and contact data from third-party reference agencies
▪ Professional social media platforms
▪ Referral from product partners
▪ Contact data from publicly available sources.
For AuraQ to deliver information, products, and services, AuraQ will need to collect PID for the following purposes which will be processed by AuraQ based on legal grounds. This includes but is not limited to:
|Processing an order, including payment details and transactions||Necessary for the performance of the contract|
|Providing a regular newsletter subscription service||Consent or Legitimate interest|
|Sending marketing communications relating to AuraQ products and services||Consent or Legitimate interest|
|Providing a personalised client service||Necessary for the performance of a contract|
|Logging and responding to service incidents||Necessary for the performance of a contract|
|Managing recruitment applications||Legitimate interest (employment)|
|General business to business collaboration||Consent or Legitimate interest Necessary for the performance of a contract|
|Use of data analytics to improve the properties, products/services, marketing, customer relationships and experiences||Consent or Legitimate interest|
In terms of being contacted for marketing purposes AuraQ may contact an individual for additional consent where required. When AuraQ processing of PID is based upon consent, and all individuals have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
AuraQ collect PID about applicants through the application and recruitment process, either directly from candidates or sometimes from an employment agency, a referrer, a referee, or background check provider. This would be used in:
▪ determining eligibility and suitability for initial employment, verification of references and qualifications.
▪ determining the terms on which an applicant would work for AuraQ.
▪ checking applicants are legally entitled to work in the applicable region.
▪ preventing and detecting fraud.
▪ quality and diversity monitoring complying with legal or regulatory requirements, communicating about the recruitment process and keeping records relating to the recruitment process.
It is in AuraQ’s legitimate interests to use the above data in determining whether a person would be suitable for a role, and if it’s beneficial to the business to do so. AuraQ may pass PID to recruitment partners and background check providers. In any event, AuraQ is committed to ensuring that the PID AuraQ collects, and uses is appropriate for these purposes and does not constitute an invasion of privacy.
AuraQ employs physical, administrative, technical safeguards and measures to protect the information AuraQ processes from unauthorised access, improper use or disclosure, unauthorised modification, and unlawful destruction or accidental loss. AuraQ staff and third parties with access to PID are required to respect and observe this policy. AuraQ will limit access to only those persons with a legitimate need to access the PID. AuraQ servers are maintained in secure facilities, both physical and cloud-based.
If there is any suspicion of misuse, loss, or unauthorised access to an individual’s PID, please inform the DPO immediately by emailing firstname.lastname@example.org.
AuraQ will not sell, rent, or otherwise disclose PID to any third-party without prior consent, except in the following circumstances:
- AuraQ shares non-personal, non-individually identifiable information in aggregate form with third parties for business purposes.
- AuraQ discloses PID to any appropriate third-party or legal authority if it is believed that an individual is involved in any illegal or harmful conduct; if AuraQ are required to do so by law; or if AuraQ believe that such action is necessary to (1) comply with the law or with legal process; (2) protect and defend AuraQ rights and property or that of AuraQ clients; (3) prevent fraud; (4) protect against abuse, misuse or unauthorised use of AuraQ websites; or (5) protect the personal safety or property of AuraQ clients, other persons, or the public (e.g., if an individual providesfalse or deceptive information about themselves or attemptsto pose as someone
else, AuraQ will disclose such information about the individual as necessary to assist any type of investigation).
- AuraQ may retain third parties to provide services to AuraQ, such as technical, administrative, logistical, or professional services. These third parties may have access to PID needed to perform their functions, but not for any other purposes. Any such third-party will be bound by contractual and confidentiality agreements not to disclose any PID for any other purpose.
- Changes of business ownership and control.
- AuraQ may, from time to time, expand or reduce its business and this may involve the sale of certain divisions or the transfer of control of certain divisions to other parties. PID provided will, where it is relevant, be transferred. The division and/or the new owner or newly controlling party will, under the terms of this policy, be permitted to use the PID for the purposes it was originally supplied to AuraQ.
If your PID is transferred across AuraQ group entities or to external third parties and service providers located outside the European Economic Area (EEA) in countries not offering adequate protection of PID, AuraQ shall put in place appropriate and suitable safeguards to protect individuals PID, such as model clauses approved by the EU Commission.
Use of data
AuraQ will process (collect, store and use) the PID provided in a manner compatible with the applicable data protection laws and regulations. AuraQ will keep PID accurate and up-to-date, and not keep it for longer than is necessary for the purposes set out above in Section 3: Your information. AuraQ is required to retain information in accordance with laws and regulation, such as that needed for income tax and audit purposes. How long certain kinds of PID should be kept may also be governed by specific business-sector requirements and agreed practices. PID may be held in addition to these periods depending on individual business needs.
Any PID submitted will be retained by AuraQ for as long as an individual uses AuraQ’s services, systems, sites or for as long as they remain opted into communication preferences. PID that is submitted through any communications system that is provided may be retained for a longer period.
Unless obliged or permitted by law to do so, and subject to Section 6: Information sharing, PID will not be disclosed to third parties except to third-party service providers who provide services such as website hosting, data analysis, email delivery and auditing.
All PID is stored securely in accordance with the principles of the Data Protection Act 2018.
Any or all of the above PID may be required by AuraQ from time to time in order to provide the best possible service and experience when using AuraQ’s services and systems. Specifically, PID may be used by AuraQ for the following reasons:
▪ Internal record keeping
▪ Improvement of our products/services
▪ Transmission by email of promotional content that may be of interest
▪ Contact for market research purposes which may be done using email, telephone, or mail. Such information may be used to customise or update the website.
If subscribed to, AuraQ will use the subscription email addressto send any updates. Un-subscription may be performed using the link in any correspondence or by emailing email@example.com. If details of the retention periods applied to the different aspects of an individual’s PID is required, please contact the DPO by email at firstname.lastname@example.org.
AuraQ does not use any automated or profiling systems for processing PID
Under what circumstances will AuraQ contact an individual?
AuraQ’s aim is not to be intrusive and does not ask irrelevant or unnecessary questions. An individual may be contacted during normal business as usual activities for the performance of a contract, where there has been consent, or through a legitimate interest.
What PID does AuraQ hold on an individual?
Upon request, AuraQ will confirm what PID is held on an individual and how it is processed. An individual has the following rights, which may be applicable in certain circumstances and may be subject to certain conditions, exemptions or exceptions as set out in applicable data protection legislation:
▪ Right of access. The right to obtain confirmation about whether PID is being processed and, if so, to obtain access to such PID and information regarding its processing.
▪ Right to rectification. The right to correct incorrect, update, or complete PID, and have the recipients to whom PID was provided, informed of the rectification.
▪ Right to erasure. Subject to certain conditions, individuals have the right to have their PID erased. If PID was made public, AuraQ will take reasonable steps to inform the data controllers who are processing the PID of any request for erasure and to inform the recipients of PID of the request to erase.
▪ Right to restriction of processing. Subject to certain conditions, individuals have the right to obtain restrictions on the processing of their PID, and, in case of restriction, have the processing limited to mere storage.
▪ Right to data portability. Subject to certain conditions, an individual has the right to be provided with their PID, which can be reused as they wish. If requested, AuraQ has the obligation to transfer PID directly to another data controller.
▪ Right to object. Individuals have the right to object to the processing of their PID based on certain grounds and the right at all times to object to the use of their PID for direct marketing purposes.
▪ Right to withdraw consent. If an individual has given their consent to the processing of their PID, they have the right to withdraw that consent at any time, without such withdrawal affecting the lawfulness of processing based on consent before its withdrawal.
▪ Automated individual decision-making, including profiling. In the case of automated individual decision-making, individuals have the right to obtain human intervention, give their point of view, receive an explanation for the automated decision, and challenge that decision.
▪ Right to lodge a complaint with the supervisory authority. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO); their contact details can be found at https://ico.org.uk.
How to request information
In the first instance, please contact the DPO by emailing email@example.com, or telephoning +44 (0)1684 571960. The DPO will respond back as required and will require appropriate and valid proof of identity before any details of PID are shared.
AuraQ is not responsible for the privacy practices of other websites that may be accessed from an AuraQ website. This policy does not apply to the collection or use of PID by other websites.
AuraQ may need to modify this policy occasionally to reflect business changes or the ways in which information is used. If AuraQ amends this policy, AuraQ will post those changes in a revised policy accessible from AuraQ websites. Unless otherwise stated, AuraQ will use information in accordance with the policy in effect when the information was collected. If AuraQ materially changes the way AuraQ uses or discloses PID that was collected under a different version of this policy, AuraQ will notify affected individuals via email and provide a reasonable opportunity to opt-out of the revised use or disclosure (which may cause a person to be completely removed from AuraQ databases).