Data Privacy & Protection Policy

Practical Business Improvements Ltd is registered in Scotland (SC457198). Our registered office and principal place of business is 6 Goodhope Lane, Bucksburn, Aberdeen, Scotland, AB21 9NH.

This Data Privacy & Protection Policy (together with any other documents referred to in it) sets out how and why we process any Personal Data we collect from you, or that you provide to us.

Please read this notice carefully as it contains important information on who we are and how and why we collect, store, use and share your Personal Data. It also explains your rights and how to contact us or our supervisory authority in the event you have any concerns we are unable to address.

When we use your Personal Data we are required to do so in accordance with the General Data Protection Regulation (GDPR). We are responsible as ‘controller’ of your Personal Data for the purposes of the GDPR. We will use your Personal Data in accordance with your engagement with us and your instructions, the GDPR, other relevant UK and EU legislation and our professional duty of confidentiality.

To learn more about our use of cookies and similar technologies, please see our Cookie Notice.

Personal data we collect

People who use or enquire about our services

We ask for your Personal Data as it enables us to provide our service to you. If you do not provide the Personal Data we request, it may delay or prevent us from providing services to you.

Personal Data we will collect:

• Your name
• Your company
• Electronic contact details, e.g. your email address and mobile phone number
• Information relating to the service you are seeking our advice on

Visitors to our website

Our website uses cookies or other tracking technologies to record visits to the website (www.pbi-ltd.co.uk) and engagement with our communications . This helps us to improve our website and communications and in turn provide you with a better experience when you are browsing. When someone visits our website we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is not processed for the purpose of identifying anyone and is processed in aggregate. We do not make any attempt to find out the identities of those visiting our website.

If we do want to collect Personal Data through our website, we will be up front about this. We will make it clear when we collect Personal Data and will explain what we intend to do with it.

Please see our Cookie Policy for more information.

Booking training via our website

The Personal Data we collect from participants in training booked via our website:

• Your name, email address and telephone number
• Name of your organisation and job title
• Information relating to the training in which you are booking with us
• Payment details
• Dietary or access requirements (Physical training only)

We utilise the services of Eventbrite who specialise in event management for scheduling and booking of training. Here is a link to Eventbrite’s privacy policy

Job applicants and potential consultants

Within the definition of job applicants, we include individuals applying for vacation scheme placements or work experience. Personal Data we may collect includes:

• Your name
• Your qualifications
• Work history
• Your address and phone number
• Professional membership details
• Details of your professional and personal online presence, e.g. LinkedIn profile
• Your employment status and details including salary and benefits
• Your nationality and immigration status
• Information about any disability you may have
• Information about criminal offences
• Electronic contact details, e.g. your email address and mobile phone number
• Any interview notes or assessments you may have completed
• References and other information relating to past employment

How your data is collected

We collect most of this information directly from you via the website and direct emails sent to and from any @pbi-ltd.co.uk address. We may also collect information from other sources:

• Via Social Media Platforms
• Depending on your privacy settings for social media services, we may also access information from those accounts or services
• When you interact with us on Facebook, Twitter, Instagram or LinkedIn

How and why we use your data

We can only use your Personal Data if we have a proper reason for doing so, e.g.

• to comply with our legal and regulatory obligations;
• for or in the performance of our service with you or to take steps at your request before entering into a contract;
• for our legitimate interests or those of a third party; or
• where you have given consent.

We won’t share your information with any other organisations for marketing, market research or commercial purposes, and we don’t pass on your details to other websites.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use (process) your Personal Data for and our reasons for doing so:

What we use your Personal Data forOur reasons and the legal basis for processingTo provide professional services to you (or in relation to you – not directly to you) For the performance of our service with you or to take steps at your request before entering into a contract.Ensuring business policies are adhered to and operational reasons, such as improving efficiency, training and quality control.For our legitimate interests or those of a third party, e.g. to make sure we are following our own internal procedures so we can continuously improve our service. Ensuring the confidentiality of commercially sensitive information.For our legitimate interests or those of a third party, e.g. to protect our intellectual property and other commercially valuable information. To comply with our legal and regulatory obligations, for instance regulations to combat insider trading and other market abuse.Preventing unauthorised access and modifications to systems.For our legitimate interests or those of a third party, e.g. to prevent and detect criminal activity that could be damaging for us and for you To comply with our legal and regulatory obligationsUpdating client records.For the performance of our contract with you or to take steps at your request before entering into a contract. To comply with our legal and regulatory obligations. For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our clients about existing and new servicesStatutory returns and regulatory returnsTo comply with our legal and regulatory obligationsEnsuring safe working practices, staff administration and assessmentsTo comply with our legal and regulatory obligations For our legitimate interests or those of a third party, e.g. to protect the wellbeing and ensure the safety of you and our peopleMarketing our services to: existing and former clients; and third parties who have expressed an interest in our servicesFor our legitimate interests or those of a third party, i.e. to promote our business to existing and former clients

How we use personal data relating to other individuals collected from you

In the course of providing you with our services, you may provide us with personal data of individuals who are not aware of our involvement or of our processing of their personal data (for instance, personal data of employees in the course of a proposal review). In such situations, we are not likely to have any direct contact with individuals whose personal data we are processing, or it may for other reasons (for instance, to maintain confidentiality) not be appropriate for us to provide them with a privacy notice setting out how we process their personal data. Before you pass any such personal data to us, you must therefore ensure that the relevant individuals have received any requisite privacy notices in connection with the performance of our services. Additionally, please direct any individuals who interact with us on your behalf to this Privacy Notice, a link to which is also contained in the footer of our emails.

Promotional Communications

We may use your Personal Data to send you updates (by email, telephone or post) about industry developments that might be of interest to you and/or information about our services, including exclusive offers, promotions or new services or products.

We have a legitimate interest in processing your Personal Data for these purposes (see above ‘How and why we use your Personal Data’). This means we do not usually need your consent to send you these communications. However, where consent is needed, we will ask for this consent separately and clearly. You have the right to withdraw this consent at any time.

We will always treat your Personal Data with respect and never sell OR share it with other organisations outside this Firm for marketing purposes.

If you would prefer not to receive any promotional communications, you can request this at any time by:

• Emailing your request to admin@pbi-ltd.co.uk; or
• Using the ‘unsubscribe’ link in emails.

We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

Where is your data held

All electronic information is held on cloud based servers of our software providers with synced copies to Practical Business Improvements computers where needed

• GSuite for business
• Microsoft365 for business
• MURAL
• XERO
• HubSpot

Information may also be held by other third parties as described above (see ‘Who we share your Personal Data with’).

To deliver services or manage our relationship with you, it is sometimes necessary for us to share your Personal Data outside the European Economic Area (EEA), e.g. –

• when your or our service providers are located outside the EEA;
• If you are based outside the EEA; or
• where there is an international dimension to the matter in which we are advising you.

Many non-EEA countries do not have the same data protection laws as the United Kingdom and EEA. We will, however, take reasonable steps to ensure any such supplier has in place appropriate measures to protect your information and any contract includes appropriate clauses about the use of data e.g. if the company is based in the USA, we will confirm whether it is accredited under the EU-US Privacy Shield.

How long will your data be held

We will keep your Personal Data after our relationship has come to an end. We will do so for one of these reasons:

• To respond to any questions, complaints or claims made by you or on your behalf;
• To show details of the enquiry handling or service provided;
• To keep records required for any applicable law or regulation;
• For business management purposes.

We will not keep your Personal Data for longer than necessary for the purposes you provide it to us and as set out in This Notice. Different retention periods apply for different types of data depending on the nature of the matter you have asked us to advise on and the purpose for which it was collected. Further details are available on request.

Your rights explained

It is important that you understand what rights you have in respect of the Personal Data we hold about you. To let us know that you wish us to exercise any of your rights outlined below, unless stated otherwise, please do this by either contacting the individual responsible for your matter or by emailing admin@pbi-ltd.co.uk

The right to be informed (knowing how we will use your data)You have the right to be told how we will use your Personal Data – which is set out in This Notice. We also provide you with additional notices when you provide us with your Personal Data.The right of access (being provided with copies of your data)You have the right to ask us to provide you with a copy of your Personal Data. We will supply any information you ask for as soon as possible but may take up to 1 month once we are satisfied as to your identity. We will not charge you for this. This is called a data subject access request.The right to rectification (changing incorrect information we hold)If you believe our records are inaccurate you have the right to ask for those records concerning you to be updated. Contact details for any requests can be found above.The right to be forgotten (erasure) (requesting deletion of your Personal Data)In some cases, you have the right to be forgotten (i.e. to have your Personal Data deleted from our database). Where you have requested that we do not send you marketing materials we will need to keep some limited information in order to ensure that you are not contacted in the future.The right to restrict processing (limiting how we use your data)In certain situations you have the right to ask for processing of your Personal Data to be restricted because there is some disagreement about its accuracy or legitimate usage.The right to data portability (moving your data in a useable format)You have the right to request the Personal Data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situationsThe right to object (when we must stop processing your data)You have the right to object to us processing data purely for our legitimate interests. If you make such a request, we must stop processing your Personal Data unless: we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms; or the processing is for the establishment, exercise or defence of legal claims.Right not to be subject to automated decision making including profiling (making a decision solely by automated means without any human involvement)The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. Practical Business Improvements Ltd does not undertake automated decision making or profiling.

For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.

How to raise a concern

We hope that we can resolve any query or concern you may raise about our use of your information. In the event that we are unable to satisfy your concerns, the GDPR also gives you the right to raise your concerns with a supervisory authority. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns or telephone: 0303 123 1113. The ICO address is: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice

This Notice was published on 9th June 2020.

We may change This Notice from time to time, when we make any significant changes we will inform you via a notice on our website and within our email footers. Where it is practicable, we will notify you directly if there are any material changes to This Notice. However, we encourage you to review This Notice periodically to be informed of how we use your Personal Data.

We will only notify individuals who are directly engaging with us about these changes. We will not notify any third parties whose Personal Data we process during the provision of our services.

Cyber Essentials

During the development of this policy, PBI has undertaken a full review of how we approach the data privacy and protection of our clients information. To this end, we have chosen to use the framework set out in Cyber Essentials to ensure we are fully compliant with all of the latest UK Government Cyber security guidelines and advice. This is audited and recertified on an annual basis. This has included a full review of both hardware and software that we use as a business. We have also undertaken a full audit of our staff training to ensure that cyber security awareness is at the forefront of all our staff minds when dealing with our clients data and information.

How to contact us with any concerns or questions

Please contact our nominated Data Protection contact if you have any questions about This Notice or the information we hold about you. You can contact them by:

Post: Practical Business Improvements Ltd, 4 Braiklay Avenue, Tarves, Ellon, Scotland, AB41 7PU

Email: admin@pbi-ltd.co.uk