Company Privacy Notice – Elaine Ball Ltd
This Privacy Notice sets out how Elaine Ball Ltd (the Data Controller) collects and uses your personal data. When we refer to “we”, “us” “our” or “controller” in this Privacy Notice we mean Elaine Ball Ltd.
Our Privacy Notice is structured in a way for you to easily find the specific details of what we do with your personal data, depending on which processing activity you want to find out more about.
Part 1 of our Privacy Notice is information we must tell everyone regardless of your relationship with us. The remaining parts give specific information on how we use your personal data for each of the different processing activities we undertake.
Elaine Ball Ltd is the data controller for the personal data we process about you.
You can contact us regarding the use of your personal data via one of the following ways:
We do not have a legal obligation under GDPR to appoint a Data Protection Officer, however members of our team and the Director(s) oversee our data protection compliance with the General Data Protection Regulation, the Data Protection Act 2018 and any other relevant privacy laws (e.g. the Privacy & Electronic Communication Regulations 2003). The various ways you can contact us to discuss any data protection issues or concerns are shown in the “Our contact details” section.
We obtain your personal data either directly from you or indirectly from third parties.
Directly
We obtain personal data directly from you, i.e. you have given your details to us, when you:
We may sometimes obtain your personal data indirectly and from third party sources, these may include:
When gathering and using your personal data we must have a legal basis to do so
– this is a requirement of data protection law.
The legal basis we rely on to process your personal data varies depending on the processing activity undertaken. The full details of the processing activities we undertake along with the legal basis we rely on to process your personal data are given in the specific Parts of this privacy notice.
We may sometimes have to process your personal data in order to comply with a legal/regulatory requirement. In these cases we will rely on the legal basis of “legal obligation” as the processing is necessary for us to fulfil our legal obligation to which we are subject to.
Depending on the purpose and legal basis we rely on for processing your personal data, there are various rights available to you. You can:
We do not undertake any solely automated decision making, including profiling, about you.
To find out more about how to exercise your rights please refer to the guidance on the Information Commissioner’s Office website.
You do not need to pay a fee to us to exercise any of your rights. However, if your request is manifestly unfounded or excessive we are allowed to charge a reasonable fee or refuse the request.
We shall respond to a valid request within one month of receiving it.
If you wish to exercise one of your rights, please contact us via one of the methods shown in the “Our contact details” section.
If you are not happy with how we are processing your personal data or you believe we have not dealt with one of your rights correctly you are entitled to make
complaint to the Information Commissioners Office (ICO). The ICO has several ways in which you can get in touch with them, including post, email, and online forms. For full details how to make a complaint please refer to their website.
We do not share, sell or rent your personal data to other businesses for them to use for their own marketing purposes.
We do not currently undertake any data sharing activities with other businesses (this includes both routine and ad-hoc data sharing). Should this change in the future we will update our privacy notice to reflect this processing activity. We will always comply with relevant data protection laws should we enter into any data sharing with another business.
We may use data processors to help us fulfil our services/delivery of goods to you.
If we use other business/es to process personal data on our behalf (they are known as data processors) to enable us to provide our services/delivery of goods to you we will ensure we have appropriate UK GDPR compliant contracts in place with each one.
The data processor is not allowed to do anything with your personal data other than what we have instructed them to do with it. They will not share your personal data with any other business apart from us, unless they are required to do so by law. They will hold it securely and retain it for the period we instruct.
Our data processors may include but may not be limited to:
Sometimes it is not possible for us to store or process your personal data wholly in the UK. When your personal data does need to be transferred or stored outside of the UK we make sure we comply with the specific requirements set out in UK GDPR for us to undertake this. We will only transfer personal data outside of the UK when one of the following provisions are in place to safeguard your personal data:
If we are unable to rely on any of the above provisions we will rely on your explicit consent to make the transfer of personal data, unless another exception under UK GDPR applies to allow us to process your personal data.
As part of our Get Kids into Survey programme we may sometimes use photographs, names and ages of children supplied by parents’ on our social media platforms. We will only ever publish these with consent of the parent or guardian. No contact details are ever published.
Google analytics Cookies:_ga
We use Google Analytics to carry out statistical analysis of page use, page interactions and paths through the Website to evaluate and develop our Website. This is known as ‘digital analytics’. We may also record certain information that customers provide during a Website purchase or other process.
This information allows us to understand individual behaviours and needs more accurately.For more information on how Google uses the data collected via this service, see here: http://www.google.com/policies/privacy/partners/
To opt out of being tracked via Google Analytics, you can also use Google’s opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
Some of our web pages also use additional cookies related to our lead management processes, which help us to track your engagement with our content. No personal data is collected until you choose to provide it via one of our webforms. At that time, your visitor engagement profile may be linked up with your personal data profile so that we have a fuller understanding of your customer journey and the areas of our business activities that interest you the most. Those relevant web pages give you the opportunity to opt in or out of these cookies.
Our website may provide links to websites of other organisations. Our Privacy Notice does not cover how those organisations process your personal data when you visit their website. We advise you to read their Privacy Notices.
We keep our Privacy Notice under review to ensure it remains accurate and up to date and we reserve the right to modify this policy at any time. Changes to this notice will be posted on our website and you should endeavour to review the notice frequently.
If you have any questions about our Privacy Notice, please contact us via one of the ways shown in the “Our contact details” section.
We provide the following services predominantly for Surveyors and Geospatial Professionals:
When you enquire about our services or purchase our services we need to collect some personal data about you and sometimes about your employees in order for us to provide information about our services or deliver our services to you. At all times we will only collect the necessary amount of personal data about you and your employees to provide the particular service to you.
The personal data we need for each service type is:
| Enquiries about our services |
Geospatial Marketing Workshops |
Marketing Implementation | Geospatial Marketing Academy |
Get Kids into Survey |
| Name and Contact details, which includes: postal address Email address Telephone number Social platforms contact details |
Name and contact details of main person we will liaise with to deliver this service to youName and contact details of delegates attending the workshops | Name and contact details of main person we will liaise with to deliver this service to youName and contact details of your staff who we will be working with us | Name and contact details of main person we will liaise with to deliver this service to youName and contact details of your staff who will be attending the Academy | Name and contact details of main person we will liaise with to deliver this service to youName and contact details of your staff who we will be working with us |
We generally gather your personal data directly from you when you either enquire about our services or enter into a contract with us to purchase one of our services.
However, we may also collect some personal data indirectly. Generally this is likely to come from your manager or another work colleague, for example, if we need details of who is attending our workshops.
We use your personal data to:
The legal basis we rely on for these purposes are:
Contractual obligation (GDPR Article 6(1)(b))
The services we provide to you are done so under contract when we are providing a service to you or with a view to entering into a contract with you when you enquire about our services.
We require certain information from you to enable us to fulfil our contractual obligation. If you are not able to provide all the information we need we may not be able to provide the service to you and the arrangement may need to be terminated.
Legitimate interests (GDPR Article 6(1)(f)
GDPR allows us to use legitimate interests for direct marketing purposes in certain circumstances. We have undertaken a legitimate interest assessment, which balances our business purposes for the processing against your right to privacy.
The outcome of the balancing test justifies our use of legitimate interests for this purpose as it would not be an unreasonable expectation for anyone who either enquired about our services with a view to purchasing them, or is an existing customer using our services to receive information from us about our services.
This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003, which governs how a business can undertake electronic direct marketing. We can rely on soft opt-in for “individual subscribers” for email marketing to prospective and existing customers. We do not need consent or soft opt-in for “corporate subscribers”.
We always give you the opportunity to object to receiving marketing communications from us, when we first collect your personal data and with every marketing communication thereafter.
When we have concluded the provision of our service to you we will keep your data for a period of 6 years from the end of our accounting year before it is securely disposed.
Marketing contact details are held for as long as you want to remain on our marketing contact list.
Yes, we use the following data processors:
When you enquire about our merchandise or proceed to buy (including but not limited to purchase made online, in person, and/or by telephone) any of our merchandise we need to collect the following personal data from you:
We gather your personal data directly from you when you enquire about our merchandise or place an order with us to purchase.
We use your personal data to:
Contractual obligation (GDPR Article 6(1)(b))
The products we sell to you are done so under contract or with a view to entering into a contract with you. We require certain information from you to enable us to fulfil our contractual obligation. If you are not able to provide all the information we need we may not be able to provide the products to you and the arrangement may be terminated.
Legitimate interests (GDPR Article 6(1)(f)
GDPR allows us to rely on legitimate interests for direct marketing purposes. We have undertaken a legitimate interest assessment, which balances our business purposes for the processing against your right to privacy. The outcome of the balancing test justifies our use of legitimate interests for this purpose as it would not be an unreasonable expectation for anyone who has enquired about our products or made a purchase to receive news and information from us.
This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003 (PECR), which governs how a business can undertake electronic direct marketing. We can rely on soft opt-in for “individual subscribers” (as defined by PECR) to undertake email marketing to both existing and prospective customers.
We always give you the opportunity to object to receiving marketing communications from us, when we first collect your personal data and with every marketing communication thereafter. You can change your marketing preferences at any time by clicking the “unsubscribe” link in the marketing email you receive.
We keep product purchasing data for a period of 6 years from the end of the financial year that the product was purchased before it is securely disposed.
Marketing contact details are held for as long as you want to remain on our marketing contact list.
Yes, we use the following data processors to deliver our service to you:
To receive electronic marketing communications from us we may only need the following personal data:
We gather your personal data directly from you when you sign up to receive marketing information from us via our website.
We need your personal data to be able to send you relevant news about us and our services, etc that you have subscribed to receive.
The legal basis we rely on is:
Consent (GDPR Article 6(1)(a)
By submitting your contact details to receive marketing from us you have given your consent for us to use your personal data for this purpose.
You always have the right to withdraw your consent to receive marketing, you can do this by clicking the “unsubscribe” link in the marketing email you receive or contact us directly and ask to be removed from our mailing list.
Marketing contact details are held for as long as you want to remain on our marketing contact list.
Yes, we use the following data processors: Mailchimp;
If you enquire about being a sponsor or become one of our Get Kids into Survey sponsors we will need the following personal data:
You can also provide us with any other information you feel is relevant for the sponsorship programme.
We do not collect any of the special categories of personal data.
We obtain personal data directly from you, for example when you get in touch with us to discuss being one of our sponsors or when you give us your details at a networking or trade event.
We may also obtain your personal data indirectly from publicly available sources. We will only obtain the necessary amount of personal data, such as name and contact details, that is relevant to the sponsorship programme and we will only use it for the purpose of approaching you with a view to entering into a discussion with you about you potentially becoming one of our sponsors.
We need your personal data to be able to have a discussion with you about you becoming one of our sponsors. This will either be at your request or we may approach you as we have identified you as someone who operates within the geospatial sector.
The legal basis we rely on are:
Contractual obligation (GDPR Article 6(1)(b))
When you enquire about becoming one of our sponsors this is done with a view to entering into a contract with you and if you then become one of our sponsors it is done so under contractual arrangements.
We require certain information from you to enable us to fulfil our pre-contractual and contractual obligations. If you are not able to provide all the necessary information we need we may not be able to use you as a sponsor and any arrangements we have entered into may need to be terminated.
Legitimate interests (GDPR Article 6(1)(f)
GDPR allows us to rely on legitimate interests for direct marketing purposes. We have undertaken a legitimate interest assessment, which balances our business purposes for this particular processing activity (to contact you about becoming one of our sponsors) against your right to privacy. The outcome of the balancing test justifies our use of legitimate interests for this purpose as we believe it would not be an unreasonable expectation for a business operating within the geospatial sector to be contacted by another business within that sector to discuss work collaborations and opportunities..
This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003 (PECR), which governs how a business can undertake electronic direct marketing. We do not need consent to market to “corporate subscribers” (B2B) (as defined by PECR) to undertake electronic marketing.
We will always give you the opportunity to object to receiving marketing communications from us, when we first collect your personal data and with every marketing communication thereafter. You can change your marketing preferences at any time by clicking the “unsubscribe” link in the marketing email you receive.
Generally, sponsors contact details are held for as long as you want to remain on our list of potential and existing sponsors. However, we do undertake a refresh of our sponsors list every 2 years to ensure it remains as up to date as possible.
Yes, we may use the following data processors for you to become a Sponsor/Brand Ambassador:
For us to pay you for the service or goods you have provided to us we need to collect and use a small amount of information about you and your business, this is also likely to include some information about the individuals who work at your business. The personal data we are likely to need is:
We obtain your data directly when we start to use your services or have purchased goods from you. We gather the relevant information from you to enable us to process payment to you for those services and goods.
We also obtain some data, such as your business name and contact details, indirectly from publicly available sources or recommendations from 3rd parties to enable us to contact you to enquire about the services and goods you provide prior to us making a purchase.
We need your personal data to either enquire about the services or goods you provide that we may be interested in purchasing or to make a purchase. We then use your personal data to pay for those goods and services when you invoice us or to raise any queries about the payment.
The legal basis we rely on are:
Contractual obligation (GDPR Article 6(1)(b))
The services or goods you have provided to us are done so under contract or with a view to entering into a contract (i.e. we have asked you for a quote for the goods or to undertake the service for us).
We require certain information from you to enable us to fulfil our part of the pre-contractual and contractual obligations, e.g. we need to have certain
information to make the purchase and to process payment. If you are not able to provide all the necessary information for us to do this, we will not be able to purchase the goods or services you provide or be able to make payment once purchased.
Legal obligation (GDPR Article 6(1)(c))
We have a legal obligation to pay for any services or goods we have purchased.
Our Accountant will see personal data relating to suppliers and any payments we make.
We keep all financial data (which includes supplier information) for 6 years from the end of the financial year it relates to before it gets securely disposed.
Yes, we use the following data processors:
When you apply for a job with us you will need to provide some or all of the following information as part of the job application process:
Depending on where you get to in the recruitment stage will determine what personal data you will need to provide.
We collect information directly from you when you submit your application form or your CV to us for a job you are applying for.
We will also collect information about you from your referees as you progress along the recruitment process.
We need your personal data to be able to process your application for a job with us, which includes, but is not limited to:
The legal basis we rely on to undertake our recruitment activities includes: Contractual obligation (GDPR Article 6(1)(b))
The processing of your job application is necessary in order for us to take steps at your request before entering into a possible employment contract with us.
We require certain information from you to enable us to fulfil our employment pre-contractual and contractual obligations. If you are not able to provide all the necessary information we need we may not be able to process your application and consider you for one of our job vacancies.
Legal obligation (GDPR Article 6(1)(c))
We have certain obligations under employment law in relation to recruitment and selection and equal opportunities that we must comply with.
Processing for employment law (GDPR Article 9(2)(b))
Information you provide to us that relates to special category personal data, such as health, religious or ethnic information is necessary for our recruitment and selection purposes as it relates to our obligations in employment law.
Processing to assess working capacity (GDPR Article 9(2)(h))
We have certain obligations to assess your health in relation to your ability to work for us.
We do not use any data processors.
All unsuccessful candidate details are kept for 2 years from the end of the recruitment process they relate to.
Successful candidate details are transferred to their employment record and kept in line with our retention schedule.
This Privacy Notice was last updated 24th February 2022.