PRIVACY STATEMENT
Please get in touch if you have any questions about Database First Aid Limited’s GDPR / Data Security / Privacy Statement / Corporate Social Responsibility, which is:
Charity
We support two local charities with time and monetary contributions. They are local Solihull school’s PTA and the local Scout groups. All the contributions they receive go directly into making local kid’s lives that little bit better. Apart from the scout hut that needs maintenance and utilities, none of the money the groups receive is for admin or staff costs etc (everyone is voluntary). Your details are not shared with them in any way shape or form.
Cookies and Website tracking
Database first aid uses two website monitoring software products to understand who is visiting the website (details at bottom of privacy statement). When you visit our website, software tracks the active business IP address and matches it to further business details they hold in their database, then shows details and contact details such as business name and key business decision makers. Database First Aid considers this a legitimate interest under GDPR. We only deal with business to business customers and clients, and so website visitors are covered under legitimate interest. The software identifies the business visitor (as opposed to the individual visitor) through tracking a company IP. Google Analytics stores cookies on your computer when you visit the site. Google Analytics allows the use of their features that include retargeting to inform you about the product and services with identifiers through Google’s network. You are given the option to accept Google’s cookies or not when using this site.
Legitimate Interest to contact you
We do not deal with private individuals. We are only a business-to-business operation. By making contact with us (whether you give us your corporate or private email address) in a business context, whether you buy our products or services, contact us from the website, download a free eBook or guide, subscribe to newsletters, make an enquiry, meet at a trade or networking event etc, we are taking this as a legitimate interest / implied consent to keep your details and contact you from time to time about our services. You can object at any time and ask to be removed, not contacted, or unsubscribe from the newsletter if we send it to you. You will only be sent the newsletter if you specifically sign up to it.
Unsubscribing from our newsletter emails
All newsletter emails offer you an easy unsubscribe facility. Unsubscribing in no way affects the service you receive from us, now or in the future. It just means the email software we use to send the newsletters will stop sending you anything. We WANT you to unsubscribe if you don’t want our hints, tips, alerts and newsletter emails.
What information is stored about you when you subscribe to the newsletter
If you sign up for newsletters, then we will store your email address. You can unsubscribe anytime, there will always be an unsubscribe link at the bottom of every newsletter. Once you unsubscribe, that’s it, the system will not send to that address again, ever. We use a variety of email, website and database software (details at bottom of privacy statement). Once you stop interacting with the newsletter (i.e. you don’t open them or clicking in them), our software will stop sending them to you automatically – no point sending you stuff you don’t really want after the initial keen phase. Our software can track if you open an email, click in a link and what website pages you visit.
What information is stored about you when you make contact
If you make contact, we will store the information you pass to us in Promptr – yes, we use our own CRM system. We need this to get back in touch with you, or work with you (and your colleagues). We will delete your details after a period of time after our last interaction or communications (retention details at bottom of privacy statement). You can object to us holding your information at any time. We may also store details about our interactions with you, either by email, phone or in person. As should you with the contacts you meet. The information we store depends on what you gave us and what we can find about you in the public domain (for instance, we may look you up on your website or LinkedIn and add that URL link into your details in our systems so we have a better understanding of who you are and can improve our service offering to you. Your contact details will never be passed to any other company (other than suppliers and subcontractors). You can object at any time. If we run a joint event, you will be informed at that time that responding to any such event will mean your data will be shared between the organisers. All of the information we store on a person (the data subject) is for them within a business to business context. We do not deal with the general public (consumers). Some information on people will be taken from their organisation’s website, LinkedIn profile, Facebook profile or purchased mailing lists, or business card.
ICO
Database First Aid Limited is registered as a Data Controller with the Information Commissioners Office (Ref: ZA156625).
GDPR legal advice
We do not offer GDPR legal advice. We do not offer legal advice. None of the staff here are lawyers. We know some rather good ones if you want the introduction. We offer advice about CRM, database, data and email Marketing – within the GDPR as per our understanding from the ICO’s website.
Subject Access Request
You are allowed to request to see the information stored about you at any time. You will need to provide UK Government approved photo proof of who you are before asking to see a copy of your information – as it might not be ‘you’ asking to see ‘your’ details. Once we have received valid proof of your identify, you will be sent the information we hold on you within the time period as stated by the GDPR. You will receive all the information where it is in a filed format that we can access. You are not obliged to pay for this service.
Right to be forgotten
If you request to be deleted from our database, we will ensure your contacts details are tagged as ‘do not contact’ and ‘unsubscribed’ so that you do not get any more emails from us. We will also clear most of your information in our systems. We will keep your basic details, so that if anyone else in our organisation goes to re-add you in the coming months or years, they can see that you have already requested not to be contacted, and so will not re-add you. If you do not agree with this safety measure, please explicitly mention this when getting in contact. Please be aware that if we 100% delete your details from our systems, we will have no record that you have requested no further contact and you might one day be re-added (as nobody will be able to have any ‘checks-and-balances’).
Data accuracy
We are keen to keep the details about you accurate. You can see much of the information we store on you by clicking on the relevant link at the bottom of every email we send you.
Data security
Promptr is a SaaS piece of kit, hosted on AWS (Amazon Web Services) and the information that travels from your site and emails is encrypted via SSL. If you are a client, we may need to keep more detailed records about you – for instance, the password to any software that we access on your behalf. Once this is not needed, we delete any references to passwords, and inform the client to remove our access from their account. Any data stored in our computer systems is password protected, encrypted, and in some cases, the file locations of this information, hidden. We have a clear desk policy and no electronic or paper records are left unprotected that could identify an individual. No suppliers and sub-contractors have access to the information we store about you. If we do need to share your details with suppliers, for instance, if a sub-contractor was to combine your data sources for us, or send our marketing emails on our behalf, we would have an appropriate written contract and policy with them. We need to do this to enable any representative of ours to get in touch with you if needed. When we have finished with paper copies, we shred the paperwork. When we have finished with any electronic copies of information, we securely trash the documents with special software. If you provide data on your own clients and contacts as part of our work agreement, once it has been processed for the intended purpose, it is securely deleted from computers (and backups). Our premises are never left unlocked and our computers are password protected and upgraded when any updates and patches are produced by the suppliers. Everyone who works for the business is given training (plus re-training at regular intervals) on data security. Nobody has the passwords to my computer. I change my password to it each earth month. My computer is encrypted.
Data Breach management
If we were to spot that a breach of data (i.e. identifiable personal or sensitive details about staff, clients, or your contacts) and the information could be made available where it should not have been, we have a process to work out if it caused anyone risk, how to resolve it and if it should be reported to the ICO.
Personal and sensitive data
We do not store information like race, religion, medical history, political party support, or sexual orientation (for instance). We store the information you share with us in the process of business and that which helps our business relationship and help improve the level of service you receive from me. We do this, not only because that’s our promise to you, but keeping loads of non-essential data correct is a complete and utter hassle. Quite frankly, this type of data doesn’t help us to help you, so we don’t want it. That would be a good hint for yourself in managing your own database by the way. Where we store your bank details for payment of our invoices, this is held in our automated payment system and we cannot see fields, like your card security number.
Data Protection Officer
It is not mandatory for us to have a separate Data Protection Officer employed. For GDPR queries, the firm’s DPO equivalent is Simon McNidder.
Data Retention period
We will keep your data for as long as relevant. For instance, if you ask us to help you, will will keep your details for contacting purposes for at least 5 years after our last communication (2 years otherwise). This is so to keep you informed about CRM issues that might affect you.
Facts and Figures
Database First Aid Limited is registered in England & Wales (registration number: 09779518). Database First Aid is VAT registered (VAT reg no: GB223750134). Database First Aid is registered with the Information Commissioners Office (reg no: 223750134). Database First Aid’s registered office address is The Colmore Building, 20 Colmore Circus, Birmingham, B4 6AT. The systems used where your information could be stored is: Google Analytics, Lead Forensics, WordPress, FreeAgent, GoCardless, Mailchimp, PopCorn, MatchIT, Microsoft Outlook/Word/Excel/Access, Phones and data backups in the cloud (AWS/Amazon Web Services and Microsoft Azure). We may need to share your details with our Accountants (for invoicing), Financial Advisers and Accounting software, staff, suppliers and subcontractors (for servicing your CRM system). Did you get this far? If you did, let us know and we’ll bung £5 into one of Solihull’s local Scout’s fundraising buckets.