Privacy Policy
Our commitment
We are committed to protecting your privacy and your personal information and ensuring that your personal information is secure both with ourselves and with third parties who act on our behalf. We will ensure we always comply with all data protection laws which apply to the personal information we process. We use many tools to make sure that your personal information remains confidential and accurate, and we may monitor or record calls, emails, text messages or other communications to protect both you and us. Personal Information Personal information is any information relating to an individual who can be identified directly or indirectly, often by name, account number, location, an online identifier, or other factors specific to their identity. Personal information may include “special category data” relating to racial or ethnic origin, political opinions, religious beliefs, membership of a trade union, physical or mental health and criminal records and allegations. When we collect personal information from you, we will indicate whether it is mandatory or voluntary – this is done on the website by using asterisks to mark mandatory fields.
Force24 Cookies & Tracking
Our organisation utilises Force24’s marketing automation platform.
Force24 cookies are first party cookies and are enabled at the point of cookie acceptance on this website. The cookies are named below:
-
F24_autoID
-
F24_personID
They allow us to understand our audience engagement thus allowing better optimisation of marketing activity.
f24_autoId – This is a temporary identifier on a local machine or phone browser that helps us track anonymous information to be later married up with f24_personid. If this is left anonymous it will be deleted after 6 months . Non-essential, first party, 10 years, persistent.
f24_personId – This is an ID generated per individual contact in the Force24 system to be able to track behaviour and form submissions into the Force24 system from outside sources per user. This is used for personalisation and ability to segment decisions for further communications. Non-essential, first party, 10 years, persistent.
The information stored by Force24 cookies remains anonymous until:
-
Our website is visited via clicking from an email or SMS message, sent via the Force24 platform and cookies are accepted on the website.
-
A user of the website completes a form containing email address from either our website or our Force24 landing pages.
The Force24 cookies will remain on a device for 10 years unless they are deleted.
Other Tracking
We also use similar technologies including tracking pixels and link tracking to monitor your viewing activities
Device & browser type and open statistics
All emails have a tracking pixel ( a tiny invisible image ) with a query string in the URL. Within the URL we have user details to identify who opened an email for statistical purposes.
Link Tracking
All links within emails and SMS messages sent from the Force24 platform contain a unique tracking reference, this reference help us identify who clicked an email for statistical purposes.
Who The Information Concerns?
This privacy notice applies to personal information we (as well as any subsidiaries, affiliates, and applicable 3rd parties) process concerning the following data subjects:
➢ Visitors to our website
➢ Customers who purchase goods or services or create an account with us
➢ Our suppliers
Purposes of Processing
Website Visitors: You can visit and browse our website without providing your name or contact details. We use cookies to analyse how our site is used by visitors and to provide some of the functionality. Cookies are ways of saving a small amount of information. They are automatically downloaded to your device when you visit a website. Our site uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website which also allows us to improve our site. A cookie is a text file placed into the memory of your computer and/or device by our computers. A copy of this text file is sent by your computer and/or device whenever it communicates with our server. We use cookies to identify you. We may also collect the following information during your visit to our website and/or the fully qualified domain name from which you accessed our site, or alternatively, your IP address:
Customers:
➢ If you purchase products or services from us, we may process the information you provide us for the purposes of:
➢ Responding to your enquiries, complaints, or rights requests
➢ Providing a service or quoting for a service
➢ Keeping you informed about our products and services (including marketing)
➢ Processing your order and to follow up on orders that are not completed
➢ Arranging visits to your home (e.g., to carry out a survey or installation)
➢ Managing your account, including carrying out identity checks where relevant
➢ Managing your credit account (if applicable) including carrying out credit checks
➢ Using your purchase history to manage rebates and supplier claim backs
➢ Market research
➢ Publishing trends and/or to improve usefulness and content of our website
➢ Tracking activity on our site and to provide a more personalised online experience
➢ Linking with social media sites and services, for example, for advertising purposes
➢ Notifying you about important changes or developments to our site or services
➢ Managing deliveries, returns and refunds
➢ Processing competition entries
➢ Product liability purposes
➢ Dealing with enquiries and complaints
➢ Claims management and insurance purposes
➢ Record keeping
Suppliers:
➢ If you supply products or services to us, we may use your personal information for the purposes of:
➢ Processing and managing orders
➢ Managing deliveries, installations, returns and refunds
➢ Product liability
➢ Managing accounts, including conducting credit and other background checks where applicable
➢ Market research
➢ Notifying you about important changes or developments to our websites, services and policies
➢ Supply chain management
➢ Handling rights requests, enquiries and complaints
➢ For claims management and insurance purposes
➢ For record keeping purposes.
If you are a supplier and you have any questions about how we use your personal information, please contact your usual business contact.
Third Party Sources
➢ Information about you may also be provided to us indirectly by:
➢ Next of kin / delegated authorities
➢ Business associates
➢ Your employer in partnership/business with the Synergy LMS Group ‘Trusted Sources’:
➢ Credit / Default Agencies
➢ Financial Institutes
➢ Insurance Companies
➢ Health providers
➢ Third-party service affiliates or suppliers who have sought your consent
Call Recording
Some telephone calls may be recorded and/or monitored, for example calls to our customer services teams. Call recording and monitoring may be carried out for the following purposes:
➢ Training and quality control
➢ As evidence of conversations
➢ For the prevention or detection of crime (e.g., fraudulent claims)
Legal Basis for Processing
The legal basis we use to process your personal information may differ for each processing activity. Dependent upon the purpose for processing, as outlined above, and the business area processing your data one of the following lawful basis of processing may apply:
Article 6 (1) (a) GDPR Consent: Where your permission and consent has been provided to allow processing to be undertaken
➢ Article 6 (1) (b) GDPR Performance of a contract:
➢ Where you have set up an account with us
➢ To process your orders
➢ Where you (or your employer) have or will enter into a contract with us and we need to process your information as part of this contract
➢ To provide quotations and / or estimates as a preliminary step towards providing a service
➢ Article 6 (1) (c) GDPR Legal Obligation: Where we are bound by further laws and regulations to process your information, affecting areas such as:
o Privacy and Electronic Communications Regulation
o Crime and anti-money laundering
o Financial Services o Employment o Welfare and health and safety
➢ Article 6 (1) (f) GDPR Legitimate interests: These include:
o Suppression lists and managing communication opt-out requests
o Training, communication and awareness
o Direct marketing
o Monitoring and web analytics
o Cloud storage
o Track and trace requirements
o To keep in touch with current, past and prospective customers
o To provide online account management and related services
o To gain an understanding of how our customers interact with us so we can provide the most relevant products and services
o To monitor the use of our website and improve its facilities
As a rule, we do not collect “special category data” about visitors to our website or our customers or suppliers. The exception is where we identify suspected criminal activity such as fraudulent claims or the use of stolen payment card details. In this case we will record details of the suspected criminal activity and may take appropriate action, including refusing to accept orders, make payments or give refunds. We may also report the incident to the relevant bank or payment card issuer or to the police or other appropriate authorities.
Should we process information defined as ‘special category’ the following lawful basis for processing may be relied upon:
➢ Article 9 (2) (a) GDPR Explicit Consent: Your permission has been granted and documented directly to us
➢ Article 9 (2) (f) GDPR Establishing, exercising, or defending a legal claim: Such as litigation against a business, supplier, fraudulent person
We may also process criminal conviction data under:
➢ Schedule 1, Part 3, Paragraph 33 DPA 2018 Legal claims: In connection with legal, or potential legal proceedings, obtaining legal advice or establishing, defending and /or exercising legal rights.
We may collect and process your personal data for humanitarian purposes, such as the monitoring of epidemics and their escalated spread (Recital 46) and in compliance with those purposes as defined by the appropriate authority/government under the lawful basis of “public interests” to protect our customers and employees.
Data Sharing
Like most organisations, we engage service providers to assist us in ensuring optimum business functionality and the ability to provide continued services. We also work with a large number of suppliers who provide products and delivery services to us.
We will only provide these third parties with the information they need to deliver the service we have engaged them for and they are prohibited from using that information for any other purpose. Whenever we share personal information about our customers or visitors to our website with these third parties, we will put in place contracts which require the protection of the personal information.
Your information may be shared within Grosvenor Contracts (London) Limited for account management (including credit accounts), analysis and reporting.
Your personal data may be disclosed to the following third parties:
➢ Tax, customs, and excise authorities
➢ Regulators, courts, and the police
➢ Fraud screening agencies
➢ Duplicate payment reviewers
➢ Central and local government
➢ Insurance companies
➢ Other professional advisors
In order to process your application, we will supply your personal information to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace, and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations. The identities of the CRAs, and the ways in which they use and share personal information, are explained in more detail at experian.co.uk/legal and www.equifax.com/privacy/ .
We may also disclose your personal information if we believe that the disclosure is necessary to enforce or apply our terms and conditions or otherwise protect and defend our rights, property or the safety of our customers and other users of the website.
We may disclose and/or transfer your personal information in connection with a reorganisation of all or part of our business if the majority of our shares are bought by another company or if we transfer all or some of our assets to another company.
Links To Other Websites
Links may be provided on our website to other websites that are not operated by us. If you use these links, you will leave our website. You should note that we are not responsible for the contents of any third-party website. External sites will have their own privacy policies which you should read carefully.
International Transfers
Some of the companies who provide services to us may be located outside the United Kingdom. As a result, your personal information may be transferred outside the UK. We will ensure your personal information is provided with the same adequacy of data protection adopted in the UK, by following legislation and ICO guidelines and requirements, such as using Binding Corporate Rules, Adequacy Rulings and Model Clauses.
Security
We maintain administrative, technical, and physical safeguards designed to protect against accidental, unlawful, or unauthorised destruction, loss, alteration, access, disclosure, or use.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of information you submit via our website and any transmission is at your own risk. Once we have received your information, we will take appropriate technical and organisational measures to safeguard your personal data against loss, theft and unauthorised use, access, or modification.
If you have created an account or registered to use any online services, your account details may be password protected. It is your responsibility to keep your password confidential and to sign out once you have finished browsing.
Access to personal data is restricted only to those who have a legitimate business need and data processed by third parties is only done so under strict instruction from us, as per the terms of their contract. We contractually require service providers and processors to safeguard the privacy and security of personal information they process on our behalf in line with data protection obligations and authorise them to use or disclose the information only as necessary to perform services on our behalf and under our instruction or to comply with legal obligations and requirements.
IT Security
We operate an enterprise class firewall and WAN network which has security policies that only allow traffic used by the business to pass and the default is to block any other traffic not included in our policies. Changes to these rules have to be authorised by a SLT member or IT manager.
All our devices have endpoint security which protects against viruses and other malicious code but also extends our security policies to the devices so when off the network the same policies around websites and what you can browse still apply.
We operate MFA on any system which allows activation and we use mobile device management to protect the devices used to generate the MFA tokens. All passwords have to be complex and changed every 90 days and user accounts are placed in groups that are used to define that employees have access to the appropriate files.
Retention
Information is retained in line with its purpose of processing and only for as long as necessary in line with business requirements, legitimate interests and statutory or legal obligations. For specific retention schedules please email Info@grosvenorcontracts.com
Rights You can exercise certain rights regarding your data:
➢ The right to receive a copy of the information we hold about you
➢ The right to have inaccurate information corrected or incomplete information completed
➢ The right to have your information erased
➢ The right to have the processing of your information restricted
➢ The right to withdraw your consent or object to processing reliant upon legitimate interests
➢ The right to have your information transferred to another organisation
➢ The right to request human intervention regarding automated decision making
The applicability of these rights is dependent upon our purpose and the lawful basis of processing relied upon.
For example:
➢ The right to Erasure is only applicable when you have provided us with your consent, or we are relying upon a legitimate interest.
➢ The right to Object is only applicable when you have provided us with your consent, or we are relying upon a Public Task or legitimate interest.
Should your request be one that we cannot process you will be informed of this, along with the reasons as to why your request cannot be carried out.
You can exercise your rights either verbally or in writing. However, should you make a request verbally we recommend that you follow this up in writing to provide a clear correspondence trail. Requests in relation to accessing your personal data, having your information erased or to opt out of marketing material can be made via email.
We have an obligation to respond within one month of receiving your request. Should we deem the request to be complex, the complex the response time can be extended by up to two months and you will be informed of the extended response date, alongside an explanation, within the original one-month time frame.
If required, identification will be requested within the one-month time frame and only limited to what is necessary for confirmation, such as a copy of your driving licence, passport, or utility bill. Once ID has been confirmed we will then process your request.
Should we refuse to comply with a request we will inform you of this within the one-month time frame and provide an explanation outlining our justification, our internal complaints procedure and your right to complain to a supervisory authority and to enforce your rights through a judicial remedy.
Contact information for submitting a request can be found at the bottom of this privacy notice.
DIRECT MARKETING
You may receive direct marketing from us if you have signed up to this or where we have a legitimate interest to provide the material to you. Regardless of the lawful basis we rely upon you have the right to stop receiving this marketing material at any time.
If you have an online account you can access, update, and correct your personal information – including your marketing choices – using the email below.
You can opt out of receiving emails or text marketing at any time by using the unsubscribe option in the message.
You can opt out of postal and telephone marketing by contacting us with your Synergy LMS account number at Info@grosvenorcontracts.com
If you prefer not to receive marketing which is tailored to suit your customer profile, please contact us at: Infor@grosvenorcontracts.com and confirm which accounts this affects. You will still receive generic marketing unless you opt out of receiving marketing entirely.