Introduction

We are committed to being transparent about how we collect and use personal data, and to meeting our data protection obligations. This policy sets out our commitment to data protection as well as important information regarding:

• the personal information we collect about you;

• what we do with your information; and

• who your information might be shared with.

We may change this privacy policy from time to time. You should check this policy regularly to ensure you are aware of the most recent version that will apply.

Who We Are

Iken Business Ltd ('we' or 'us') are a 'controller' for the purposes of the UK GDPR regime comprised of the Retained Regulation (EU) 2016/679 ('UK GDPR’), the Data Protection Act 2018 and any subsequent UK data protection legislation. We are responsible for, and control the processing of, your personal information. 

We are a limited company incorporated and registered in England and Wales with company number 02776536 whose registered office is at First Floor, Ps21, 21 Prince Street, Bristol, England, BS1 4PH. 

Purpose
The purpose of this policy is to make our position clear in relation to data protection and reinforce our commitment to not only comply with legal requirements but to adhere to industry best practice. It shall cover our practice around processing and storage of personal data and your rights in respect of the information we hold about you. 

Scope
This privacy policy applies to visitors of our website (available at: Iken | Legal Case Management for Public Sector & Legal Teams), those who access and use our services and any individuals whose personal information we process during the course of business, which includes:

• our prospective customers and recipients of our marketing communications;

• our customers (business contacts);

• our suppliers, service providers, agents, and subcontractors; and

• applicants for job vacancies.

If you are unsure how this policy applies to you, please contact us (see ‘How To Contact Us’ below) and we will be happy to help.

How To Contact Us
We have appointed a Data Protection Officer with responsibility for data protection compliance within our organisation. Questions about this policy, or requests for further information, should be directed to them at dpo@iken.co.uk. 

What Information Do We Collect and Process?

Personal information provided by you

During the course of accessing our website, using our services, the job applicant process, contacting us, providing services to us, or otherwise dealing with us, you may provide us with a range of personal data which we will use in the course of our business. This personal information may include:

• Your name or another unique identifier;

• Your address;

• Your contact details (which may include your landline telephone number, mobile number, and/or email address);

• Payment or other financial details (e.g. payment card information, bank information);

• Professional information (e.g. job title and/or type, professional qualifications, industry); and

• Other related information.

In very limited cases, we may collect special category personal data, particularly in respect of job applicants. Special category personal data includes information relating to your:

• racial or ethnic origin;

• political opinions;

• religious or similar beliefs;

• trade union membership;

• physical or mental health or condition;

• sex life or sexual orientation; or

• genetics or biometric information.

We ensure that wherever this information is collected, there is a legitimate justification for doing so and that we have a lawful basis for doing so in accordance with Article 9(2) of the UK GDPR, including where we have obtained your express consent at the point at which special category data is collected.

Information we collect automatically

Our website and services may collect certain information about you automatically, such as your IP address, geographical location, browser type and version, operating system, referral source, length of visit and number of page views. 

Personal information provided by third parties

Occasionally we may receive information about you from other sources (such as from our suppliers, our customers, your employer, single sign-on (SSO) providers, and (in the case of job applicants) recruitment agencies and your referees), which we will add to the information we already hold about you in order to help us operate our business effectively.

Personal information about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her/their behalf and has agreed that you can:

• transfer the personal data and give consent on his/her/their behalf to the processing of his/her/their personal data;

• receive on his/her/their behalf any data protection notices;

• give consent to the transfer of his/her/their personal data abroad; and

• give consent to the processing of his/her/their sensitive personal data (if applicable).

How Do We Use Your Personal Data and Our Legal Basis For Processing Your Personal Data

We may process your data for a variety of reasons, including because:

• we are legally obliged to e.g. to confirm your identity;

• the processing is necessary for the performance of the contract with you to provide our services or to enter into an employment contract with you; or

• it is in our legitimate business interests to do so.

In some instances, we will rely on your consent to process personal data and where we do this, it will be flagged to you at the time.

Our main processing activities for personal data, and the legal basis on which we perform those activities are:

Prospective customers / marketing recipients:

Where we use your personal data to market our services, we will process your personal data in order to contact you in relation to our services and keep a record of our communications (e.g. sales telephone calls, quotations and offers).

Our legal basis for doing so is:

• consent, which you will have given when you provided the personal data to us or one of our suppliers. You can withdraw this consent at any time by following the instructions in our communications or by contacting us; or

• our legitimate business interests, which allows us to market our products and services to individuals provided there is a business case for doing so and our interests do not override the rights of the individuals in question. If you wish to object to direct marketing, you may do so by opting out via the unsubscribe link provided in our communications, contacting the sender directly or by contacting us at dpo@iken.co.uk.

Customers and service users:

We will process your personal data in order to provide our services to you and to provide you with information and updates regarding the same. More detailed information around how we use your personal data when you access and use:

1. Iken Cloud can be found at our Iken Cloud Privacy Policy; and

2. Iken Connect can be found at our Iken Connect Privacy Policy,

both of which can be viewed here: [‘Data Protection & Privacy’ webpage link here]

Our legal basis for doing so is that the processing is necessary for the performance of a contract and our legitimate business interests. We will also keep a record of your data and use it for related purposes, including corporate account management, customer support, and audit purposes, on the basis that we have a legitimate interest in doing so.

We may also contact you in relation to our services, including in relation to any user feedback or focus groups we hold with our clients. Our legal basis for doing so will be the same as for prospective customers, as set out above.

Suppliers, service providers etc.:

We will process your personal data in order to receive goods and/or services from you and to manage our relationship, including making payments to you, dealing with accounts issues, placing orders etc. Our legal basis for doing so is that the processing is necessary for the performance of a contract and/or legitimate business interests (as applicable). 

Applicants for job vacancies:

We will process your personal data for the purposes of considering your application or CV, your interview with us and the selection process in order to recruit staff for our business. Our legal basis for doing so will primarily be that it is necessary for our legitimate interests, which will allow us to consider and evaluate applicants for the vacancies. If successful, we may need to process your personal data for the purposes of entering into an employment or consultancy contract with you.

Other Processing Activities

Monitoring and recording communications

We may monitor and record communications with you (such as online meetings and emails) for the purpose of training, fraud prevention, and/or quality assurance. We may also retain copies of communications and details provided to us by you, for example support requests, account queries, complaints, for internal account management and auditing purposes. This is done on the basis of legitimate interests.

What Are Your Rights?
As a data subject, you have a number of rights in relation to your personal data. These include the right to:

• find out how we process your data;

• request that your personal data is corrected if you believe it is incorrect or inaccurate;

• obtain restriction on our, or object to, processing of your personal data;

• if we are relying on consent, you can withdraw your consent to our processing of your personal data (including any direct marketing);

• obtain a copy of the personal data we process concerning you. We will take steps to verify your identity before responding to your request. Once we have verified your identity we will respond as soon as possible and in any event within one month.

• lodge a complaint with the UK supervisory body, the Information Commission’s Office (the ICO) here: https://ico.org.uk/. If you have a concern or complaint about the way we handle your data, we ask that you contact us in the first instance to allow us to investigate and resolve the matter as appropriate.

• if we are relying on legitimate interests for direct marketing, you can object to receiving such direct marketing.

You are responsible for ensuring that information you provide to us is accurate, complete and up-to-date. You can review and change your information by contacting us. 

If you would like to exercise any of your rights or find out more, please contact us at dpo@iken.co.uk 

Data Security

What do we do to help keep your information safe?

We take the security of personal data seriously. We are certified to ISO27001. We have internal policies and controls in place to protect personal data against loss, accidental destruction, misuse or disclosure.

While we will use all reasonable efforts to safeguard your personal data, you acknowledge that the use of the internet is not entirely secure and for this reason we cannot guarantee the security or integrity of any personal data that are transferred from you or to you via the internet. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

We have put in place procedures to deal with any suspected data breach and will notify you and the ICO of a breach where we are legally required to do so.

What can you do to keep my data safe?

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

Storage of Personal Data and Who Your Information Might Be Shared With
We process your personal data on secure servers based in the UK and the European Economic Area (“EEA”). 

We will not sell your data to third parties. We may disclose your personal data to:

• our agents and service providers, to the extent that they require access to the data in order to provide goods or services to us, in which case they will be bound by a contract requiring them to process personal data in accordance with the requirements prescribed by data protection law;

• law enforcement agencies in connection with any investigation to help prevent unlawful activity; and

• a third party purchaser if we sell our business, in which case, customer and support user information will be a transferred asset.

Where we engage third parties to process personal data on our behalf, such parties do so on the basis of our written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

Impact Assessments

Some of the processing that the organisation carries out may result in risks to privacy. Where processing would result in a high risk to individual’s rights and freedoms, the organisation will carry out a data protection impact assessment to determine the necessity and proportionality of processing. This will include considering the purposes for which the activity is carried out, the risks for individuals and the measures that can be put in place to mitigate those risks.

International Data Transfers Outside of the UK or EEA

It is sometimes necessary for us to transfer your personal data to countries outside the UK and EEA. For example, some of our carefully selected service providers are located outside of the UK.  In those cases we will comply with applicable UK and EEA laws designed to ensure the privacy of your personal data.

Under the applicable data protection laws, we can only transfer your personal data to a country outside the UK/EEA where:

• the UK government has decided the particular country ensures an adequate level of protection of personal data (known as a UK ‘adequacy regulation’) further to Article 45A of the UK GDPR;

• in the case of transfers subject to EEA data protection laws, the European Commission has decided that the particular country ensures an adequate level of protection of personal data (known as an EU ‘adequacy decision’) further to Article 45 of the EU GDPR;

• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you, or

• a specific exception applies under relevant data protection law.

How Long Do We Keep Your Personal Information?

We keep your personal information for as long as we need to for the purposes for which it was collected or (if longer) for any period for which we are required to keep personal information to comply with our legal and regulatory requirements.

Cookies

Please see our cookie policies for further information on the cookies that we use:

• Iken’s brochure website: (available at: Iken | Legal Case Management for Public Sector & Legal Teams)

• Iken Cloud: (available at: Home | Iken)

• Iken Connect: (available at: Iken Connect)