Privacy & Data Protection

Rest assured that I take your privacy seriously and am 100% committed to protecting it. 

I've been in business for many years; during which I've been a customer of hundreds of suppliers myself. So, I completely understand how important it is to respect the information you give me about yourself.

The new rules contained within the General Data Protection Regulation (GDPR) govern what can and can’t be done with information about you - and I've studied them to make sure I'm crystal clear about my obligations.

I've written my Privacy & Data Protection policy to cut through the legal jargon and spell out exactly what I do with what you’ve told me about yourself and your business.

In a nutshell, it all boils down to five Paul Sowerby Privacy Pledges. I promise that I will:

1. only use the information you give me to improve the service I deliver

2. protect your data like it’s my own

3. only ever talk your language. No nonsense, no spam, and no cleverly worded sentences that

leave you baffled

4. give you the power to decide what and how you hear from me

5. delete your information as soon as I no longer need it or you ask me to do so

This Privacy Notice sets out what personal data I hold about you and how I collect and use it. It applies to all clients whether you’re a business or an individual buying my services or browsing my website.

I am required by data protection law to give you the information in this Privacy Notice. It is

important that you read it carefully together with any other similar or additional information that I might give you from time to time about how I collect and use your personal data.

This Privacy Notice applies from 25 May 2018, when the UK General Data Protection Regulation came into force. It does not give you any contractual rights. I may update this Privacy Notice at any time.

Who is the controller?

I, Paul Sowerby (Plot 597-631, Street 29, Dubai Investment Park-2, Dubai, UAE) am the “controller” for the purposes of data protection law. This means that I am responsible for deciding how I hold and use personal data about you.

I also rely on an external Data Protection Coordinator who is committed to making sure I am looking after all your information. If you have any queries, you can reach me in relation to Data Protection at paul@paulsowerby.com

So, what is personal data?

Personal data means any information relating to a living individual who can be identified (directly or indirectly) using the information you give me (eg name, job title, company address, email address, mobile number etc.). It can be factual (eg contact details or date of birth), or an opinion about an individual’s actions or behaviour.

Data protection law divides personal data into two categories: ordinary personal data and special category data. Any personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sexual life or sexual orientation, or biometric or genetic data that is used to identify an individual is known as special category data. (The rest is ordinary personal data). But don’t worry; I don’t collect special category data from my clients!

What type of ordinary personal data do I hold about you and why?

I collect, hold, and use the following types of ordinary personal data about you:

- Publicly available information about you, such as your business social media presence,

Numbers your web sites and business cards, contact email details etc

- Data including name, address, email address, company registration number, company VAT

number, your account activity, contact number etc

- If I should ever record ‘phone calls for quality and training purposes, I would hold the recordings so that I can:

o process your enquiry or project brief and correspond with you about it

o make sure you are receiving the quality of service you expect

o invoice you for my services

o chase outstanding payments

o maintain your account with me

o maintain any ongoing commitments

In addition to this, there’s my marketing programme.

If you’ve said I can do so, I'll send you marketing messages by email, text and snail mail to keep you aware of what I'm up to and to help you see and find my products and services.

You can stop receiving marketing messages from me at any time, by:

- calling me to tell me not to talk to you any more 

- clicking on the ‘unsubscribe’ link in any marketing email

- contacting me at paul@paulsowerby.com

Once you do this, I'll update my records to ensure that you don’t receive further marketing

messages. Please note though, that it might take a few days for all my records to be updated and so you might get messages from me while I process your request.

What are my legal grounds for using your ordinary personal data?

The new regulations set out specific reasons under which I can process this information about

you.

When I ask you for your details, I will use one or more of the following reasons as to why I am asking for it:

- I need it to take steps (at your request) to enter a contract with you

- I need it to comply with a legal obligation, eg the obligation to provide the service you

have purchased

- it is necessary for my legitimate interests (or those of a third party) and your interests and

your rights (I will cover these later!) do not override those interests (legitimate interest)

For example, if you send me an enquiry through my website, it is in my legitimate interest to get in touch with you to follow up on the query.

How do I collect your data?

You provide me with most of the personal data about you that I hold and use, for example when you reach out to me via online channels such as my web site or in response to my marketing.

Some of the personal data I hold and use about you is generated from internal sources. For

example, I may make notes against your account on my internal CRM system to specify your

preferences.

Some of the personal data about you that I hold and use may come from external sources. 

For example if you send out copies of your brochure.

Who do I share your personal data with? 

I may share some of your data with the following people, the types of data and our legal grounds for doing so are detailed below:

- Where you make an enquiry on my website about a service provided by one of my strategic partners, I may pass some of your information onto one or more of them. I have a legitimate interest in sending your details to them so they can help you with your needs. The data I share may include: name, address, contact number, email address etc

- I may share client information with delivery companies when I need to send information to you quickly that doesn’t suit electronic channels. I use companies such as royal mail and reputable delivery companies for this. I need to share your data with these companies to perform the contract I entered into with you

- Every year I submit business information to our financial advisors and corporate authorities (eg the UK's HMRC and Companies House), and as part of this process they will have access to client information to make sure I am not being fraudulent in my activities. This is a legal obligation that I have as part of my business operations

- I may share a client’s details with county courts and debt collectors if the client fails to pay a debt owed to me

- In special circumstances at your request, I may share your personal data with suppliers and manufacturers

- I also invest in understanding how you came to find me on the internet. This means I share things like mouse-clicks and IP addresses with companies like inspectlet.com. I have a legitimate business interest in finding out this information as it helps to improve my website.

- When you communicate with me via my web site, this is hosted by a third-party company

who host all of my data. I am satisfied that they have taken steps to ensure that this is

secure and only the necessary people can see your personal data. I have a

legitimate business interest in using their services and hosting platform

- If you choose to request any email newsletter that I produce and explicitly give your consent for me to send you subsequent issues and other marketing material via my opt-in process, the email address that you submit to me will be stored in my database and forwarded to any third parties who provide me with email marketing services 

- I may share your information with our suppliers to tell you about the launch of a new product or service. For example, I may share your company address with a printing supplier to send you information

Consequences of not providing personal data

If you do not wish to provide me with your information, that’s entirely your choice. Please bear in

mind that if you don’t provide me with the information I require for the reasons I have stated, I won’t be able to supply you with information about my services and may not be able to trade with you.

How long will we keep your personal data?

I hate saying to goodbye, but I'll only hold onto your information for as long as it’s needed to be able to fulfil my contract to supply you and provide my services to you.

If I think it’s reasonably necessary or if I'm required to meet legal or regulatory requirements, resolve disputes, prevent fraud, and abuse, or enforce my terms and conditions, I may also keep hold of some of your information as required even after you have closed your Account with me – assuming it’s no longer needed to provide services to you.

Your rights

The regulations set out the rights that everyone has if a business is processing data about you,

they are:

- The right to make a subject access request. This enables you to receive certain information

about how I use your data, as well as to receive a copy of the personal data I hold about

you and to check that I am doing exactly what I say I am doing!

- The right to request that I correct incomplete or inaccurate personal data that I hold

about you. This speaks for itself, if I have the wrong email address or phone number, you

have the right to tell me to make it right!

- The right to request that I delete or remove personal data that I hold about you where

I don’t have a good reason for keeping hold of it. You also have the right to ask me to

delete or remove your personal data where you have exercised your right to object to

processing (see below)

- The right to object to me processing your personal data where I am relying on my

legitimate interest (or those of a third party), where I cannot give a good reason for

processing the data about you

- The right to request that I restrict our processing of your personal data. This enables you

to ask me to suspend the processing of personal data about you, for example if you want me

to tell you how accurate the information is, or you want to know why I am asking for this

information

- The right to withdraw your consent to me using your personal data. Alongside this, you also

have the right to request that I delete or remove that data, if I do not have another

good reason to continue using it

- The right to request that I transfer your personal data to another party, in respect of data

that you have provided where my legal ground for using the data is that it is necessary for

the performance of a contract or that you have consented to me using it (this is known as the

right to “data portability”)

If, for whatever reason, you want to exercise any of these rights, please contact me at paul@paulsowerby.com

Web Site

My web site also collects and uses personal information. I do so as follows:

- Tracking Site Visits

Like most websites, this site uses Google Analytics (GA) to track user interaction. I use this data to study the number of people using my site, to better understand how they find and use my web pages and to see their journey through the website.

Although GA records data such as your geographical location, device, internet browser and

operating system, none of this information personally identifies you to me. GA also records your computer’s IP address which could be used to personally identify you, but Google do not grant us access to this. I consider Google to be a third-party data processor.

GA makes use of cookies, details of which can be found on Google’s developer guides. FYI my website uses the analytics.

- Cookies

Cookies are very small harmless files that most websites put on to your computer when you roam their pages, to help the site run efficiently and make your user experience more enjoyable. Most Cookies are critical to a website’s performance and your enjoyment of it. I have reviewed and adjusted our Cookie Notice to meet the requirements of GDPR. 

Our Cookie policy is as follows:

In addition to GA’s use of Cookies, this web site uses:

- Information Cookies to gather anonymous information to assess how visitors are using the website. This will then help me to improve certain pages of my site which may currently be poorly designed or unclear for the user. Information Cookies also highlight the most visited pages or broken links

- Helpful Cookies to help you when you return to the website. For example, they will save information such as name and email address and so make it a quicker and easier process for you

- Third Party Cookies to monitor and record your typical browsing habits whilst working in the background so only relevant ads (wherever ads become used) are displayed

The basic rule is that I must:

- Tell you Cookies are in place and being used to monitor and record your usage of my website. (Consider yourself told)

- Explain what the cookies are doing and why. (Tick)

- Get your consent to store a Cookie on your device. (You’ll have seen the pop up when you landed on my site)

If I do this the first time I set Cookies, the rules say I don’t have to repeat it every time you visit my website.

That said, I accept that devices may be used by different people. So, bearing in mind that there could be more than one user of your device, I plan to repeat the process at suitable intervals.

Disabling cookies on your internet browser will stop GA from tracking any part of your visit to pages within this website.

IP Addresses

In addition to Google Analytics, this website may collect information (held in the public domain)

attributed to the IP address of the computer or device that is being used to access it. The

information is supplied to me from Whoisvisiting.com. Whoisvisiting.com is a service offered by

Whoisdata Limited. The Whoisvisiting system does not use your IP address to identify you, the

individual, in any way. No cookies are used by the Whoisvisiting system. The Whoisvisiting system will only lookup information when a static IP address is being used. When a device is assigned a static IP address, the address does not change.

Contact forms and email links

Should you choose to contact me using the contact form on my I'm Here page or via email links, none of the data that you supply will be stored by this website or passed to/be processed by any of the third-party data processors. Instead, the data will be collated into an email and sent to me over the Simple Mail Transfer Protocol (SMTP). Our SMTP servers are protected by TLS (sometimes known as SSL) meaning that the email content is encrypted using SHA-2, 256-bit cryptography before being sent across the internet. The email content is then decrypted by my local computers and devices.

Email newsletters and promotional flyers

Your email address will remain within my database until you specifically request removal from the list. You can do this by unsubscribing using the unsubscribe links contained in any email newsletters that I send you or by requesting removal via an email to paul@paulsowerby.com

When requesting removal via email, please send your email to me using the email account that is subscribed to the mailing list.

If you are under 16 years of age you MUST obtain parental consent before joining any email

Newsletters I may produce.

While your email address remains within my database, you will receive periodic marketing communications from me.

Pseudonymisation is a recent requirement of the GDPR which many web application developers are currently working to fully implement. I am committed to keeping it as a high priority and will implement it on this website as soon as I can.

If you have any questions or concerns about how your personal data is being used, you can contact our me on paul@paulsowerby.com

If you aren’t happy with how Paul Sowerby is processing your data, you also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Details of how to contact the ICO can be found on their website: https://ico.org.uk