Privacy Policy

 

Last Update: 21st January 2019

1. Purpose and Overview

This policy covers how ORMultiView (ORM)(“us”, “we”, or “our”) treat personal information and the standards you can expect from us. We are committed to safeguarding your privacy and to complying with UK Data Protection legislation and GDPR.

 

2. What is personal information?

Personal information is information about you that is personally identifiable such as your name, address, email address, or phone number as well as other information that may not otherwise be publicly available.

 

3. What personal information do we collect?

3.1 Personal Information

Personal information will be collected by ORM using the online contact form to allow us to provide the required services. Personal information collected will include: Name, Email Address and Telephone Number.

Please note: you are not obligated by law to provide us with any information. You hereby acknowledge, warrant and agree that any information you do provide us is provided of your own free will and consent, for the purposes and uses described herein.

 

3.2 ORM website

You can access ORM’s website without using any registration process or providing any personal information.

When you use ORM’s website we automatically collect certain technical and routing information about your visit so we can continuously improve what and how the site delivers. For example, we may log the Internet Protocol (IP) address of your computer and measure your browsing patterns when on this site.

This information is held in aggregate form and is not matched with your personal information so no individual user is identified.

 

4. Use of cookies

We use cookies to identify you when you visit ORM’s website to build up a demographic profile. Using cookies means we can tell how many people per month are accessing the site and which pages are visited most often. A cookie is a small piece of information sent to your web browser by a web server and can only be read by the server that gave it to you. It cannot be executed as code or used to deliver viruses to your computer.

Most browsers are initially set to accept cookies. You can set your browser to notify you when you receive a cookie, giving you the chance to decide whether to accept it. By using this site you consent to the use of cookies in this way. 

You can find out more about cookies here.

 

5. Who will have access to personal information?

We do not rent, sell or share personal information about you with other people or non-affiliated organisations except to provide services you’ve requested or when we have your permission, or under any of the following circumstances:

i) In response to subpoenas, court orders, or as otherwise required by legal process, or to establish or exercise our legal rights or defend against legal claims;

ii) We believe it is necessary to share information for us or the appropriate authorities to investigate, prevent or act regarding suspected illegal or fraudulent activities, potential threat to personal or physical safety, violations of our terms of use or as otherwise may be required by law;

iii) Information is transferrable due to our acquisition or merger with another company. In this event you will be notified by email prior to transfer.

 

6. Personal Data Retention Policy

Legal requirements apply for the retention of any particular data. For example:

  • Regulations regarding certain professions, e.g. medical.

 

In the absence of any legal requirements, Personal data will only be retained as long as necessary for the purpose of processing. This means data is to be deleted e.g. when:

  • The data subject has withdrawn consent to processing;

  • A service has been performed or cannot be performed anymore; or

  • The data is no longer up to date.

  • If none of the above apply we will delete data after 12 months.

 

 

7. Confidentiality and security

We limit access to personal information about you to employees who we believe reasonably need to meet that information to provide products or services to you or to do their jobs.

We have physical, electronic, and procedural safeguards that comply with regulations to protect personal information about you.

 

7.1 Right to be informed & Right of access

You have a right under GDPR legislation to see what information we hold about you and how we process this information, subject to certain conditions.

If you want to exercise these rights, you should make an application to us in writing. We may ask you to provide us with sufficient information so that we can be sure of your identity. We also reserve the right to make a charge of a reasonable fee for providing you with the information you are requesting if a request is excessive or repetitive.

If you would like to proceed with a request to see what data we hold about you and how it is processed, please write to us at the address within the contact us section of this policy.

 

7.2 Right of rectification

You have a right under GDPR legislation to request the rectification of information we hold about you and how we process this information, subject to certain conditions.

If you want to exercise this right, you should make an application to us in writing. We may ask you to provide us with sufficient information so that we can be sure of your identity. This request will be actioned within one month, or up to two months if the request is complex in nature.

If action is not taken in response to a request for rectification, ORM will explain why this is the case. If you are unsatisfied with our response, you then have the right to complain to the supervisory authority and to a judicial remedy.
 

7.3 Right of erasure

You have a right under GDPR legislation to request the erasure of some or all information we hold about you, subject to certain conditions, listed below:

 

▪ Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.

▪ When the individual withdraws consent.

▪ When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.

▪ The personal data was unlawfully processed (ie otherwise in breach of the GDPR).

▪ The personal data must be erased to comply with a legal obligation.

▪ The personal data is processed in relation to the offer of information society services to a child.

 

If you would like to proceed with a request for the erasure of some or all of your data, please write to us at the address within the contact us section of this policy. In some circumstances, ORM may refuse to comply with the erasure request. This may be due to one or more of the following reasons:
 

▪ To exercise the right of freedom of expression and information;

▪ To comply with a legal obligation for the performance of a public interest task or exercise of official authority.

▪ For public health purposes in the public interest;

▪ Archiving purposes in the public interest, scientific research historical research or statistical purposes; or

▪ The exercise or defence of legal claims.

 

7.4 Right to restrict processing

You have a right under GDPR legislation to request the restriction of processing of some or all information we hold about you, subject to certain conditions, listed below:
 

▪ When an individual contests the accuracy of the personal data, the processing will be restricted until the accuracy of the personal data has been verified.

▪ Where an individual has objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and ORM is considering if legitimate grounds exist to override the request of the individual.

▪ When processing is unlawful and the individual opposes erasure and requests restriction instead.

▪ If ORM no longer need the personal data but the individual requires the data to establish, exercise or defend a legal claim.

 

If ORM have disclosed the personal data in question to third parties, we will inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.
 

7.5 Right to object

Wherever possible, ORM will inform their clients and prospective clients of the right to object at the point of first communication.

You have a right under GDPR legislation to object to the processing of some or all information we hold about you, subject to certain conditions, listed below.

Individuals have the right to object to:

 

▪ Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority - including profiling

▪ Direct marketing - including profiling

▪ Processing for purposes of scientific/historical research and statistics.

 

ORM will stop processing personal information with immediate effect if the right to object is invoked unless:

 

▪ ORM can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual.

▪ The processing is for the establishment, exercise or defence of legal claims.

 

8. Breach Management

8.1 Identification and Classification

ORM have put in place procedures that will allow any staff member to report any information/data security breach.
 

▪ We ensure that all staff are aware to whom they should report such a breach.

 

▪ Having such a procedure in place will allow for early recognition of the breach so that it can be dealt with in the most appropriate manner.

▪ Details of the breach will be recorded accurately according to procedure, including the date and time the breach occurred, the date and time it was detected, who/what reported the breach, description of the breach, details of any ICT systems involved, corroborating material such as error messages, log files, etc.

▪ In this respect, staff are made fully aware as to what constitutes a breach. In respect of this policy a breach maybe defined as the unintentional release of customer confidential or personal information/data to unauthorised persons, either through the accidental disclosure, loss or theft of the information/data.
 

8.2 Containment and Recovery

Containment involves limiting the scope and impact of the breach of data/information. If a breach occurs, ORM will:
 

▪ Decide on who would take the lead in investigating the breach and ensure that the appropriate resources are made available for the investigation.

▪ Establish who in the affected organisation/s need to be made aware of the breach and inform them of what they are expected to do to assist in the containment exercise.

▪ Establish whether there is anything that can be done to recover losses and limit the damage the breach can cause.

 

8.3 Risk Assessment

In assessing the risk arising from any security breach, ORM will consider what would be the potential adverse consequences for individuals, i.e. how likely it is that adverse consequences will materialise and, in the event of materialising, how serious or substantial are they likely to be. In assessing the risk, the following points will be considered:
 

▪ What type of Information/data is involved?

▪ How sensitive is the information/data?

▪ Are there any security mechanism’s in place (e.g. password, protected, encryption)?

▪ What could the information/data tell a third party about the individual/s?

▪ How many individuals are affected by the breach?

 

8.4 Notification of Breaches
All information/data breaches are reported to ORM’s Information Security Manager. The ISM will complete a Security Incident Report.

Where it is deemed the breach is likely to result in a high risk to individual’s rights and freedoms, ORM will notify the Information Commissioners Office within 72 hours.

 

Where it is deemed the breach is likely to result in a high risk to individual’s rights and freedoms, ORM will notify the affected customer/s within 96 hours. This will include a copy of the completed security incident report if requested by the affected individuals.

ORM document all breaches of information security, even if they don’t all need to be reported.
 

8.5 Evaluation and Response

After any information/data security breach, a thorough internal review of the incident will occur. The purpose of this review is to ensure that the steps taken during the incident were appropriate and to identify areas that may need to be improved.

Any recommended changes to policies and/or procedures should be documented and implemented as soon as possible thereafter.

 

9. Email messages

We may occasionally send emails requesting feedback on your experience using ORM.

If you do not wish your details to be stored, please get in touch with us using the contact details below and we will endeavour to remove your information with immediate effect.

 

10. Links

The site contains links to affiliated websites and other information related services. This Privacy Policy does not apply to such linked third-party websites and services.

 

11. Notification of changes

By using this site, you consent to this privacy policy. If this policy is changed or updated in any material sense whether because of a change in the law or our internal policy, or both, we will publish a notice of the same on this site.
 

12. Contact Us

If you have any queries concerning this Privacy Policy, your personal information or any questions on our use of the information, please contact us:

 

Data Compliance,

ORMultiView Limited (ORM)

The Forge Enterprise Centre

3 Church Road

West Huntspill

Somerset TA9 3RN

 01934 714125
 

12. Policy Review

The Policy will be subject to review whenever any relevant technological or regulatory changes occur and will, as a minimum, be formally reviewed on an annual basis.
 

ORMultiView Ltd is a Company registered in England No. 3222787

Our Details
 
The Forge Enterprise Centre,
3 Church Road, West Hunstpill,
Somerset, TA9 3RN

+44 1934 714125

enquiries@ormultiview.com

square-linkedin-512.png

Office Hours (GMT)
 

Mon -  Thu 9:00 - 17:30

Fri                9:00 - 17:00