Privacy Statement

Please note that this Privacy Policy concerns the processing of personal data for which Allstrat is the data controller, i.e. where Allstrat has decided the purposes and means of the processing.

For the avoidance of doubt, this Privacy Statement does not concern any processing of personal data that Allstrat may conduct as a data processor as a result of your use of our services.

Personal data refers to data that can be related to you as a natural person. We process the following types of personal data related to you:

• Contact details such as name, e-mail address and phone number.

• User information if you use our services, e.g. if you log in to an Allstrat online account.  Such information may include IP address, device and browser type and also information about how you interact with our services, e.g. which features are used and which buttons are clicked.

• Other information we receive from you through your contacts with us.  This will include your responses to questionnaires and assessments.Information used when you schedule a call or online meeting using the calendar system or engage in a coaching session on the website.

• Information used when you pay for products and services on an invoice basis.  Usually payments are handled online using a secure payment card handler for this purpose.  We use Stripe and Paypal for this purpose and they are data controllers for their payment services.

We process personal data for the following general purposes:

• To provide our services in accordance with relevant terms and conditions.

• Administration of the business relationship with you.

• To develop and improve our services.

• To provide you as a current or potential Allstrat/Responsible Data Use customer information and offers about our services, and also from selected third parties.

• To market and promote our services.

• To comply with legislation.

A privacy notice is provided at each point where we collect personal data which is specific to and contains clear information about that purpose of processing.

Where personal data is shared with a service provider in a 3rd country, the sharing activity is governed by "Standard Contractual Clauses" (SCCs) in a data sharing agreement between Allstrat Ltd as the data controller (exporter) and the service provider as a data processor (importer).

In such circumstances a Transfer Risk Assessment (TRA) will be completed.

Where personal data is transferred to a service provider headquartered in the USA you should be aware that the law in the USA allows for government agencies to enforce access to information of non-US citizens for certain purposes. Where a purpose of processing involves the use of such a service provider, the privacy notice will provide you with information about this and your options.

We take appropriate administrative, physical, and technical measures (collectively “Security Measures”) to protect your personal information from loss, misuse, unauthorised access or disclosure, alteration and destruction.

We follow generally accepted standards when implementing and maintaining such Security Measures, including, but not limited to, TLS/SSL for data encryption in transit, encryption of data at rest, limiting unnecessary access, using encryption, monitoring for unauthorised access attempts, and mitigating activities by bad actors.

These Security Measures are periodically reviewed and, if necessary, updated to ensure they meet current and generally accepted best practices.

Furthermore, only authorised personnel have access to personally identifiable information on a need to know basis.

We also take measures to ensure service providers that process personal data on our behalf also have appropriate security controls in place.

We use an internal Privacy Policy to clarify and enforce information security behaviour for our staff and contractors.

We keep a data retention schedule as part of the documentation of our purposes of processing. The exact retention period depends on the purpose of processing. This information will always be provided to you using a privacy notice at the time we initially collect personal data from you.

The General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 gives you rights over your personal data.

Here is a brief statement to inform you of those rights and our obligations to uphold them.

• You have the right to be informed about how your personal data is, or will be, processed.

• You have the right of access to your personal data.

• You have the right to rectify any errors contained in your personal data.

• You have the right to ask for your personal data to be erased from our records.

• You have the right to restrict processing of your personal data. You have the right to data portability.

• You have the right to have your personal data provided to you in a "portable" machine-readable format.

• You have the right to object to any aspect of our processing of your personal data.

• You have rights regarding the use of automated decision-making.

You can enforce your rights by issuing us with a Subject Access Request (SAR). You can make your SAR by completing the form on this page: https://responsibledatause.uk/make-a-sar

Your personal data shall be collected and processed:

• Lawfully, fairly and in a transparent manner.

• Collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes.

• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation).

• Accurate and kept up to date.

• Kept in a form which permits identification of data subjects for no longer than is necessary.

• Kept in a manner that ensures appropriate security and integrity of the personal data.

• It is our obligation to be accountable for the data processing carried out under our control.

It is our obligation to only process personal that is accurate, relevant, necessary taking into account our legitimate purposes, and you have the right to control that we do so.

You can find out more about your rights by visiting the website for the UK Information Commissioner’s Office at https://ico.org.uk.

To update personal data that we process about you, please get in touch with us through privacy@allstrat.co.uk.

To receive a free of charge excerpt of personal data that we process about you, please use the Subject Access Request (SAR) form on the website or send us a physical, signed letter to Data Privacy, Allstrat Ltd, Suite 316, Castle House, 1 Baker Street, Stirling, FK8 1AL.

(note that in all cases we must first take steps to verify your identity)

Monday 15th May 2023