Privacy and Data Protection

Visitors to our websites

When someone visits our Websites, we use third-party service providers, such as Google Analytics, to collect Technical Data such as standard internet log information and Usage Data such as details of visitors’ behaviour patterns. We do this to find out information such as the number of visitors to our Websites.

This information is processed in a way which does not identify anyone. We do not allow our third-party service providers such as Google to make any attempt to find out the identities of those visiting our Websites.

Marketing

Where permitted by law or where we have asked for your consent, we may send you marketing materials which we believe may be of interest to you.

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You may receive marketing communications from us if you have requested information from us or engaged with us and you have not opted out of receiving that marketing.

You can ask us to stop sending you marketing messages by following the opt-out links within any marketing communications sent to you or by contacting us at dpo@itasworld.com at any time.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example, relating to updates to our Terms and Conditions or checking that your contact details are correct.

Disclosure of your personal data to third parties

We may disclose personal data to the following categories of recipients:

• to third-party suppliers, service providers and business partners where they are providing services to us, such as helping us to market, advertise or supply our products or services, for them to use for the purposes set out in this privacy policy. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. However, these third-party service providers may have their own privacy policies in respect of the information we are required to provide to them. For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal data will be handled by them;
• to a third party if ITAS or substantially all of our assets are acquired by that third party, in which case personal data held by us will be one of the transferred assets;
• to any law enforcement body, regulatory, government agency, court or other third party where we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request;
• to third parties (such as other companies and organisations) to protect our business, our clients or users, or others, and in order to enforce our rights or apply our terms of service or other agreements (including for the purposes of fraud protection and credit risk reduction); or
• to any other person where you have consented to the disclosure.

If you are an employee or contractor, we may share your personal data with our clients as part of our efforts to win work and deliver our services to them.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Storage of your personal data

Your information is stored by a third-party provider on behalf of ITAS in the United Kingdom (“UK”), the European Economic Area (“EEA”), the United States of America and Canada.

International transfers of your personal data

We may transfer your personal data to service providers that carry out certain functions on our behalf (such as third-party data storage providers). This may involve transferring personal data outside the UK or EEA to countries which have laws that do not provide the same level of data protection as UK or EEA law.

Whenever we transfer your personal data out of the UK or EEA, we endeavour to ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:

• We will only transfer your personal data to countries that have been deemed by the UK or EEA to provide an adequate level of protection for personal data.
• We may use specific standard contractual terms approved for use in the UK or EEA which give the transferred personal data the same protection as it has in the UK or EEA, namely the EU “Standard Contractual Clauses”, the UK “International Data Transfer Agreement” or the “UK Addendum”.

Your legal rights

ITAS takes your privacy very seriously and wants you to be aware of your rights, as follows:

• you have the right to request (i) confirmation of whether we process your personal data and (ii) access to a copy of the personal data retained;
• you have the right to have inaccurate personal data rectified, or completed if it is incomplete;
• in certain situations, you have the right to have your personal data erased or transmitted directly to another company, where technically feasible;
• where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time without impact to any data processing activities that have taken place before such withdrawal;
• you have the right not to be subject to any decisions based solely on automated processing, including profiling, which has legal or other similarly significantly effects on you unless we have your consent, it is authorised by law or it is necessary for the performance of an agreement; and
• in certain situations, you have the right to restrict or object to our processing of personal data regarding you.

Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

If you would like to exercise any of your rights, please send an email to the Data Protection Officer at dpo@itasworld.com.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We take steps to ensure that your information is treated securely and in accordance with this privacy policy. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, for example, by encryption or by using pseudonymisation in the case of credit card information on payment, we cannot guarantee the security of your information transmitted via the internet; any transmission is at your own risk.

We have appropriate technical and organisational measures to ensure a level of security appropriate to the risk of varying likelihood and severity for the rights and freedoms of you and other individuals. We maintain these technical and organisational measures and will amend them from time to time to improve the overall security of our systems.

In addition, we limit access to your personal data to those employees and other third parties who have a business need to know.

We may, from time to time, include links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any information to these websites.

How long we keep your personal data

We retain your information for as long as it is necessary for the purposes for which it was collected and processed. Additionally, we retain data for the purposes of satisfying any legal, regulatory, accounting, finance, tax, reporting and insurance requirements after which we take steps to destroy or de-identify personal data when the information is no longer required for any purpose for which it may be used or disclosed by us and we are no longer required by law or regulation to retain the information. Please note that this will be assessed on a case-by-case basis.

After our agreement with you expires or terminates, or our relationship with you has otherwise ended, we may also store your information in an aggregated and anonymised format.

Complaints or queries

ITAS is committed to meeting the highest standards when collecting and using personal data. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.

If you wish to make a complaint about the way in which we have processed your personal data, please contact our Data Protection Officer at dpo@itasworld.com, or alternatively use our “Contact Us” details on our Websites and we will endeavour to deal with your request.

You can also complain to the Information Commissioner’s Office, which is the UK’s independent regulator for data protection, if you are unhappy with how we have used your personal data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: www.ico.org.uk.

Changes to this policy

We will generally notify you of any material changes to this privacy policy, through a notice provided via the Websites or otherwise supplied to you. However, you should look at this privacy policy regularly to check for any changes. We will also update the “Last Updated” date at the bottom of this policy, which reflects the effective date of such policy. Your continued engagement with us after the date of the updated policy constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must stop your engagement with us.