Anonymised data

We may also collect, use and share anonymised, aggregated data such as statistical or demographic data for any purpose. Anonymised data may be derived from your personal data but is not considered personal information in law as this information does not directly or indirectly reveal your identity. For example, we may aggregate information on how you use our website to calculate the percentage of users accessing a specific website feature.

How we collect personal data

We collect most of this information from you direct. However, we may also collect information from other sources.

How and why we use personal data

Under the Data Protection Legislation, we can only use your personal data if we have a proper reason for doing so, for example: consent, contract, legitimate interests, or legal obligation.

1. Consent. We may process your data based on your consent to:

• place cookies and similar tracking technologies on your device (please see our Cookies Notice for further details);
• send you our marketing communications (e.g. our blogs, newsletters, and invites to our webinars, events and seminars) if you have not previously bought our products or services;
• share your details with a third party for marketing purposes;
• publish content which you upload to our website; and
• respond to your enquiries.

Where we want to use your data on the basis of your consent, we will ask for such consent separately and clearly.

Right to withdraw consent

You have the right to withdraw consent at any time by:

• emailing us at alex@mirthy.co.uk; or
• in case of consent to marketing emails, by using the ‘unsubscribe’ link in our marketing emails.

Even if we are not required to obtain your consent for marketing purposes, you can still opt-out of receiving marketing communications at any time, so you are still in control.

2. Contract. We will use your personal data if we need to do it to perform our obligations under a contract with you, or if it is necessary for a contract which we are about to enter with you. For example, if we need to:

• register you as a new customer or administer your account;
• process and deliver your order to you;
• manage our relationship with you (e.g. to respond to your enquiries or to notify you about changes to our services);
• provide after sale care services (e.g. technical support); and
• enable you to partake in a competition or a prize draw.

3. Legitimate interests. We may process your personal data when we (or third party) have a legitimate reason to use it, so long as this is not overridden by your own rights and interests. For example:

• to manage your account and our relationship with you;
• to manage payments, fees, charges, and to collect debts which you may owe to us;
• to interact with you professionally (e.g. if you represent our current or prospective client, supplier or business partner) to manage our relationship with the organisation you represent;
• to administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data);
• to deal with your enquiry unrelated to a contract which we may have with you;
• to provide you with a free service (e.g. to allow you to use our website functionalities and tools);
• to send you our marketing communications (e.g. our blogs, newsletters, invites to our webinars, events and seminars) if you have previously bought our products or services, or if you represent our current or prospective business client;
• to ask you to leave a review or complete a survey;
• to increase our business or promote our brand through delivering relevant website content and advertisements to you;
• to measure or understand the effectiveness of the advertising we provide to you;
• to improve our website, products, services, marketing, and customer relationships and understanding;
• to conduct web analytics;
• for the prevention and detection of fraud and spam; and
• for the establishment, exercise or defence of legal claims.

We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are changes in the law, regulation, or structure of our business.

4. Legal obligation. We may process your personal data to comply with our legal obligation. For example, to:

• notify you about changes to our terms or privacy policy;
• address your complaint; and
• comply with a request from a competent authority.

Who we share personal data with

We may share your information with third parties for the purposes set out in this notice.

We share data with providers of tools and services which we use to operate our business, for example:

• website, domain, webinar, and content hosting/management providers (e.g. IONOS, WordPress, Genesis Digital, Youtube provided by Google);
• website, webinar and user analytics service providers (e.g. Google, Genesis Digital);
• website plugins and marketing software (e.g. ThriveThemes);
• online advertising tools providers (e.g. Facebook);
• direct marketing and analytics services providers (e.g. Mailchimp provided by The Rocket Science Group);
• customer care tools providers (e.g. Quirobot provided by Hugo B.V., and Chatbot provided by LiveChat);
• contact relationship management tools providers (e.g. Hubspot);
• data storage providers (e.g. Dropbox, Google Drive);
• providers of avatar services for our websites and webinars (e.g. Automattic Inc trading as Gravatar);
• social media providers, social media management tools providers and social media analytics tools (e.g. Facebook, Hootsuite);
• E-commerce providers; and
• Payment processors (e.g. Stripe).

We impose contractual obligations on the above providers to ensure that your personal data is protected.

International data transfers

Transfers of data outside the European Economic Area (EEA) are subject to special rules under the Data Protection Legislation. Those of our contractors and suppliers who are based outside the EEA, are either:

• based in countries that have been identified by the European Commission as providing adequate protection (such as Canada and Switzerland); or
• have in place an appropriate data sharing safeguard mechanism (for example, have entered into the European Commission’s standard contractual clauses with us, or subscribe to the EU-US Privacy Shield).

Other sharing

We may also:

• share your personal data with members of our staff, contractors, freelancers and consultants;
• disclose your personal data to professional advisers (e.g. lawyers, accountants, auditors or insurers) who provide professional services to us;
• disclose your personal data to certain third parties if specifically requested or agreed with you (e.g. if you ask us to introduce you to a third party);
• disclose and exchange certain information with law enforcement agencies and regulatory bodies to comply with our legal obligations; and
• share some personal data with other parties, such as potential buyers of some or all of our business or during a re-structuring. The recipient of the information will be bound by confidentiality obligations.

Such data recipients will be bound by confidentiality obligations.

How long we keep personal data

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

For example:

• if you sign up to Mirthy, we will keep your personal data for up to 24 months after you delete your Mirthy account for data and reporting purposes; or
• if you subscribe to our updates or consent to receiving marketing communications, we will hold your data for that purpose until you unsubscribe or otherwise tell us that you no longer wish to receive such communications.

We may also anonymise your personal data (so that it can no longer be associated with you) for analytics, research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Your rights

You have a number of rights in relation to your personal data, which allow you to access and control your information in certain circumstances. You can exercise these rights free of charge, unless your request is manifestly unfounded or excessive (in which case we may charge a reasonable administrative fee or refuse to respond to such request).

If you would like to exercise any of those rights, please contact us at alex@mirthy.co.uk. Please let us know what right you want to exercise and the information to which your request relates.

Keeping personal data secure

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully, including:

• data encryption;
• two-factor authentication;
• multi-authentication (for access purposes);
• strong password protection on accounts and secured backup data;
• regular server and cloud backups;
• Antivirus and malware protection, scanning and firewalls;
• data processing procedures; and
• continued PCI compliance.

We limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Complaints

We hope that we can resolve any query or concern you may raise about our use of your information. You may contact us by using the contact methods set out in the Who we are and how to contact us section of this policy.

The Data Protection Legislation also gives you a right to lodge a complaint with a supervisory authority, in particular in the European Union (or the European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws has occurred. The supervisory authority in the UK is the Information Commissioner, who may be contacted at https://ico.org.uk/concerns, telephone on 0303 123 1113, or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner’s Office, so please contact us in the first instance.

Changes to this privacy policy

This privacy policy was last updated on 18/05/2020

We may change this privacy notice from time to time, when we do we will publish the new version of the policy on our website. We may also inform you via email.