1.1 EXB Ltd ("we", "us", "our") will safeguard and respect your privacy. This privacy policy ("Policy") explains the ways in which we collect and process or use your personal data and information. It also sets out your legal rights to access or change your personal data.
1.2 This Policy does not apply to our processing of personal data of anyone to whom we have applied our Terms of Business or with whom we have a specific contract which includes clauses or references to specific privacy policies which override this one (this may include clients, employees, licensees, suppliers or others if you have been told that another policy applies). For those people, EXB's Terms of Business or the specific contract set out how we collect and use their personal data.
1.3 We do not knowingly collect or maintain any personal information of children. If you are under the age of 18, please do not access our website or social media pages or communicate with us. We will take steps to delete the personal information of anyone who we know or reasonably believe to be under the age of 18.
1.4 This Policy is provided in a "layered" manner so that you can click through to the specific areas set out below from paragraph 3 onwards. Alternatively, you can view the entire current policy as a whole by clicking here. Please contact us if your visual or other personal access requirements mean that you need a larger font or other format copy of this Policy.
1.5 This Policy is subject to copyright and may not be copied or used or adapted for use by anyone else without written licence from us. We may use automated search tools to check for unlicensed copies of our materials.
2.1 EXB Limited is a limited company registered in England and Wales with registered number 08850803 and registered address at Office 68 Cassidy House, Station Road, Chester CH1 3DW, United Kingdom. We also trade using various trading names and websites and social media names and pages such as "EXB", "Franchise Generator", "EXB Legal", "EXB Security", "EXB Franchising", "Franchisee Report" and "Commercial Legal".
2.2 This Policy is issued on behalf of all our group companies, details of which can be found here. When we refer to "we" or "us" we are referring to the relevant company of our group companies responsible for processing your data (the relevant company will be made clear to you when engaging our services or buying our products). EXB Ltd, the company referred to above is the controller and responsible for this website.
2.3 EXB Ltd is a consultancy not a law firm and is not regulated by the Solicitors Regulation Authority. However, individual solicitors within EXB Ltd may be regulated by the Solicitors Regulation Authority (this will be set out on the relevant person's information section of this website).
2.4 You can contact us at our registered office or as set out in the Contact section of our website at https://www.exbdirect.com/contact.html including for any data protection or privacy related matters or directly to our data protection manager by email to dp@exbdirect.com.
3.1 We may collect any information that you provide to us when you:
(a) buy or apply for any of our products or services;
(b) create an account on our website or in any of our apps;
(c) communicate with us by post, email, chat, social media messages, comments or posts, calls, meetings, training, webinars or via our website or apps;
(d) make an enquiry, provide feedback, or make a complaint by any of the communication methods referred to above;
(e) subscribe to any of our marketing, newsletters, articles or mailing lists;
(f) enter a competition, promotion or survey provided by us or on our behalf;
(g) register to and/or attend our events in person or virtually;
(h) network with us (e.g. at exhibitions, conferences and/or other meetings or events) or provide us with any contact details for networking purposes;
(i) link to or share information with any of our personnel through social media or business forums or groups (as examples including LinkedIn, business or industry associations or alumni networks);
(j) attend a meeting at which we are present (in person or virtual);
(k) submit a CV and/or an application for a job vacancy or to become a licensee or service provider of ours and / or attend an interview or assessment with us.
3.2 We may receive information about you from third parties. For example:
(a) Service providers: We may collect personal information from or via our external service providers, such as those referred to in paragraph 7.1 below;
(b) Security: We will collect information from our information and cyber security service providers who are based inside the European Economic Area (EEA), about any actual or attempted misuse of our website, apps, emails or other communication methods or devices;
(c) Publicly available sources: We use publicly available sources such as search engines, social media, websites, Companies House, Electoral Register, for instance to carry out identity and compliance checks and to gain background information and research;
(d) Analytics providers: We may collect personal information from external providers of analytics such as Google and others who may be based outside the EEA;
(e) Employers, recruitment agencies and referees: If you are an applicant for a job with us or to become a service provider or licensee of ours, we may contact your recruiter, current and former employers and/or referees, who may be based inside or outside the EEA, to provide information about you and your application;
(f) Referrers: We may receive information about you from other people if you have communicated to them that you would like to hear from us or from specified categories of business that include us;
(g) Official Sources: We may receive information about you from government authorities or bodies, police, crime or fraud prevention or other authorised entities.
4.1 The information we collect and process about you may include some or all of the following:
(a) Identity: including title, names, usernames, the company you work for, your title or position and your relationship to other people;
(b) Contact information: including email addresses, phone numbers, addresses, social media names or contacts;
(c) Information contained in communication or correspondence: including information contained in any communication between us, for example as referred to in paragraph 3.1 above;
(d) Identification and background information: including information provided by you if required as part of our client acceptance processes, including your passport, utility bills copies or other personal identification documents;
(e) Website, social media and app usage and other technical data: including information about your interactions with our websites, apps or social media pages and the device that you use to access them, including information such as IP addresses, geographical location, your device information (such as your hardware model, mobile network information, unique device identifiers). This information may be collected by third-party analytics service providers on our behalf and/or may be collected using cookies or similar technologies. For more information on cookies please read paragraph 8 below;
(f) Transactions and profile data: including details about products and services that you bought from us and payments that you made, your interests, preferences, feedback and survey responses and your marketing and communication preferences;
(g) Employment and background data: if you submit a job application to us, you may provide information and details about your academic and work history, qualifications, skills, personal or professional background, references, proof of your entitlement to work in the UK, your national insurance number, your passport or other identity document details, and any other related information that you may provide to us;
(h) Sensitive information: we will not knowingly store non-public information about criminal convictions and offences nor sensitive information about your race or ethnicity, religious, philosophical or political beliefs or opinions, sex life, sexual orientation, trade union membership or health, generic or biometric data. However, an exception may be if you ask us to do so because it is relevant to your attendance at our premises or events or for your employment or for the provision of services to or from you.
4.2 Sensitive information or special categories of very sensitive personal information by law require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We process special categories of personal information only where needed for your attendance at our premises or events or for you to provide services to us or for us to provide services to you.
4.3 We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Policy.
5.1 We use your information for the purposes listed in paragraph 6 on the basis of one or more of the following (further detail is given in paragraph 6):
(a) to enter into or perform a contract with you;
(b) our legitimate interests as a business;
(c) to comply with a legal or regulatory obligation;
(d) your consent (if needed and where we request it), subject to paragraph 5.2 below.
5.2 Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.
6.1 We use your information for the following purposes:
(a) Provision of our services: to provide our services to you, or otherwise take steps as set out in any contract with you or in EXB's Terms of Business or our website's Terms of Use and / or to manage payments to or from us (on the basis of performing our contract with you, or otherwise on the basis of our legitimate interest to conduct our business);
(b) Response to enquiries: to respond to enquires you make including by any of the communication methods referred to in paragraph 3.1 above, especially if you ask for information about us providing our services to you (on the basis of our legitimate interest to respond to enquiries from prospective clients and to operate a lawful business, or otherwise to comply with our obligations to you and to any of our regulators and / or on the basis of your consent if necessary and if given);
(c) Our relationship with you: to manage our engagement and our relationship with you, including by maintaining our database of contacts, asking you for feedback, notifying you about changes to our terms of use, and/or privacy policy or other policies (on the basis of performing our contract with you, to comply with our legal obligations and any regulators and on the basis of our legitimate interests to keep our records updated and study how our website and services are used);
(d) User support: to provide service and support in relation to your use of our website or social media pages or groups (on the basis of our contract with you or on the basis of our legitimate interests to provide you with customer service), and to deal with enquiries or complaints about the website (on the basis of our legitimate interest in providing services to our website and social media users and to comply with our legal obligations);
(e) Marketing and Sales: to communicate with you about our news, events and services that we believe may interest you, if we have the requisite permission to do so (either on the basis of our legitimate interests to provide you with marketing communications where we may lawfully do so or your consent if we have requested it);
(f) Recruitment: to process any applications you send to us for a job, service provider or licensee application, whether directly or via an agent or recruiter (on the basis of our legitimate interest to recruit new employees, contractors and licensees);
(g) Your experience of our website, social media and apps: to provide you with access to our website and / or social media pages or groups or apps in a way that is optimised and convenient which may include personalised content relevant to you including sharing your information with our website, social media and app hosts, content contributors and developers (on the basis of our legitimate interest to ensure our website, social media and apps are presented in an effective and optimal manner);
(h) Analytics: to use data analytics to optimise the use of and to improve our website, social media, apps and our products/services, marketing, client relationships and experiences (on the basis of our legitimate interests in personalising, enhancing, modifying or otherwise improving the services and/or communications that we provide to you, developing our business, and informing our marketing strategy);
(i) Fraud and unlawful activity detection: to protect, investigate, and deter against fraudulent, unauthorised, or illegal activity, including identity fraud or money laundering (on the basis of our legitimate interests to detect and prevent fraud and to operate a safe and lawful business or where we have a legal obligation to do so);
(j) Compliance with policies, procedures, regulators and laws: to enable us to comply with our legal obligations, any regulators' requirements, policies and procedures and to enforce our legal rights, or to protect the rights, property or safety of our employees and service providers and share your information with our technical and legal advisors (on the basis of our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so).
6.2 Where we use your information for our legitimate interests, we consider any potential impact that such use may have on you. Our legitimate interests do not automatically override yours and we will not use your information if we think your interests should override ours unless we have other grounds to do so (such as your consent or a legal obligation). If you are concerned about our processing please see "Your rights to your information" in paragraph 12 below or contact us if you wish more information about how we balanced your and our legitimate interests.
7.1 On the lawful grounds referred to above and connected with the purposes set out, in addition to any recipients of your information described elsewhere in this Policy, we may share your personal information if relevant with third parties such as:
(a) Our service providers: service providers we work with to deliver our business, who act as processors and provide us with services including (as examples) the following:
(i) website, email, app and social media development and hosting service providers based in the UK, EEA or USA;
(ii) cloud computing hosting service providers based in the UK, EEA or USA;
(iii) contract management, document management and digital or electronic signature service providers based in the UK, EEA or USA;
(iv) online payment gateway and service providers based in the UK, EEA or USA;
(v) IT, system administration, analytical and security service providers based in the UK, EEA or USA;
(vi) identity verification, fraud prevention and detection service providers based in the UK, EEA or USA;
(vii) sub-contracted, outsourced or consultancy service providers based in the UK or EEA;
(viii) licensors or licensees of ours who perform services for us or for you under licence based in the UK or EEA;
(b) Regulators and governmental bodies: HM Revenue & Customs, regulators (which may include, but only to the extent applicable and necessary and if regulated by them, the Solicitors Regulation Authority for individual solicitors), governmental bodies and other authorities acting as processors or joint controllers based in the United Kingdom, who require reporting of processing activities in certain circumstances;
(c) Group companies: Our group companies (as set out here) to the extent necessary either because they are providing services or products directly to you or are providing them to us;
(d) Standards and Industry Bodies and Associations: To the extent applicable and necessary and if a member of the association or governed by their Code of Conduct, associations or quality standards organisations or similar, for example in relation to any ISO standards, the Institute of Information Security Professionals, the British Franchise Association and so on.
(e) Referrals and Publicity: any selected third party that you consent to our referring you on to or sharing your information with for marketing, client reference or publicity purposes;
(f) Prospective buyers of our business: any prospective buyer of our business or assets, if we decide to sell our business or assets or to merge with them (to the extent necessary and subject to confidentiality obligations);
(g) Other external entities (including professional advisers): any other third parties (including legal, accountancy, consultancy, tax or other advisors, regulatory authorities, courts, law enforcement agencies and government agencies) where necessary to enable us to enforce our legal rights, or to protect the rights, property, or safety of our employees, or where such disclosure may be permitted or required by law.
7.2 We require third parties to have appropriate security to protect your information from unauthorised access or processing and to treat it in accordance with all applicable law. We do not permit third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for the same specified purposes as we do, and in accordance with our instructions.
8.1 We may use cookies to ensure that you get the most out of our website. Cookies are small amounts of information in text files which we store on the device you use to access our website, social media or app. Cookies allow us to monitor and simplify your use of the website, social media or app.
8.2 If you do not want cookies to be installed on your device, you can change the settings on your browser or device to reject cookies. For information about how to reject cookies using your internet browser settings please see the "Help" section of your browser (or visit www.aboutcookies.org). If you do set your browser to reject cookies, you may not be able to access all parts of this and other websites.
8.3 The names of the cookies used on our website and the purposes for which these cookies are used are as follows: (Currently none used)
8.4 Our website, social media pages and groups or apps may contain content and links to other external websites, plug-ins and applications that are operated by third parties that may also operate cookies. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these external websites or cookies, are not responsible for their privacy statements, and this Policy does not apply to them. You should consult the terms and conditions and privacy policy of the relevant external website, social media group or page or app to find out how they collect and use your information and to establish whether and for what purpose they use cookies.
9.1 We follow careful security procedures and policies as to how your personal information is stored and used and who has access to it and use appropriate security features to help prevent any unauthorised person gaining access to it. Sending information via the internet, although useful and essential, is however always insecure to some extent. Although we take all appropriate measures to protect your personal data, we cannot guarantee its security, in particular if you send or receive it via a device or method that is not secured.
9.2 We aim to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services and of personal information that we hold.
9.3 We operate a policy of "privacy by design", with our systems and policies all designed to take information security into account. We try to minimise the amount of personal information we hold and how long we hold it for. We use appropriate technological and operational security measures to protect your information against unauthorised access or unlawful use, which may include some or all of the following:
(a) physical: ensuring the physical security of our offices, equipment and devices;
(b) technical: ensuring the physical and digital security of our equipment and devices by using appropriate firewalls, password protection, pseudonymisation, encryption and other security;
(c) procedural: maintaining a privacy / data protection / information security policy for our personnel, licensees and sub-contractors and providing them with related training.
9.4 We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
9.5 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where legally required to do so.
10.1 We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for or to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
10.2 To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
10.3 We may have a data retention policy which you can be sent on request if you would like more information about how long we keep your information for. In general terms:
(a) by law we have to keep basic information about certain people including our customers and employees or contractors (including Contact, Identity, Financial and Transaction Data) for six years after they cease paying or being paid for tax purposes.
(b) in some circumstances you can ask us to delete your data: see paragraph 12.1(h) below for further information.
10.4 In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
11.1 Our company is registered in the UK but uses personnel and sub-contractors based in other countries within the European Economic Area (EEA) including Spain. Within the UK and the EEA, your personal data is protected by the General Data Protection Regulations and national implementations that reflect it or are very similar in their level of protection (including any countries that are not technically within the European Union (EU)).
11.2 We do not transfer your personal data outside the EEA unless you instruct us to do so or the transfer is necessary to provide the services you requested from us or is otherwise required or permitted by law or as set out in this Policy.
11.3 If we transfer your personal data out of the EEA, we ensure a similar degree of protection is in place by ensuring at least one of the following is implemented:
(a) Your personal data is transferred to a country that the European Commission has deemed to provide an adequate level of protection for personal data. For details, see European Commission: Adequacy of the protection of personal data in non-EU countries;
(b) Your personal data is transferred to recipients on the basis of specific contracts approved by the European Commission which give personal data the protection it has in Europe. For further details, European Commission: Model contracts for the transfer of personal data to third countries;
(c) Your personal data is transferred to recipients based in the USA that are part of the Privacy Shield which requires similar protection for personal data shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield.
11.4 On request we will supply you with further details on the protections for any of your personal data that is transferred or processed outside the EEA.
12.1 You have rights in respect of the information that we hold about you, including:
(a) the right to be informed of the ways in which we use your information: this is contained within this Policy, but contact us if you want more details;
(b) the right to ask us not to process your personal data for marketing purposes: we will make this change as soon as possible;
(c) the right to request access to the information that we hold about you: this is commonly known as a "data subject access request" and enables you to receive a copy of personal data that we hold about you (to the extent that we are required to provide it) and to check that we are lawfully processing it. It will be helpful and enable us to respond faster to you if you could be as specific as possible about the data that you would like a copy of (including dates where possible).
(d) the right to request that we correct or rectify any information that we hold about you which is outdated or incorrect: we may need to verify the accuracy of the new data that you provide to us;
(e) the right to withdraw your consent for our use of your information in reliance of your consent: refer to paragraph 6 above to see when we are relying on your consent;
(f) the right to object to our using your information on the basis of our legitimate interests: this right applies when there is something about your particular situation which makes you want to object to our processing on this ground (refer to paragraph 6 above to see when we are relying on our legitimate interests) and where our own compelling legitimate grounds to process your information do not override your rights;
(g) the right to request the transfer of your personal data to you or to someone else like a new replacement service provider: we will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;
(h) in certain circumstances, the right to ask us to delete information we hold about you: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it or where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
(i) in certain circumstances, the right to request restriction of processing of your personal data: this enables you to ask us to suspend the processing of your personal data in the following scenarios:
(i) if you want us to establish the data's accuracy.
(ii) where our use of the data is unlawful, but you do not want us to erase it.
(iii) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
(iv) if you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
(j) the right to complain about us to the ICO: you have to right to complain about us in relation to your data protection and / or privacy to the UK Information Commissioner's Office (www.ico.org.uk) as well as a right to complain to the relevant authority in your country of work or residence. We would, however, appreciate the chance to deal with your concerns ourselves before you approach the ICO, so please contact us first.
12.2 You should note that we may need to retain certain information for our own legal, record-keeping and research purposes. We may also need to send you service-related communications even when you have requested not to receive marketing communications.
12.3 How to exercise your rights
(a) You may exercise your rights using the contact details in paragraph 2 of this Policy or here. We will comply with your request unless we have a lawful reason not to do so. It will help to get your request dealt with promptly and correctly if you could please clearly mark it in the subject matter with "Information Privacy Request" or "Data Protection Request" or similar wording and be as specific as you can in your request in relation to what you want.
(b) Note that your objection to processing (or withdrawal of any previously given consent) could mean that we are unable to provide you with our legal services or otherwise perform the actions necessary to achieve the purposes set out above (see 'How we use your information'). Even after you have chosen to withdraw your consent, we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations.
(c) You may request us to cease sending you any marketing information at any time by notifying us using the contact information set out in paragraph 2 above. Each marketing email sent to you will contain an easy, automated way for you to "opt out" and cease receiving marketing emails from us.
(d) If you have received unwanted, unsolicited marketing from us or claiming to be from us, you should please forward a copy of it with your comments to us for review.
12.4 What we need to process your requests
(a) We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any unauthorised person. We may also contact you to ask you for further information in relation to your request.
(b) We will generally not charge any fee for you to access your personal data or exercise your other rights referred to. However, if your request is clearly unfounded, repetitive or excessive, we have the right to and may charge a reasonable fee or refuse to comply with your request.
12.5 Timing of our response to your requests: We will try to respond to all legitimate requests within one month. Sometimes it may take us longer than a month if your request is particularly complex or you have made more than one request. If so, we will notify you and keep you updated.
13.1 We are the controller and responsible for your personal data where we collected that data for our own business purposes.
13.2 Where we are performing services (such as document or contract creation or management, or information security services) for someone else who originally collected your data, we are the "processor" of that data. If so, you should also check the privacy policy of whoever you gave your data to. From our side as a processor, we will comply with all applicable data protection legislation and will protect your data to the same extent as set out in this Policy for protecting data when we are a controller. If we are the data processor rather than the data controller then we will:
(a) process the personal data only on the documented instructions of the controller;
(b) enter into a written contract or undertake to comply with written contractual clauses with the controller with regard to the data processing;
(c) only use staff and other persons who have a duty of confidentiality with regard to the data;
(d) comply with security obligations equivalent to those imposed on the controller by law;
(e) notify the controller of any breach in relation to the personal data shared by the controller;
(f) enlist a sub-processor only with the prior permission of the controller.
14.1 We keep this Policy under review. The date that it was last updated is set out below.
14.2 As a result of our reviews, we reserve the right to make changes to this Policy from time to time. The current version of this Policy is the one published at the relevant time on our website.
14.3 We will, where appropriate, notify you of any material changes by e-mail or other communication method (for example if there is a change in the processing purpose for your data, or a change in identity of controller). If we change the purpose for which we use your personal data from the purpose for which we collected it, we will also (on request) give you further information about how the new purpose is compatible with the original purpose or the legal basis for the new purpose.
14.4 It is important that the personal information that we hold about you is accurate and current. Please contact us and let us know if your personal data changes during your relationship with us.
© EXB Ltd 2019
Version Date: 01.07.19