Privacy Notice

Data controller: Widernet Communications Limited

Person with responsibility for data protection compliance within the Company: The Data Protection Officer who can be contacted at help@sharedworkforce.com

---

The Company collects and processes personal data relating to its customers in order to manage the customer relationship. The Company is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

What information does the Company collect?

The Company collects and processes a range of information about you. This includes:

• business contact name
• company address and contact details, including email address and telephone number

The Company collects this information upon registration for a developer account. Data is stored in a database which is encrypted at rest.

Why does the Company process personal data?

The Company needs to process data to enter into a contract with you and to meet its obligations under the contract. For example, it needs to process your data to provide you with an invoice for services purchased.

In some cases, the Company needs to process data to ensure that it is complying with its legal obligations. For example, to charge the applicable taxes (VAT).

In other cases, the Company has a legitimate interest in processing personal data before, during and after the end of the customer relationship. Processing customer data allows the Company to:

• maintain accurate and up-to-date customer records and contact details (including details of who to contact in the event of a site outage or issue with the service);
• ensure effective general customer relationship management and business administration; and
• respond to and defend against legal claims.

Where the Company relies on legitimate interests as a reason for processing data, it has considered whether or not those interests are overridden by the rights and freedoms of customers and has concluded that they are not.

Who has access to data?

Your information is shared internally with the Directors of the Company.

The Company shares your data with various third party providers to help provide the service to you. These third parties process your personal information on our behalf for the purposes of site administration, payments, development and back-up.

How does the Company protect data?

The Company takes the security of your data seriously. The Company has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. Our internal policies and controls include:

• Our email facility is provided by Google and we use Google Drive to store data. Google is GDPR compliant;
• Passwords that are used for Google Drive are encrypted;
• We use 2-factor authentication where possible;
• Electronic devices (e.g. laptop, mobiles, tablets etc.,) are password protected and locked when not in use and/or left unattended;
• Manual/paper-based records are stored in lockable cabinets at all times when not in use and appropriate measures are taken (e.g. password protection) to protect the transfer of any electronic records if taken off-site; and
• We ensure that the movement of any manual records to off-site locations are undertaken securely and never left unattended.

Where the Company engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and Company measures to ensure the security of data.

For how long does the Company keep data?

The Company will hold your personal data for the duration of your contract and for 12 months after the contract comes to an end.

Your rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require the Company to change incorrect or incomplete data;
• require the Company to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where the Company is relying on its legitimate interests as the legal ground for processing; and
• ask the Company to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the Company's legitimate grounds for processing data.

If you would like to exercise any of these rights, please contact Erica Turner. You can make a subject access request by making the request in writing to erica@sharedworkforce.com.

If you believe that the Company has not complied with your data protection rights, you can complain to the Information Commissioner.

What if you do not provide personal data?

You have some obligations under the contract to provide the Company with data. In particular, you are required to provide your company name, company number and registered company address.