Privacy (transparency) notice pursuant to General Data Protection Regulation Arts 13 and 14.

This notice is intended for individuals with whom we deal in our business, including candidates for jobs with us. It is not intended for our employees.

We categorise those individuals (“data subjects”) as follows:

• Individuals - academics, the retired, those between jobs, sole traders without employees and those who only contact us because of their personal interest in our business and technology.
• Corporate subscribers - deal with us in their capacity as employees or owners of businesses which have other employees.
• Candidates - those who have applied for a job with us.

We obtain and process personal data in different ways depending upon the data subject, the purpose of the processing and way in which we obtained your personal data.

In most circumstances, your data will only be processed within the UK or EEA. If for any reason we need to have your data processed elsewhere we will inform you of that, any privacy risks involved and what we have done to minimise those risks. In some circumstances, we would also seek your consent for that.

Some of our data is stored, or otherwise processed for us, outside the UK/EU. In those circumstances we ensure that our contracts with those processors and their processing comply with UK/EU data privacy standards and rules.

You can at any time ask us to tell you what personal data relating to you we hold.

You also have the right to ask us to rectify your data if it is inaccurate, erase it or restrict the processing of it. In some circumstances, you can ask us to provide it to you in a format which would allow you to transfer it digitally to another.

Where we have requested and you have given us consent to process your data you may withdraw that consent at any time.

Were our business to be sold all your data would be transferred to the purchaser so that they could use it in the same way as we do now.

If you are at all concerned about our processing of your data please let us know by emailing [email protected]

Purpose. We process your data in order to respond to you and so that we can contact you about matters of mutual interest, and send you white papers, case studies and other related materials that may be of interest.

Legitimate Interest. We have a legitimate interest in doing that as you will have indicated that you wish us to do so or it is reasonable for us to assume that. We do not need your consent.

Marketing. If we were to use your data in order to send you marketing material about our services, otherwise than for your interest only, we will only do so with your consent. That consent can be withdrawn by you at any time by following the “unsubscribe” link on our communication.

Those with whom we share it. Some of our data, which could include your personal data, is stored off site by third parties. Some is stored by our UK subsidiary, Critical Software Technologies. Except for our marketing database none of our personal data is stored outside the EEA or UK.

Retention. Your data will be retained for up to ten years after our last interaction with you unless you ask us to delete it earlier and we are able to do that.

Why we need your data. Without your data we would not have the information necessary to be able to communicate with you.

Where we get it. Most of your data held by us will have come from you. Some may have been obtained from your colleagues and friends.

Purpose. We process your data to enable us to contact you in your role within your organisation and in order to record any information that you provide to us. That contact may include sending you a newsletter or marketing material but only if they are relevant to your role. We may also need to use it in order that we can recommend you or the goods and services of your organisation to others.

Legitimate Interest. We have a legitimate interest in using your data for those purposes. We do not need your consent. You can however at any time tell us that you do not wish for us to contact you again at all, or that you do not wish to receive marketing material.

Those with whom we share it. Some of our data, which could include your personal data, is stored off site by third parties. Some is stored by our UK subsidiary, Critical Software Technologies. Except for our marketing database none of our personal data is stored outside the EEA or UK. We may, in connection with a project on which we are working with your organisation, provide it to others working on the same project. We may also provide it to third parties seeking our recommendation of your organisation or someone like you.

Retention. Your contact and other data will only be held for as long as you retain your role in your organisation or, if it was relevant to a project, for so long as we retain the records of that project.

Why we need your data. Your data is needed principally so that we can contact you and otherwise for the purpose set out above.

Where we got it. The usual source of your data is you or your organisation. On occasions we may obtain it from your colleagues, from mutual clients, from others involved in a project or from publicity material published by your organisation or publicly available directories.

If you have indicated that you would like to join our team and we decide to keep your details “on file” and have informed you of that, we will send you newsletters and similar material to keep in touch. You can unsubscribe at any time.

Purpose. We process your data (your contact details, career history and other relevant information) to enable us to assess you for a role and contact you. Some of that contact may be by way of newsletters keeping you in touch with us and our news. You will be offered the opportunity to unsubscribe if you wish.

Legitimate Interest. We have a legitimate interest in using your data for those purposes. We do not need your consent.

Those with whom we share it. Some of our data, which could include your personal data, is stored off site by third parties. Some is stored by our UK subsidiary, Critical Software Technologies. None of our personal data, except that on our marketing database, is stored outside the EEA or UK. We may, if your role would be working for one of our customers, provide it to that customer to allow them to assess you. If we seek references for you we will supply your name and details of the proposed role to your referees. If we wish to verify your qualifications or suitability we may provide information sufficient to identify you, things that you have told us about yourself and the proposed role to those that can verify the information you have given us.

Retention. If we decide not to employ you, most personal data about you will be deleted/destroyed approximately six months after that decision is made and we will retain only sufficient data to identify that we have considered you for employment but that your application was unsuccessful. If we think we might want to employ you in future we will retain indefinitely all the data that we have about you unless you ask us to delete it. If we employ you, all the data about you will be transferred to your HR file and used and retained in accordance with our policies for employment.

Why we need your data. Without your data we would be unable to assess you, or contact you.

Where we got it. The usual source of your data is you or a recruitment consultant or “job board”. Some data may come from referees or those we use to verify the information that you provide.

In addition to the disclosures reasonably necessary for the purposes identified elsewhere in this privacy policy, we may disclose information about you:

• To the extent that we are required to do so by law
• In connection with any legal proceedings or prospective legal proceedings
• In order to establish, exercise or defend our legal rights
• To the purchaser (or prospective purchaser) of any business or asset which we are (or are contemplating) selling

Except as provided in our privacy policy, we will never provide your information to third parties.

We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

Of course, data transmission over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet.

We may update this privacy policy from time-to-time by posting a new version on our website.

The website contains links to other websites. We are not responsible for the privacy policies or practices of third-party websites.

Please let us know if the personal information which we hold about you needs to be corrected or updated.

If you have any questions about this privacy policy or our treatment of your personal data, please contact us or write to us at Critical Software SA, Parque Industrial de Taveiro, Lote 48, 3045-504 Coimbra, Portugal.