Contractors and Suppliers
Fair Processing Notice
- We respect your personal data and take its security very seriously.
- We only hold what data we need for the purpose for which we obtained it.
- We never share your data with any advertisers.
- We delete your data when it’s no longer required to do our job properly.
- You have privacy rights, and we honour them.
- We are happy to answer your questions. Our contact details can be found at the end of this notice.
What data we hold
For an enquiry or for a quote that you do not accept, we will process your name and contact information.
If you proceed and we enter into a contract with you, we will process your name, address, contact details and payment information.
We also generate log files from various servers. This will include an IP address assigned to you or to your internet service provider.
References to the legal basis for processing of your personal data (e.g. “(Basis: Art. 6(f).)”) are a reference to the article of the General Data Protection Regulation. Each piece of personal data that we process must have a legal basis.
How we use your personal data:
When we both work for the same client
In order to fulfil our contractual obligations from our mutual client, your details will have been passed to us. We will need to process your data in order for us to work on the client’s account.
(Basis: Art. 6(f): it is in our legitimate interest that we process your data so that we can fulfil the contractual obligations of our client)
How we use your personal data:
If you enter into a contract with us
If you choose to work with us, we will need to process your data in order to provide you with the service that you have ordered. We need to process payment details in order to fulfil the contract. We will retain your personal data for 6 years after our contract has ended, or 6 years after our last invoice to you has been paid.
(Basis: Art. 6(b): processing is necessary for the performance of a contract)
Your data and transfers outside of the EEA
Some of your data may be processed using Google, DropBox, Paypal, Amazon Web Services, Slack, Trello and other digital services which are based in the USA. However adequate safeguards are in place as these organisations are certified to the EU-US Privacy Shield Framework.
We use Harvest for accounting purposes to create, store and send invoices – it records email addresses and account history, but does not process any payment. Harvest is preparing to GDPR – information can be found here. https://www.getharvest.com/security
Technical data
Sites we manage the hosting for have access logs and other security measures which may record your IP address or personal information if logged in. We use the logs to help with our company’s security as well as to look at visitor behaviour (e.g. which website pages get the most traffic or are the most popular).
(Basis: Art. 6(c): we have a legal obligation to protect the data of our clients and our staff. Art. 6(f): strategy planning is a legitimate activity for a business.)
Third parties
As a prospective collaborator, we will not transfer your personal data to third parties at this stage except the following:
- Companies that provide services to us. Our telephone service providers will get to see your phone number if we call you and our broadband supplier which could see your email address (but not the content of what you send us, if you encrypt it).
- Companies that we are recommending you to. As part of fulfilling our obligations to our clients or potential clients we mat recommend you or your business to them. This may require us to send some contact information. where possible we will limit that information to hat which is already in the public domain.
- In response to a court order. It is possible, though unlikely, that we might be forced to disclose your information in response to a court order.
As a supplier, we transfer your data to the following third parties:
- Cloud service & IT providers. We use a number of cloud service & IT providers, such as our CRM, project management systems, accountancy software, email providers and webhosting. We also share with IT professionals who not only ensure that our systems run smoothly, but are also committed to the highest standards of data protection compliance.
- We use photographers, copywriters, freelancers, collaborators and other specialist professionals. If appropriate to the project, we’ll share your information with them.
- In response to a court order. It is possible, though unlikely, that we might be forced to disclose your information in response to a court order.
If we enter into a contract with you, we transfer your data to the following third parties:
- Accountants & Bookkeeper. We also use an external accountancy service but, unless you are a sole trader or a partnership, they are unlikely to see any personal data relating to you.
- If you do not pay any bills that may be accrued, we may choose to engage a third party to recover any money you owe us.
Your rights
You have rights in respect of our processing of your personal data which are:
- To access to your personal data and information about our processing of it. You also have the right to request a copy of your personal data (but we will need to remove information about other people).
- To rectify incorrect personal data that we are processing.To request that we erase your personal data if:we no longer need it;
- if we are processing your personal data by consent and you withdraw that consent;
- if we no longer have a legitimate ground to process your personal data; or
- we are processing your personal data unlawfully
- To restrict our processing of your personal data if it is based upon legitimate interest.
- To object to our processing if our processing is based upon legitimate interest.
- To request that your personal data be transferred from us to another company if we were processing your data under a contract or with your consent and the processing is carried out automated means.
- If you want to exercise any of these rights, please contact us using the details at the end of this notice.
Retention periods
This is the length of time that we will continue to process or store your personal data.
Emails: We store all emails for a maximum of two years. We may keep important emails for the duration of our working relationship with you. We may delete other emails at any time at our discretion, as long as no relevant subject access requests have been made.
Data about clients: We will store your data for 6 years after your contract ends, or 6 years after our last invoice to you has been paid, for accountancy and tax purposes.
Data about enquiries: We keep contact information from enquiries for a period of up to three years.
Content: Content and images supplied to us are kept on our secure server in easily accessible folders for up to three years. These folders may include your personal information or images for which consent is required. After that they are moved into a secure archive to which have limited, password protected access. We keep this content to help us keep work for our clients, or to keep records of the work we have done for posterity. We will never share your previously unpublished work or source files without your permission.
Please note, these archives do not constitute as a backup, and cannot be relied upon as a storage mechanism.
Website Access Logs: We may choose to keep a record of access to websites we manage. These website logs can kept indefinitely for the functioning duration of the website. We feel these logs present limited risk and are more useful being retained.
ICO registration
Venn Creative is registered with the Information Commissioner’s Office
Ref: ZA394998
Contact us
Venn Creative
The Studio
Unit 28, Kernick Industrial Estate
Penryn TR10 9EP
Cornwall
01327 377105
