Processing your personal data
To process your data we must have a lawful basis to do so. The law allows for six ways to process your personal data. We will process your personal data where:
- You have given consent to the processing of your personal data for one or more specific purposes;
- It is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract;
- It is necessary for compliance with a legal obligation to which we are subject;
- It is necessary in order to protect your vital interests;
- It is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
- It is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.
We are committed to protecting your personal information and respecting your privacy. We process your personal data when you access our Sites and Services. These include:
- Viewing or subscribing to our websites and social media functions.
- Corresponding with us using services such as web contact forms, webchat facility, telephone, email or written letter.
- Signing up to marketing material or newsletters.
- Entering competitions or participating in discussion boards.
- Applying for a job vacancy.
- Purchasing, licensing or accessing products, including mobile applications (Apps).
We use your personal data in the following ways:
- Provide you with personalised access to mapping and other geospatial data
- Provide you with access to other emapsite services
- Fulfil online payments or orders for any products you purchase through our online services
- Provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about, where you have consented to such communications
- Provide you with promotions and and information about other goods and services we feel may interest you, where you have consented to such communications
- Carry out our obligations from any contracts you have entered into with us
- Conduct customer satisfaction surveys and market research
- Process job vacancy applications and CVs
- Respond to your enquiries and complaints
- Notify you about changes to our products and services
Our legitimate interests
There are times when we will rely on legitimate interests to process personal data, particularly when it is not practical to obtain consent. We will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair. Examples are:
- Reporting criminal acts and compliance with law enforcement agencies.
- Internal and external audit for financial or regulatory compliance purposes
- Statutory reporting
- Maintenance of suppression lists
- Customer satisfaction surveys and market research
- Physical and network security
- Work experience placements
- Financial management and control
- General administration
Categories of personal data you may give to us
Categories of personal data you give us includes:
- Telephone number
- Email address
- Date of birth and age
- User name and passwords to access our sites and services
- Financial and credit card information
- Personal profile description and photograph
- Equality and diversity information
- Location information
Your location information
- We may use GPS technology or other technology to determine your current location in order to provide certain functionality to you as part of our site and services.
- You can withdraw your consent to determine your current location at any time through your device setting
Your device information
Each time you visit or use our Sites and Services, we may automatically collect the following information:
- Technical information, including the type of mobile device you use, a unique device identifier (for example, your Device's IMEI number, the MAC address of the Device's wireless network interface, or the mobile phone number used by the Device), mobile network information, your mobile operating system, the type of mobile browser you use, and/or time zone setting;
- Details of your visits to any of our Sites and Services including, but not limited to, Internet protocol (IP) address used by your Device, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes and the resources that you access (Log Information);
- URL click stream information showing how users have reached our Site and Services and whether they access other third party sites via any external links.
We use the device information in the following ways:
- To administer our site and services for troubleshooting, data analysis, testing, research, statistical and survey purposes;
- To improve our site and services to ensure that content is presented in the most effective manner for you and for your device;
- To allow you to participate in interactive features of our sites and/or service, when you choose to do so;
- As part of our efforts to keep our sites and services safe and secure;
- To determine which features your device supports which assists our development strategy.
We use the Log information in the following ways:
- Track the success of our products and services and our marketing activity.
- Monitor data traffic and any patterns of use.
Information we pass to third parties and other data sharing
In order to facilitate your use of our site and services, we may have to share your personal data with third parties to provide elements of our site and services to you. We will provide your personal data to third parties when they need the data to perform particular functions in delivering our sites and services to you or as part of our regulatory compliance. These include:
- Service providers acting as data processors, located in the UK and EU who provide data hosting facilities, IT and system administration services.
- Service providers located in the UK and EU acting as data processors who administer our customer email service, webchat service, API Services.
- Service providers where a device requires interaction with 3rd parties for registration of devices, 3rd party software and downloading of mapping tiles.
- Service providers acting as a data processor for the facilitation of our recruitment processes.
- HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
- We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the Companies Act 2006.
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.
- If we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request.
- Protect the rights, property or safety of our group companies, our suppliers and/or our customers.
- We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Data transfers to third countries
The data we collect from you may, on occasion, be processed at a destination outside the European Economic Area (EEA). It may also be processed by organisations operating outside the EEA who work for us or for one of our suppliers. These organisations may be engaged in the fulfilment of your request, order or reservation, and the provision of support services.
Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.
Once it is within our control, we will do our utmost to ensure your personal data is processed in a way that ensures appropriate security from unauthorised or unlawful processing, accidental loss, destruction or damage.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Retaining your personal information
We will retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may also retain your personal data for a reasonable period afterwards to allow us to respond to any follow up enquiries or complaints, or for as long as you remain a registered user of our products and services.
To determine appropriate retention periods for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, we may use or store this information indefinitely without further notice to you.
In some circumstances you can ask us to delete your data: see Right of Erasure below for further information.
Your data protection rights
Withdraw consent – Where we are using your personal information on the basis of your consent, you have the right to withdraw that consent at any time.
Right to be informed – You have the right to be told how your personal information will be used. This policy document, and shorter summary statements used on our communications, are intended to be a clear and transparent description of how your data may be used.
Right of access – You can write to us asking what information we hold on you and to request a copy of that information. This is called a Subject Access Request. From 25 May 2018 we will have 30 days to respond to you once we are satisfied you have rights to see the requested records and we have successfully confirmed your identity. Please contact us if you wish to submit a Subject Access Request
Right of erasure – From 25 May 2018, you have the right to be forgotten (i.e. to have your personally identifiable data deleted). However, we may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you. In some cases, we may recommend that we suppress you from future communications, rather than data deletion. Our Customer Services Team will be happy to advise you.
Right of rectification – If you believe our records are inaccurate you have the right to ask for those records concerning you to be updated. This enables you to have any incomplete or inaccurate data we hold about you corrected. We may need to verify the accuracy of the new data provided to us.
Right to restrict processing – In certain situations you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
Right to data portability – Where we are processing your personal data under your consent, the law allows you to request data portability from us to another service provider. This right is largely seen as a way for people to transfer their personal data from one service provider to another. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Right to object – You have an absolute right to stop the processing of your personal data for direct marketing purposes. If you wish to amend your communication preferences you can do so on our Your Preferences page
Right to object to automated decisions – In a situation where a data controller is using your personal data in a computerised model or algorithm to make decisions “that have a legal effect on you”, you have the right to object. This right is more applicable to mortgage or finance situations. We do not undertake complex computerised decision making that produce legal effects.
Cookies are small amounts of information, which we may store on your computer. Unless you have indicated your objection when disclosing your details to us, our system will issue cookies to your computer when you log on to the site. Cookies make it easier for you to log on to and use the site during future visits. They also allow us to monitor website traffic and to personalise the content of the site for you. You may set up your computer to reject cookies by following the relevant instructions, which can be found at www.aboutcookies.org.uk In that case, you may not be able to use certain features on our site. If you do not wish to receive cookies in the future, please let us know at [email protected]
Changes to this policy
All comments, queries and requests relating to our use of your information are welcomed and should be addressed to [email protected]