At This Can Happen we are committed to respecting your privacy. This Privacy Notice explains how we collect, use and disclose personal information that we receive when you respond to our questionnaires or use our online platform (“Platform”).
It is important that you read this Privacy Notice so that you are fully aware of how and why we are using your data.
The TCH Platform is owned and operated by SBL Ideas Ltd, a company registered in England and Wales with company number 11026007 and having its registered office at 19-20 Bourne Court Southend Road, Woodford Green, Essex IG8 8HD, trading as “This Can Happen” or “TCH”.
TCH is registered as a data controller with the Information Commissioner’s Office under data protection registration number ZB139431.
If you have any questions about our Privacy Notice or your information, or wish to exercise any of your rights as described in this Privacy Notice or under data protection laws, you can contact us:
By post at:
19-20 Bourne Court Southend Road, Woodford Green, Essex IG8 8HD
By email at: firstname.lastname@example.org
This Privacy Notice refers to data collected by TCH in the course of provision of its services. TCH’s practices and policies surrounding this data are governed by a Client Services Agreement (“CSA”) between your employer and TCH.
Under the CSA, your employer is the “controller” (i.e. decision-maker) of your personal data, while TCH is the “processor” of such personal data when providing its services to your employer.
However, we may also act as a “controller” of your personal data in limited situations in connection with your use of the Platform. This is the case where we are processing your personal data for our own purposes outside the context of providing services to your employer under the CSA (e.g. to improve your experience of the Platform).
CONFIDENTIALITY OF YOUR INFORMATION
TCH treats in strict confidence your responses to our surveys and questionnaires and your employer is not entitled to have access to such responses other than in an aggregated and anonymized form as prepared by TCH.
TCH AS PROCESSOR
Where we are acting as a processor, we process your personal data on behalf of and in accordance with the instructions of your employer. We are not responsible for our customers’ (i.e. your employer’s) policies and practices surrounding data privacy and security.
TCH AS CONTROLLER
In the limited situations where we act as a controller of your personal data, we are directly responsible to you in respect of our handling of your data. We have set out below details of the types of your personal data we collect as a controller and the purposes for this (among other matters).
Personal Information We Collect
We collect the following limited information regarding your use of the Platform as a controller:
- Technical Data: including the Internet protocol (IP) address, browser type, internet service provider, device identifier, your login information, time zone setting, browser plug-in types and versions, preferred language, activities, operating system and platform, and geographical location; and
- Usage Data: including the full Uniform Resource Locators (URL), clickstream to, through and from the Platform, pages you viewed and searched for, page response times, length of visits to certain pages, referral source/exit pages, page interaction information (such as scrolling, clicks and mouse-overs), date and time pages are accessed, website navigation and search terms used, and whether you have opened our marketing newsletters.
We may also collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal information but is anonymised and is not considered personal information as it will not directly or indirectly reveal your identity.
What We Do with Your Personal Information
When acting as a data controller, we will only use your personal information if we have a legal basis for doing so. The purposes for which we use and process your information and the legal basis on which we carry out each type of processing is explained below:
- To administer the Platform, including resolving technical issues, troubleshooting, data analysis, testing, research, statistical and survey purposes.
Lawful basis: It is in our legitimate interests to ensure that the Platform functions properly and to resolve issues with it where required.
- To improve the Platform to ensure that content is presented in the most effective manner for you and your computer, mobile device or other item of hardware through which you access the Platform.
Lawful basis: Your consent.
- To anonymise and aggregate the data we collect through the Platform in the course of providing the services to our customers for statistical and research purposes.
Lawful basis: It is in our legitimate interests to anonymise the personal data we collect in the course of providing our services in order that we can carry out research, prepare reports and promote our services.
Disclosure of Your Personal Information to Third Parties
We may share your personal information with third party vendors and other service providers that perform services for us or on our behalf as required to achieve the purposes described above, which may include providing web hosting or analytics services.
As detailed above, we may share your data with our service providers and some of these may be based outside of the United Kingdom (“UK”) and European Economic Area (“EEA”). This may involve transferring your personal data internationally outside the UK and the EEA.
Where personal information is transferred to and stored in a country not determined by the UK or European Commission as providing adequate levels of protection for personal information, we take steps to provide appropriate safeguards to protect your personal information, including entering into standard contractual clauses approved by the UK or the European Commission, obliging recipients to protect your personal information.
If you would like further information on the specific mechanism used by us when transferring your personal information outside of the UK or the EEA, please contact us using the details set out in the Contact Us section above.
Security of Your Personal Information
We use appropriate technical and organisational security measures (including encryption) to protect personal information from unauthorised use, loss, alteration or destruction. Where data processing is carried out on our behalf by a third party, we take steps to ensure that appropriate security measures are in place to prevent unauthorised disclosure of personal information.
Despite these precautions, however, we cannot guarantee the security of information transmitted over the Internet or that unauthorised persons will not obtain access to personal information.
How Long We Keep Your Personal Information
We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:
- Right of access. You have the right to obtain access to your personal information.
- Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
- Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
- Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
- Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
- Right to object. You have a right to object to any processing based on our legitimate interests in certain circumstances.
- Right to withdraw consent. If you have provided consent to any processing of your personal information, you have a right to withdraw that consent but without affecting the lawfulness of processing based on consent before its withdrawal.
Please note that not all of the above rights are absolute and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.
You can exercise any of your rights as described in this Privacy Notice and under data protection laws by contacting us as provided in the Contact Us section above.
Cookies and Other Tracking Technologies
If you have any questions or concerns regarding our Privacy Notice or practices, please contact us as provided in the Contact Us section above. You also have the right to complain to the UK Information Commissioner’s Office (https://ico.org.uk/). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
We reserve the right to change this Privacy Notice from time to time. Any changes will be posted on the Platform with an updated revision date. If we make any material changes to this Privacy Notice, we may notify you by email or by means of a prominent notice on the Platform prior to the change becoming effective.
Updated and effective as of 23 July 2021