Privacy Notice

Version 2 – (27^th April 2018 - Burgess & Lee)

Burgess & Lee collects data from visitors throughout the website experience. This is largely to provide interactive functionality that would otherwise be impossible without collecting the minimum amount of data. Some data is also used to analyse your experience anonymously to improve the website experience.

Burgess & Lee respect your privacy, so we will not sell your data to third parties, allow any access to the data that isn’t necessary to honour any other contracts we have in place, or store excessive amounts of data we no longer need.

Burgess & Lee will comply with the General Data Privacy Regulation (GDPR) (EU May 25^th 2018).

 

Definitions

The Data Subject – any living person, E.g. you

Third Party – another company who Burgess & Lee work with to provide services to The Data Subject

Personally Identifiable Information – data belonging to The Data Subject that can be used to uniquely identify them

Data Controller – any organisation that stores Personally Identifiable Information, E.g. Burgess & Lee

Data Processor – any organisation that works on (processes) Personally Identifiable Information

 

How we obtain your data

Burgess & Lee collects data from The Data Subject during the usage of this website. Some of that data may be Personally Identifiable Information. This may be entered into web forms or provided to the website by the browser (such as IP address).

Burgess & Lee may also obtain Personally Identifiable Information about The Data Subject from a Third Party as part of a contract to work with that data.

 

How we use your data

Burgess & Lee primarily uses data from The Data Subject to either serve a contract between Burgess & Lee and The Data Subject, or to provide necessary functionality on this website.

Burgess & Lee may also collect additional data to satisfy other legal requirements, such as is required for Ecommerce.

 

Which Third Parties have access to the data collected

Burgess & Lee works with several third parties to provide the service The Data Subject receives.

In all cases there is either an explicit contract in place between Burgess & Lee and the Third Party, Terms and Conditions, or other legally binding relationship.

 

The data will likely be shared with:

A list of services that most visitors to the websites or customers will probably have their data shared with and why

Alphabet Inc (Google) – a suite of Google Tools are used by Burgess & Lee

Intergage Ltd – website host / provider

 

The data may be shared with:

A list of services that visitor or customers data is commonly shared with, but only applies to 50% or less

Sage (Accounts) – accounting tool used for tracking and invoicing customers

 

The data is also rarely shared with the following:

A list of rare (edge case) services that 1 or 2 visitors or customers may find their data in.

Mobile Phones – our staff may enter your contact number into their phones for the purpose of a meeting, and will then erase the number after the meeting

Marketing

Burgess & Lee does not share your data with any Third Parties for Marketing Purposes unless The Data Subject has explicitly Opted in.

 

Third Party Cookies

Burgess & Lee can largely operate without the use of third party cookies. However, in many cases third party cookies improve the website experience.

Burgess & Lee will not add Social Sharing buttons to the page unless The Data Subject has explicitly Opted in to “Social Cookies”.

Burgess & Lee will not include any tracking systems unless The Data Subject has explicitly Opted in to “Tracking Cookies”.

Burgess & Lee will allow Google Analytics to operate on this website in order to provide necessary anonymous analytical data. This may result in a small amount of Personally Identifiable Information being collected, but this is only used as statistics and not for identification purposes.

 

Data Security and Storage

Burgess & Lee will only store data for as long as necessary to fulfil the purpose for which it was obtained. Some data may be held for longer if it is either held on other systems that have not updated, in backup data that has not expired, or because of another lawful basis.

Burgess & Lee take security seriously, and make use of technology where feasible to secure data and protect against breaches.

 

Personal data protection principles

We adhere to the principles relating to Processing of Personal Data set out in the GDPR which require Personal Data to be:

(a)          Processed lawfully, fairly and in a transparent manner (Lawfulness, Fairness and Transparency).

(b)          Collected only for specified, explicit and legitimate purposes (Purpose Limitation).

(c)           Adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (Data Minimisation).

(d)          Accurate and where necessary kept up to date (Accuracy).

(e)          Not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes for which the data is Processed (Storage Limitation).

(f)           Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (Security, Integrity and Confidentiality).

(g)          Not transferred to another country without appropriate safeguards being in place (Transfer Limitation).

(h)          Made available to Data Subjects and Data Subjects allowed to exercise certain rights in relation to their Personal Data (Data Subject's Rights and Requests).

 

Data Subject's rights and requests

Data Subjects have rights when it comes to how Burgess & Lee handles their Personal Data. These include rights to:

1. withdraw Consent to Processing at any time;
2. receive certain information about the Data Controller's Processing activities;
3. request access to their Personal Data that we hold;
4. prevent our use of their Personal Data for direct marketing purposes;
5. ask us to erase Personal Data if it is no longer necessary in relation to the purposes for which it was collected or Processed or to rectify inaccurate data or to complete incomplete data;
6. restrict Processing in specific circumstances;
7. challenge Processing which has been justified on the basis of our legitimate interests or in the public interest;
8. object to decisions based solely on Automated Processing, including profiling (ADM);
9. prevent Processing that is likely to cause damage or distress to the Data Subject or anyone else;
10. be notified of a Personal Data Breach which is likely to result in high risk to their rights and freedoms;
11. make a complaint to the supervisory authority; and
12. receive or ask for their Personal Data to be transferred to a third party in a structured, commonly used and machine readable format.
13.  

Updates to our Privacy Notice

This Privacy Notice will be reviewed regularly and this page will be updated with changes.

 

Contacting the Data Protection Officer (DPO)

If you have any concerns about how Personally Identifiable Information is used by Burgess & Lee please contact the Data Protection Officer:

Contact Details (address / email / telephone) of the DPO