General Data Protection Regulation

With the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 coming into force on May 25^th 2018, the Eco Carbon Traders Limited (ECT) has updated its data privacy notice. The GDPR gives data subjects a right to be informed and this privacy notice will continue to be updated as required with the latest version always available to read. If there is a substantial change in the future, however, we will do our best to inform you of the details.

As always, the BBA remains committed to the protection of personal data and commercial information. If you have any queries about the data privacy notice, please email info@ecocarbontraders.co.uk.

Last updated: May 2018

Eco Carbon Traders Limited (ECT) is committed to protecting and respecting your privacy. ECT is a company limited by guarantee, registered in England & Wales under company number 8619571. ECT’s registered office is Unit G2, Chapel Farm Industrial Estate, Cwmcarn, Gwent, NP11 7BH.

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.  Please read the following carefully to understand our views and practices regarding your personal data and how we will treat data.

For the purpose of Data Protection legislation, the data controller is ECT.

To contact ECT on a data protection issue, please email info@ecocarbontraders.co.uk

Information we may collect from you:

We may collect and process the following data about you:

Information you give us.

Most of the personal data we process are data that you already know and provide to us. You may give us information about you by submitting information to the Website or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you register to use the Website, subscribe to any service or if you report a problem with the Website. The information you give us may include personal data such as:

• your name
• your address
• your email address
• your phone number

It is necessary for to provide the personal data we need to be able to respond to any enquiry you send to us, or to prepare or fulfil a contract with you. If the personal data are not provided, we may be unable to respond to you or provide the services you are requesting.

If you are applying for a job at ECT, the information you provide may include more extensive personal data. There is an appendix to this document describing the processing of personal data for job applicants. The data privacy notice for employees is a separate document, and is available to all ECT staff.

Information we collect about you when you use the Website.

With regard to each of your visits to the Website we may automatically collect the following information:

• technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our client services number.

Information we receive from other sources.

• We may receive information about you if you use any of the other websites we operate or any other services we provide. We may also receive information about you if you are the customer of a ECT client (for example, a customer of one of our approved installers for whom we carry out any works as part of ongoing approval). We may also receive personal data as part of complaints or reports from third parties. We may receive contact information from third parties for marketing purposes; these data will only be used or processed if doing so is compliant with the Data Protection Legislation.

Uses made of the information and the lawful basis for this processing.

Information is processed according to data protection legislation.

Information you give to us.

We will use this information:

• to respond to enquiries submitted on the Website¹;
• to carry out our obligations arising from any intended or active contracts entered into between you and us and to provide you with the information or services that you request from us²;
• to carry out processing relating to complaints, appeals and whistleblowing¹;
• to carry out processing for recruitment¹;
• to provide you with information about other services we offer that are similar to those that you have already enquired about¹;
• to send you our newsletter (if you have subscribed to this) ³;
• to notify you about changes to our service¹;
• to ensure that content from the Website is presented in the most effective manner for you and for your computer¹.

The superscripted numbers above indicate the lawful basis of processing for each of the above uses:

¹ – legitimate interests – to carry out the necessary processing to answer enquiries, to maintain the effectiveness of the website, and to carry out business, marketing and recruitment activities.

² – contractual necessity – to carry out the necessary processing to prepare and perform contracts

³ – consent (which you may withdraw at any time, including by using the Unsubscribe link sent with each newsletter email)

Information we collect about you when you use the Website.

We will use this information:

• to administer the Website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to improve the Website to ensure that content is presented in the most effective manner for you and for your computer;
• as part of our efforts to keep the Website safe and secure.

Information we receive from other sources.

We may combine this information with information you give to us and information we collect about you. We may use this information and the combined information for the purposes set out above (depending on the types of information we receive).

If you are the customer of a ECT client, we may use the information to monitor client installations, and/or to carry out site inspections. If you are applying for a job at ECT, we may receive personal data about you from third parties such as educational establishments, previous employers or references. The lawful basis of this processing is legitimate interests.

Disclosure of your information.

We may share your information with selected third parties including:

• business partners (such as the owners of schemes we operate, e.g. Local Authorities, Energy Companies Obligation)
• Suppliers
• regulatory authorities who may require access to documents containing personal data as part of their supervisory activities (e.g. Stroma Accreditation) and other external auditors (e.g. OFTEC, GAS Safe)
• subcontractors and other third parties for the performance of any contract we enter into with you (this could include occasions where inspections are sub-contracted)
• analytics and search engine providers that assist us in the improvement and optimisation of the Website.

We may disclose your personal information to third parties to obtain legal advice or if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

Where we store your personal data.

All information you provide to us is stored on our secure servers. Any online payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of the Website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

We will take all steps reasonably necessary to ensure that your data are treated securely and in accordance with this privacy policy. The data that we collect from you will not be transferred to or stored outside the European Economic Area (“EEA”) except as required for the fulfilment of contracts entered into between you and ECT, or on behalf of you (for example, to carry out factory inspections in a third country). All transfers of data outside the European Economic Area will be made in accordance with the Data Protection legislation.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Data retention

Contact details provided as part of the preparation or fulfilment of a contract (for example, for all works carried out approval or inspection): documents containing personal data, such as correspondence, will be retained on the job files while the approval or equivalent remains valid, and for as long after that as information may need to be available for commercial or auditing reasons. This is required as audits often require the ability to go back through the history of an approval, inspection or test. Job files will not, however, be used as the primary source of contact details. Contact details are also retained for the length of an approval or certificate in order to provide contacts with correspondence relevant to our service with them, such as policy or service changes.

Contact details used for newsletter distribution, marketing or other updates: these are retained until a request is made for erasure or rectification, or until ECT is made aware that they are invalid.

Personal data from job applications: personal data from unsuccessful job applications (e.g. CVs, interview notes) will be retained for twelve months after they are received by ECT, unless otherwise agreed between ECT and the applicant. Personal data from successful job applications are transferred to Personnel Files.

For the avoidance of doubt, where there is a legal requirement to retain personal data, this will be complied with, taking precedence over any ECT retention policy.

We will not disclose your personal information to third parties other than as set out in this clause without your prior written consent.

Your Rights as a data subject.

he Data Protection legislation gives you a number of rights concerning the personal data we hold about you.

The right to access data

You have the right to access personal data held about you. To submit a request to access personal data, please email info@ecocarbontraders.co.uk.  ECT will acknowledge your response shortly after it is received, and we will let you know whether there is any further information we need. We aim to respond to your request as soon as possible, and in any case within one month.

The right to rectification, erasure, restriction or objection

In some situations, you have the right to request that personal data we hold about you is rectified (corrected if it is inaccurate) or erased (deleted). You also have the right to request that your personal data is only used for some elements of processing, and you have the right to object to the processing of your personal data for one or more purposes. If you wish to make any of these requests, please email info@ecocarbontraders.co.uk.

The right to withdraw consent

If ECT is processing personal data on the basis of consent, you have the right to withdraw consent at any time. This does not affect processing already carried out on the basis of previous consent. ECT will try to make this easy for you in cases where we rely on consent as the basis for processing, such as including an ‘unsubscribe’ link on emails. Alternatively, please email info@ecocarbontraders.co.uk with your request.

The right to lodge a complaint with a supervisory authority

The UK Supervisory Authority for data protection is the Information Commissioner’s Office (ICO). If you believe that ECT is not complying with data protection legislation, we would encourage you to contact us first, but if you are not satisfied with our response, you have the right to report a concern to the ICO. Information is available from their website https://ico.org.uk/

Cookies.

Cookies are small pieces of information that are stored on your device when you access a website. The Website uses cookies to distinguish you from other users. This helps us to provide you with a good experience when you browse the Website and also allows us to improve the Website.

Changes to our privacy policy.

Any changes we may make to our privacy policy in the future will be posted on this page. Please check back to see any updates or changes. If there are significant changes to the types of data processing we carry out, we will attempt to contact affected data subjects about the changes.