Privacy statement

This privacy statement sets out how Fraser Murray (“we”, “us” or “our”) uses and protects any information that you give us when you use this website or are in contact with us (whether by email, telephone, via the forms on our website, through any social media platforms or other applications we use or even face to face).

We are committed to ensuring that your privacy is protected. We therefore conduct our business in compliance with applicable laws on data privacy protection and data security. This privacy statement tells you what to expect when we collect and process your personal information. Where you provide us with personal information then you can be assured that it will only be used in accordance with this privacy statement.

The data controller who is responsible for how we handle your personal information is Fraser Murray of 67 Hillfoot Drive, Bearsden G61 3QG. Any queries you have in relation to the same should be directed to hello@frasermurray.scot

What we collect

We may collect the following information:

name and job title
contact information including email address and phone number
demographic information such as postcode, preferences and interests
other information relevant to customer surveys and/or offers
transaction details about services you specifically request from us
financial details in relation to any services you request from us
details of visits to our website including traffic data, location data, weblogs and other communications data and resources you access or use

Given the nature of the services we provide it is extremely unlikely that we will require to collect any sensitive data about you. Sensitive data is personal information which includes your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic or biometric data, or information concerning your health or mental wellbeing or sexual orientation. Where we do require to process such sensitive data to provide services to you we will notify you in advance and will request your express consent in writing to process such sensitive data.

If you do not wish us to collect any of the personal information stated above, you should discuss this with us. We can explain the reasons for collection and discuss the consequences of not providing the information or of providing partial or incomplete information and the effect this may have on our ability to provide our services.

What we do with the information we gather

By law we can only process your information if we can demonstrate the lawful grounds we have for doing so. Currently there are six potential lawful grounds for processing personal information, namely:

we have your consent;
it is necessary for performance of a contract to which you are a party or to take steps at your request prior to entering into such contract;
it is necessary for our compliance with a legal obligation;
it is in the public interest;
it is necessary to protect your vital interests; or
that it is in our legitimate interest to do so but only where that interest does not override your interests or your fundamental rights and freedom.

If none of these grounds apply or ceases to apply we must cease processing your personal information immediately. Generally, we will rely on consent, contract, legal obligation or legitimate interest for processing.

We therefore use your personal information in the following ways:

Registering you as a client, maintaining our relationship with you and processing and delivering services to you including recording payments. This will be done based on either contract or legal obligation
Administration of our website and business (including webhosting and support) and making suggestions that may be of interest to you such as available upgrades and enhanced or additional related services or products and advising you on service/security or technical issues that may affect you. As doing so is required to run our business, ensure security and performance of your website, its admin and support and to develop our services this will be done based on legitimate interest
Ensuring that content from our website is relevant to you and is presented in the most effective manner for you including seeking your views on our products and services and as doing so is required include to review the services we supply to you and to inform our overall marketing strategy this will be done on the basis of legitimate interest

We will only retain your personal information for as long as is necessary in line with the purposes for which it was originally requested or collected or where we are required to do so for some legal or reporting purpose.

In working out how long we retain personal data we look the type of personal data involved, the purpose of processing, how sensitive or confidential the data is and at legal and commercial considerations including any legal obligations we have. By way of example by law we are required to keep accounting records for six years after end of the year in which the last transaction occurred. This means that we will be required to keep some basic client details for that purpose even although our relationship with you may be at an end. However, it should be noted that the requirement is basic client details and therefore it is not legitimate to also keep information such as your preferences for that period of time.

If you have any questions relating to either retention periods or more require more detail on the purposes of processing or the specific reason or legal grounds, we are relying on for that processing then please contact us for additional information.

Sharing Your Information

We will not sell the personal information that we collect from you and will only use it for the purposes set out in this privacy statement. We may share your personal information with the following parties:

Service providers who provide us with cloud hosting solutions and IT and administration services such as our webhosting company, our CRM database provider and social media and marketing services provider and any third party outsourced services providers;
HMRC and other regulatory authorities who require reporting of our activities by law;
Professional advisers such as our lawyers, accountants, bankers and insurers; and
Third parties to whom we sell, transfer or merge our business or any part of it;

All third parties with whom we share your data are required to protect your personal data, treat it confidentially and to process it in accordance with the law. Where we use third parties we will take all reasonable steps to ensure that they are GDPR compliant and in particular that:

they have adequate technical and other measures in place to ensure the security of your personal information;
they only use it for specified purposes;
any employees or contractors who have access to the information are adequately trained and deal with it on a need to know basis only; and
they act only in accordance with our instructions.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure or loss of or damage to your personal information, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect from you. These include robust procedures for dealing with breaches including incident reporting and notifying the Information Commissioner, and where appropriate you, of any breaches, the consequences of the same and the remedial action taken.

Where possible the information you provide us with will be held within the European Economic Area (“EEA”) or within the UK.

Overseas Transfers

Countries outside of the EEA do not always have similar levels of protection for personal data as those inside the EEA. The law provides that transfers of personal data outside of the EEA is only permitted where that country has adequate safeguards in place for the protection of personal data. Some types of processing may use cloud solutions which can mean information may sometimes be held on servers which are located outside of the EEA or may use processors who are based overseas.

Where we use cloud-based services or third-party providers of such services and in either or both circumstances the data is processed outside of the EEA that will be regarded as an overseas transfer. Before instigating an overseas transfer, we will ensure that the recipient country and/or processor has security standards at least equivalent to our own and in particular one of the following permitted safeguards applies:

The country in question is deemed to have adequate safeguards in place as determined by the European Commission; or
There is a contract or code of conduct in place which has been approved by the European Commission which gives your personal information the same protection it would have had if it was retained within the EEA; or
If the overseas transfer is to the United States, then the transferee is a signatory to the EU-US privacy Shield as all Privacy Shield signatories are obliged to give your personal information the same degree of protection it would have had if it was retained within the EEA.

If none of these safeguards exist, then we may seek your explicit consent for an overseas transfer. In line with your rights as an individual you are free to withdraw this consent at any time.

How we use cookies

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Controlling your personal information

You have rights as an individual which you can exercise in relation to the information we hold about you. These rights are:

the right to restrict processing of your personal data;
the right to rectification or correction of your personal data;
the right to object to processing of your personal data;
the right of erasure of personal data (also referred to the right to be forgotten);
the right not to be subject to a decision based solely on automated processing or profiling;
the right to transfer your personal data (also referred to as the right of portability)
the right to withdraw your consent to processing your personal data; and
the right of access to your personal data.

Additional information about these rights can be found on the Information Commissioner’s website at www.ico.org.uk/for-organisation/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

If you have provided consent and we are relying on that as the legal ground of processing your personal information and wish to exercise your right to withdraw that consent you can do so at any time by contacting us at hello@frasermurray.scot

You may request details of personal information which we hold about you. Any request requires to be in writing and is not subject to any charges or fees. If we do hold any personal information about you, we will:

give you a description of it;
tell you why we are holding it;
tell you who it has or will be disclosed to;
the source of the information (if not you);
where possible, the period for which it will be stored; and
let you have a copy of the information in an intelligible form

We will respond to a subject access request within 30 days. On occasion we may need additional information from you to determine your identity or help us find the information more quickly. Where the information you have requested is complex we may take longer than this but shall keep you advised as to progress should this be the case.

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect.

Marketing Information

We may provide you with information on services and products that we may provide. This is regarded as marketing activity. We will only market to you where you have:

specifically requested marketing information from us; or
previously acquired similar services/goods from us; or
consented by way of ticking a box or opting in to receiving marketing from us.

If you have opted out of marketing, we will not send you any future marketing without your consent.

Each time we market to you we will always give you the right to opt out of any future marketing but would point out that you have the right at any time to ask us not to market to you at any time by emailing us at hello@frasermurray.scot rather than waiting on a specific opt out.

Complaints

We would prefer to resolve any issues or concerns you may have direct with you. If you feel you are unable to resolve matters by contacting us direct or are you are unhappy or dissatisfied with how we collect or process your personal information you have the right to complain about it to the Information Commissioner who is the statutory body which overseas data protection law. They can be contacted through www.ico.org.uk/concerns.

We may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes. This policy is effective from May 2018.