Onecom Technology Group Privacy Notice

1Introduction

1. 1.1
   Our Privacy Notice explains how Onecom uses your personal data, what we do to ensure the safety and security of it, and who we share it with. It also informs you of your rights and how the law protects you. This Notice applies where Onecom decides how and why your personal data is used, including when you use our websites, the OneCloud portal and the OneCloud app. Where we process personal data on behalf of a business customer to provide our services to that customer, the customer is responsible for telling you how your personal data is used.

2In short

1. 2.1
   Here are the things we think you'd really want to know about how we manage your personal data.

   1. 2.1.1
      Your personal information is, where appropriate, shared within the Onecom Group.
   2. 2.1.2
      We do use a number of third parties to process your personal information on our behalf and some of them are based outside of the UK and European Economic Area.
   3. 2.1.3
      You have a number of rights over your personal information. How you can exercise these rights is set out in this notice.
   4. 2.1.4
      We do send direct marketing, if we're allowed to. If you want us to stop, please contact us using the contact form or use the opt-out link in the email.

3Who we are

1. 3.1
   When we use the expressions "Onecom", "we", "us" and "our" we are referring to the companies that make up the Onecom Technology Group. This includes: Onecom Limited, Onecom Partners Limited, Onecom Technology (India) Private Limited, Onecom Technology Group Limited, Solo Bidco Limited, Solo Topco Limited, Gradwell Communications Limited, and Matrix Business IT Limited.
2. 3.2
   For more information about Onecom: https://www.onecom.co.uk/about.

4Your rights

1. 4.1
   You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you.
2. 4.2
   These include:

   1. 4.2.1
      The right to access a copy of the personal information we hold about you.
   2. 4.2.2
      The right to correction of inaccurate personal information we hold about you.
   3. 4.2.3
      The right to restrict our use of your personal information.
   4. 4.2.4
      The right to be forgotten.
   5. 4.2.5
      The right of data portability.
   6. 4.2.6
      The right to object to our use of your personal information.
3. 4.3
   If you are seeking to exercise any of these rights, please contact us using the contact form.

5How the law protects you

1. 5.1
   Data protection law states that we are allowed to use personal data only if we have a proper reason to do so. The law says we must have one or more of the following reasons:

   1. 5.1.1
      To fulfil a contract we have with you.
   2. 5.1.2
      You have given us your consent.
   3. 5.1.3
      We have a legitimate interest and it is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights.
   4. 5.1.4
      Where we have a legal obligation to do so.
   5. 5.1.5
      When it is necessary to protect your or some else's life, this is called Vital Interest.

6Types of personal data we collect

1. 6.1
   Contact Data includes billing address, delivery address, email address and telephone numbers.
2. 6.2
   Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
3. 6.3
   Technical Data includes internet protocol (IP) addresses.
4. 6.4
   Usage Data includes information about how you interact with and use our website, the OneCloud app, products and services.
5. 6.5
   Marketing, Market Research and Communications Data includes your preferences in receiving marketing from us.

7Where we collect personal data from

1. 7.1
   We may collect personal data about you from these sources:

   1. 7.1.1
      Personal data you give us directly.
   2. 7.1.2
      When you use our websites, the OneCloud app or interact with us through social media.
   3. 7.1.3
      Credit reference agencies.
   4. 7.1.4
      Reputable data suppliers.
   5. 7.1.5
      Personal data from companies/businesses which have been acquired by Onecom.
   6. 7.1.6
      From publicly available sources such as information held in Companies House, and information about you that is openly available on the internet.

8How we use your data

1. 8.1
   To provide our products and services.
2. 8.2
   For safety and security.
3. 8.3
   Analytics and profiling.
4. 8.4
   Marketing and advertising.

9Who and why we may share your personal data

1. 9.1
   If we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority.
2. 9.2
   Companies within the Onecom Group so that we can provide you with a high-quality service.
3. 9.3
   Our service providers so that they can help us provide the products and services you require from us, or we think you might be interested in. These third parties include:

   1. 9.3.1
      Advertising companies, who help us place adverts online and on other media.
   2. 9.3.2
      Social media providers, such as Facebook, Instagram and Twitter.
   3. 9.3.3
      Market research partners, who help us analyse customer behaviour.
   4. 9.3.4
      Companies that deploy our email campaigns because they need to know your email address to carry out these services.
   5. 9.3.5
      Credit reference agencies.
   6. 9.3.6
      Third party vendors who help us manage and maintain our IT infrastructure.
   7. 9.3.7
      Security and fraud prevention companies to ensure the safety and security of our customers, colleagues and business.
   8. 9.3.8
      Companies that enable us to collect your reviews and comments, both online and offline.
   9. 9.3.9
      Professional advisors including lawyers, bankers, accountants, auditors, and insurers who provide consultancy, banking, legal, and accounting services.
   10. 9.3.10
       Providers of app store, notification, security and app performance services, such as Apple and Google, when you use the OneCloud app.

10International transfers of personal information

1. 10.1
   From time to time, we transfer your personal information to Onecom Group companies, suppliers or service providers based outside of the UK and EEA for the purposes described in this privacy policy. When we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law, including the use of model contracts in a form approved by regulators.

11Keeping you informed about our products and services

1. 11.1
   We would like to tell you about our products and services that we think you might be interested in. We will only ever do this with your consent or where there is a legitimate interest.
2. 11.2
   We won't send you marketing messages, if you tell us not to, but if you receive a service from us, we will still need to send you occasional service-related messages and may still send surveys (you can always opt out of these via the survey email itself).
3. 11.3
   Please note that it can take a little while for all marketing to stop once you either withdraw your consent or tell us you'd like to opt out of marketing.
4. 11.4
   You may opt out of these calls or emails at any time, either verbally whilst on the phone or by using the contact form.

12Automated decision making and AI

1. 12.1
   We sometimes use automated decision-making. For instance, we use automated decision-making for credit assessments when you apply for a contract with us. The outcome can determine your eligibility for a contract or the payment terms we can offer you. You have the right to request human intervention or contest a decision by contacting us via the 'Your rights' section above.
2. 12.2
   We use AI within some of our internal operational processes. Where we do so, your personal data may be processed by AI tools as part of those operations. We assess the use of AI involving personal data to ensure that your rights are protected and that we comply with ICO guidance and applicable data protection law.

13How long we hold your personal data for

1. 13.1
   We will only keep your personal data for as long as necessary for our business or legal requirements. To determine the appropriate retention period, we always consider the amount and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure and the applicable legal and/or regulatory requirements.
2. 13.2
   We also have processes in place to securely dispose of personal data we no longer require.

14Security

1. 14.1
   We take protecting your personal information seriously and are continuously developing our security systems and processes. Some of the controls we have in place are:

   1. 14.1.1
      We use technology controls for our information systems, such as firewalls, user verification, strong data encryption and multiple verification access protocols.
   2. 14.1.2
      Systems are proactively monitored through a "detect and respond" information security function.
   3. 14.1.3
      We utilise industry "good practice" standards to support the maintenance of a robust information security management system.
   4. 14.1.4
      We enforce a "need to know" policy, for access to any data or systems.

15If things go wrong and you wish to make a complaint

1. 15.1
   You have the right to make a complaint at any time to the Information Commissioner's Office (www.ico.org.uk), the UK regulator for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact our Data Protection Officer in the first instance using the below details.

16Cookies

1. 16.1
   Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them, please see our Cookies Policy.

17Important Contact Details