This Site is owned by Shearwater Group (SWG). SWG is a member of the Alternative Investment Market, registered at 22 Great James Street, London, WC1N 3ES and with Company Number 05059457.
SWG is committed to safeguarding the privacy of personal and sensitive personal data and is bound to comply with the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018, along with similar and applicable laws in other countries around the world. This Privacy Notice forms part of SWG’s obligation to be open and fair with all individuals whose personal and sensitive personal data we process while visiting this Site and to provide details around how it processes such personal data and what it does with it.
What personal data do we process?
How do we collect your data?
We only collect data directly from you when you provide us with information by filling in forms on our Website.
Who do we share your data with?
We only disclose your personal data in the ways set out in this Privacy Notice or subject to any agreements in place between us.
The following circumstances may apply:
Across the SWG lines of business, as part of a need to know or as part of improving our existing solutions and services or as part of providing new solutions and services. These lines of business consist of the following legal entities, all registered at 22 Great James Street, London, England, WC1N 3ES
- Xcina limited, company number 10835789
- Xcina Consulting limited, company number 1085775
- Shearwater Shared Services limited, company number 11331923
- Geolang limited, company number 05719222
- SecurEnvoy limited, company number 04866711
- Brookcourt Solutions limited, company number 05356175
- Pentest limited, company number 11925182
To third parties who process personal data on our behalf, such as systems providers.
We do not sell, rent or trade any of your personal data.
In certain circumstances we may also disclose your personal information to third parties:
- In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets
- If we are, or substantially all of our assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
- If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our Terms or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of SWG, our lines of business, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
How do we protect your data?
Where SWG acts as the controller of personal data, it will ensure that necessary and adequate safeguards are in place to prevent unauthorised access, loss, misuse or alteration of your personal data.
We store all personal information on secure servers with relevant access and firewall controls. We also carry out regular security testing to ensure that your personal data is protected.
Any personal data sent to us, either in writing or email, may be insecure in transit and we cannot guarantee its delivery.
International data transfers
We share your personal data within the SWG group of companies.
The data that we collect from you will be transferred to, and stored at, a destination inside the United Kingdom (UK). It will not be processed by staff operating outside the UK.
Your legal rights
Unless subject to an exemption under the data protection laws, you have the following rights with respect to your personal data:
- The right to request a copy of the personal data which we hold about you;
- The right to request that we correct any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary to retain such data;
- The right to withdraw your consent to the processing at any time, where consent was the lawful basis for processing your data;
- The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), where applicable (i.e. where our processing is based on consent or is necessary for the performance of our contract with you or where we process your data by automated means);
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to our processing of personal data, where applicable i.e. where processing is based on our legitimate interests (or in performance of a task in the public interest/exercise of official authority); direct marketing or processing for the purposes of scientific/historical research and statistics).
If you wish to exercise any of the rights set out above, please contact us as described below (section 13).
No fee required – with some exceptions.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable admin fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you:
- We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
- We may also contact you to ask you for further information in relation to your request to speed up our response
Time limit to respond:
- We try to respond to all legitimate requests within one month.
- Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Updates to this policy
In order to remain compliant with any legal and regulatory obligations, or as part of our evolving business practices, we may update this Privacy Notice from time to time by publishing a new version. In certain instances, we may notify you.
Third party websites
We are not responsible for the practices employed by Third Party Websites linked to or from our Website nor the information or content contained therein. Often links to other websites are provided solely as reference points to information on topics that may be useful to the users of our Website. Please remember that when you use a link to go from our Website to a Third-Party Website, our Privacy Notice will no longer apply. Your browsing and interaction on any other Website, including Third Party Websites, which have a link on our Website, are subject to that Website’s own Privacy Notice.
How to get in touch
To exercise all relevant rights, queries or complaints in relation to this policy or any other data protection matter between you and us, please in the first instance contact us via:
- Email: firstname.lastname@example.org
- Telephone: +44 (0)20 3985 8467
- In Writing: Data Protection Officer, Xcina Consulting, 1 King William Street, London EC4N 7AR, UK
If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the data protection regulator; the Information Commissions Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England, UK.
Details of how cookies are used on the Shearwater Group’s website can be found here.