Privacy Notice

The purpose of this privacy notice is to explain how Capacitas Limited (“Capacitas”) processes your personal data to fulfil our data protection responsibilities, when you interact with our website. Please note that separate notices are made available for our employees, job candidates and specific groups of people, when required.

The role of Capacitas, in data protection terms, is that of a data controller where we determine the purpose and use of the personal data being processed. It is the responsibility of our Privacy Manager (PM) to ensure the processing of your personal data is done in accordance with UK data protection legislation. The PM is contactable by email using contact@capacitas.co.uk.

The sort of personal data collected by Capacitas will be your basic contact details sufficient to be able to respond to your general enquiries, possibly for sales purposes and to set up any contractual arrangements with our current and prospective clients.

Capacitas’s duty of confidentiality means that our staff will treat your personal data with due respect and in confidence. It is only disclosed to others when absolutely required. We use appropriate organisational and technical measures to ensure your personal data is kept secure. We also expect the same duty of confidentiality of all third parties with whom we share your personal data.

In general, the processing of personal data takes place on-site and/or agreed off-site locations within the UK for which the associated servers are located in UK, the EU and the US for HubSpot.

For those occasions where personal data is subject to international transfer to those countries not in the European Economic Area (EEA) or to those territories that do not have ‘adequacy’ status, as determined by the UK Government, or those companies not registered with the US Data Privacy Framework, it will be treated as a restricted transfer. In such an event, the appropriate measures will be taken to ensure the lawful transfer of personal data.

The processing of personal data is done in accordance with the principles of data protection and always against a legal reason (lawful basis) such as those below:

• To comply with our legal obligations
• We will pursue our legitimate interests to respond to your general enquiries and stay in touch with you for marketing purposes if we are permitted to do so
• To administer any contractual obligations (and the preparations of those contracts) we may develop with you
• When processing for a pre-defined purpose for which your consent will be sought prior to the processing commencing – please note that consent can be withdrawn at any time by contacting the PM

Capacitas will share your personal data but only when necessary, with some or all of the following:

• Administrative support where personnel/ organisations are bound by a data processing agreement and/or contractual arrangements
• Appointed contractors for specific outsourced services who are subject to a data processing agreement or equivalent as bound by their contracts

These organisations are reviewed regularly, and the number is kept to a minimum.

The key periods are as follows:

• Routine correspondence for casual enquiries in hard copy or in emails will be stored for 7 years after the last interaction with Capacitas
• Formal correspondence that includes your personal data, such as that provided in contracts, will be retained for the duration of the contract plus another 7 years
• Contact data is stored indefinitely unless a valid request to erasure is received from the interested data subject

At the end of the retention period, Capacitas will destroy or delete your personal data and any associated correspondence/ documentation for which Capacitas has no lawful basis to justify its retention. If it is technically impractical to delete electronic copies of your personal data, it will be put beyond operational use. It should be noted that Capacitas allows up to 3 months after the retention period has ended to complete this action. Our retention period has no impact on your rights (see below).

The UK General Data Protection Regulation defines the rights that you have (although these do not apply in all situations) and these are summarised as follows:

• Right to be informed as to how your personal data are being processed – this is done through this notice
• Right to access your personal data held by us and this is done by submitting a (Data) ‘Subject Access Request’ to the PM
• Right to rectification of your personal data if we have collected it incorrectly or it needs to be updated
• Right to erasure of your personal data for which we no longer have a legitimate purpose to process
• Right to restrict processing under certain circumstances, during which your personal data will be taken out of operational use until the matter is resolved
• Right to data portability of your personal data in a machine-readable version, but this only applies to data provided with your consent or under contract
• Right to object to processing your personal data for which we do not have a legal or contractual obligation
• Rights related to automated decision making and profiling, however, Capacitas does not use these techniques in its decision making

Further details on all of these rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk.

If you wish to exercise your rights, raise a query or make a complaint about our processing of your personal data, please contact the Privacy Manager. Please note that we may need to verify your identity before responding fully. If that is the case, we will ask you to provide proof of identification that will enable us to confirm your identity.