This Privacy Notice describes Amethyst’s policies and practices regarding its collection and use of your personal data and sets out your privacy rights.
We recognise that information privacy is an ongoing responsibility and so we will continually update this Privacy Notice to provide an up-to-date overview of what we do with your information.
Controller contact details
Under current Data Protection Legislation (the General Data Protection Regulation 2016/679 (“GDPR”) and the Data Protection Act 2018) the data controller is ‘Amethyst Risk Management’ (Amethyst).
If you have any questions about this Privacy Notice, including any requests to exercise your legal rights (see your legal rights below), please contact us using the details set out below:
- Full name of legal entity: Amethyst Risk Management
- Email address: dpo@amethystrisk.com
- Postal address: Worting House, Church Lane, Basingstoke, Hampshire, RG23 8PX
You have the right to make a complaint at any time to the supervisory authority for data protection issues, the Information Commissioner’s Office of the United Kingdom (https://ico.org.uk/).
We would, however, appreciate the chance to address your concerns before you approach the ICO so please contact us in the first instance.
When does this policy apply?
This Notice covers how we collect and use your personal information. For example:
- When you visit or use our website, or social media channels
- When you use our services
- When you provide to us your goods or services
- When you contact us
- When you interact with us as a customer, client, supplier or other person with a business relationship with us.
Third-party links
The Websites may include links to third-party websites and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.
The data we collect about you
“Personal Data” means any information relating to an identified or identifiable natural person: an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural or social identity.
It does not include data where the identity has been removed.
We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together as follows:
| Categories of data | Examples of types of data |
|---|---|
| Identity Data | Name, surname, title, |
| Contact Data | Address, email, phone number |
| Technical Data | Internet Protocol (IP) address, login data, browser types and versions, time zone setting and location |
| Profile Data | Details of purchases made, queries, comments, or complaints made |
| Recruitment Data | CV, queries, comments or job applications |
| Usage Data | Information about how you use our services and website |
| Marketing and Communications Data | Preferences in receiving marketing materials and your communication preferences |
Unless we obtain your informed consent or it is otherwise required by law or in connection with a contract we have with you, we do not collect any Special Categories of Personal Data.
Information we collect automatically
When you visit or use our website or interact with us through our digital channels, in addition to the information you provide to us directly, we may collect information sent to us by your computer, mobile phone or other access device.
For example, we may collect:
| Data category | Data example |
|---|---|
| Device information | IP address, operating system version |
| Log information | Time and duration of your use of our digital channel |
| Other information about your use of our digital channels | Length of visit, number of page views |
How do we use your information?
We may use your data for different legitimate reasons and business purposes. We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.
Below you will find an overview of the purposes for which we may process your data:
| Purposes | Examples |
|---|---|
| Management of relationship | Customer feedback, ongoing requirements |
| Improvement of website, services, marketing and relationships | Improve our service and keep website updated and relevant to needs of customers |
| Recruitment | Reviewing applications, CVs, interviews and offers of employment. |
| Security and protection of our interests/assets | Deploying and maintaining technical and organisational security measures, conducting internal audits and investigations |
| Compliance with legal obligations | Disclosing data to government organisations or supervisory authorities as applicable, such as tax and national insurance deductions, record-keeping and reporting obligations, and other requests from government or other public authorities, responding to legal process, pursuing legal rights and remedies, and managing any internal complaints or claims |
| Defence of legal claims | Establishment, exercise or defence of legal claims to which we are or may be subject |
On what legal basis do we use your information?
To be able to process your data, we may rely on different legal bases, including:
- Your consent (only when legally required or permitted). If we rely on your consent as a legal basis for processing your data, you may withdraw your consent at any time
- The necessity to establish a contractual relationship with you and to perform our obligations under a contract
- The necessity for us to comply with legal obligations and to establish, exercise, or defend ourselves from legal claims
- The necessity to pursue our legitimate interests, including:
- To administer and generally conduct business within the Company
- To prevent or investigate suspected or actual violations of law, breaches of a business customer contract, or non-compliance Auriga policies.
- The necessity to respond to your requests
- The necessity to protect the vital interests of any person
- Any other legal basis permitted by law.
When do we share your information?
We do not share any of your data except in the cases described here.
If it is necessary for the fulfilment of the purposes described in this Policy, we may disclose your data to the following entities:
- Business Partners where doing so is necessary for the performance of our contractual relationship with you
- Service providers who provide Amethyst with IT and system administration services
- Professional advisers including lawyers, bankers, auditors and insurers
- HM Revenue & Customs (United Kingdom), regulators and other authorities
- Any third parties to whom we may choose to sell, transfer or merge parts of the Amethyst business or assets.
We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law.
We do not allow our third-party service providers to use your Personal Data for their own purposes, and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Do we transfer your data abroad?
All the personal data we process is processed by our staff in the UK. However, for the purposes of IT hosting and maintenance, your information may be situated outside of the European Economic Area (EEA).
Whenever we transfer Personal Data out of the EEA, we adhere to the protections for international transfers approved by the European Commission.
Please contact us if you want further information on the specific transfer mechanism.
How do we protect your information?
To protect your information, we will take appropriate measures that are consistent with applicable data protection and data security laws and regulations, including requiring our service providers to use appropriate measures to protect the confidentiality and security of your data.
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need-to-know.
They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator if we are required to do so.
How long do we keep your information?
We will only retain your Personal Data for as long as is reasonably necessary to fulfil the purposes for which it has been collected (for details on these purposes, see above section “How do we use your data?”), including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.
Please keep in mind that in certain cases a longer retention period may be required or permitted by law. The criteria used to determine our retention periods include:
- The amount, nature and sensitivity of the Personal Data
- The potential risk of harm from unauthorised use or disclosure of your Personal Data
- The purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, accounting and other requirements
- How long your Personal Data is needed to provide you with our services or to operate our business
What are your responsibilities?
We would like to remind you that it is your responsibility to ensure, to the best of your knowledge, that the data you provide to us is accurate, complete and up to date. If the personal information which we hold about you needs to be corrected or updated, please let us know.
If you share other people’s information with us, it is your responsibility to collect such data in compliance with data protection and privacy legislation. For instance, you should inform such other people, whose data you provide to us, about the content of this Notice and obtain their consent.
What are your rights?
Under the Data Protection Act 1998, and the GDPR from 25th May 2018, you have rights as an individual which you can exercise in relation to the information we hold about you. A good explanation of them is available on the website of the Information Commissioner’s Office.
If you wish to exercise any of your legal rights, please contact us using the contact details set out in this Privacy Notice.
You have a right to:
- Request access to your Personal Data
- Request correction of the Personal Data we hold about you
- Request erasure of your Personal Data, or for Amethyst to cease processing it (subject to certain exceptions)
- Request restriction of your Personal Data
- Request the transfer of your Personal Data to you or a third party
- Withdraw consent at any time where we are relying on consent to process your Personal Data
- Request that Amethyst stop using your Personal Data for direct marketing purposes.
For all of the above, please email dpo@amethystrisk.com.
How do we use cookies?
We do not use cookies or for any purpose.
Our Details
If you have any questions about this privacy policy or our treatment of your personal data, please write to us by email to dpo@amethystrisk.com or by post to Amethyst Risk Management, Worting House, Church Lane, Basingstoke, Hampshire, RG23 8PX.
This privacy notice was last updated on 1st August 2024.
