1. Who we are

2. Personal data we collect and where it comes from

We do not knowingly collect special category data (such as health information) or criminal offence data. Please do not send it to us.

3. How we use your data, and our legal basis

We must have a lawful basis to use your personal data. The table below sets out why we use it and which basis we rely on.

Where we rely on legitimate interests, we balance them against your rights and freedoms. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time.

4. Marketing

We would like to keep you informed about Comtec products, CPD opportunities and news. We will contact you for marketing purposes:

• by email or SMS where you have consented, or where you are an existing customer or have enquired about a similar product or service and have not opted out; and
• by post or telephone where permitted by law. We do not make unsolicited marketing calls to numbers registered with the Telephone Preference Service (TPS) or Corporate TPS.

Every marketing email includes an unsubscribe link. You can also opt out at any time by emailing privacy@comtecgrp.com or ticking the relevant box on our forms. We will keep a record of your request so we do not contact you again.
We do not sell your data, and we will not pass it to third parties for their own marketing without your consent.

5. Who we share your data with

We only share personal data where we need to, and we require anyone who handles it on our behalf to protect it. Recipients include:

• Group companies: members of our group, meaning our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the Companies Act 2006.
• Service providers (processors) acting on our instructions, such as [website hosting and maintenance, CRM system, email marketing platform, analytics provider, IT support, payment provider, couriers and logistics partners].
• Professional advisers, such as lawyers, accountants, auditors and insurers.
• Authorities and other parties where we are legally required to disclose data, or need to do so to enforce our terms, protect our rights, property or safety, or those of our customers or others. This includes exchanging information with other organisations for fraud prevention and credit risk reduction.
• Buyers and sellers of a business: if we sell, buy or merge any business or assets, or if Comtec or substantially all its assets are acquired by a third party, personal data we hold may be disclosed to or transferred to the other party, who may use it as set out in this policy.

6. International transfers

Some of our suppliers, or members of our group, are located outside the United Kingdom, or may access data from outside the UK. When we transfer personal data out of the UK, we make sure it is protected by an appropriate safeguard, such as:

• transferring to a country covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US recipients);
• using the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• another safeguard permitted by data protection law.

You can ask us for more information about the safeguards we use by contacting privacy@comtecgrp.com.

7. How long we keep your data

8. How we protect your data

No transmission over the internet can be guaranteed to be completely secure. Please take care when sending us information, and do not include sensitive details in general enquiry forms or emails. If you have a password for our site, you are responsible for keeping it confidential.

If a personal data breach occurs that is likely to result in a risk to you, we will notify the Information Commissioner’s Office within 72 hours where required, and we will tell you directly where the breach is likely to result in a high risk to your rights and freedoms.

9. Your rights

To exercise any of these rights, email hello@comtecgrp.com or write to us at the address in section 1. We will reply within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if so. We may need to ask for proof of identity to make sure we only release data to the right person. We will not charge a fee unless a request is clearly unfounded or excessive.