1. How we use your information
This privacy notice tells you what to expect when t-three Consulting Ltd (t-three) collects personal information. t-three is made up of different legal entities. This privacy notice is issued on behalf of the t-three Consulting so when we mention "we", "us" or "our" in this privacy notice, we are referring to the relevant company in the t-three Group responsible for processing your data. We will let you know which entity will be the controller for your data when you purchase a product or service with us. t-three Consulting Limited is the controller and responsible for our website. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. Client personal data will be held for as long as the individual or their employer is in receipt of services from t-three, plus up to a maximum of 3 years. (If a client makes a specific request for their data to be deleted sooner and it does not conflict with any legal or compliance requirement to hold data for longer, we will honour the request).
2. Use of Data Processors
Data processors are third parties who provide online platforms for us to use to support our Client’s projects as well as our internal recruitment. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. The Data Processors that we currently have a relationship with are:
t-three use of Hubspot
T-Three uses the HubSpot platform to underpin some of our inbound marketing and sales activity. HubSpot’s marketing automation platform allow us to build and manage our webpages effectively as an inbound marketing hub where visitors can learn more about our company and our services, download content, engage in a live chat with the sales team and provide their contact information and other demographic information, as and where appropriate. This information, which is stored and managed on the HubSpot service providers' servers (learn more about HubSpot data protection and security here), is then used by T-Three so that the visitors can be contacted about their interest in our services and can interact with us as they choose.
4. Information We Collect
When you visit our website
You are free to explore the T-Three website without providing any Personal Information about yourself. When you visit the website to download our content, subscribe to our blog or we request that you provide Personal Information about yourself, and we collect Navigational Information.
This refers to any information that you voluntarily submit to us and that identifies you personally, including contact information, such as your name, e-mail address, company name, address, phone number, and other information about yourself or your business. Personal Information can also include information about any transactions, both free and paid, that you enter into on our website, and information about you that is available on the Internet, such as from Facebook, LinkedIn, Twitter and Google, or publicly available information that we acquire from service providers such as MailChimp. We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
This refers to information about your computer and your visits to this website such as your IP address, geographical location, browser type, referral source, length of visit and pages viewed. Please see the "Navigation Information" section below.
Information about children
Our website is not aimed at addressing anyone under the age of 13. As such, we do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from a child under age 13 without verification of parental consent, we take steps to remove that information from our servers.
5. How we use information we collect
We never sell Personal Information
We will never sell your Personal Information to any third party.
Use of Personal Information
t-three will only contact people via a telephone number if we are sure the individual is not listed on the Telephone Preference Service (TPS) and/or Corporate TPS (CPTS). If we were ever to purchase a telephone list we would use a company that is PECR and GDPR compliant, and check the list against the TPS and CPTS.
If t-three were to purchase contact lists, we would only use a reputable business that can confirm their lists are compliant to GDPR and PECR. If we were to purchase a contact list then we would only request certain job roles e.g. HR Directors, working within major cities and in large organisations; contacts would need to be relevant to our business.
Use of Navigational Information
We use Navigational Information to operate and improve your experience of our website. We may also use Navigational Information alone or in combination with Personal Information to provide you with personalised information about T-Three.
Client testimonials and comments
We post client testimonials and comments on our website, which may contain Personal Information. We obtain each client's consent via email prior to posting the client's name and testimonial.
Security of your Personal Information
We use marketing platforms and partner services such as HubSpot and Mailchimp that are scrupulous about the safety of the data we store with them, using a variety of security technologies and procedures to help protect your Personal Information from unauthorised access, use or disclosure. They secure the Personal Information you provide on computer servers in a controlled, secure environment, protected from unauthorised access, use or disclosure. You can contact us at firstname.lastname@example.org to understand more about the security provisions of the platforms we use.
Social Media Platforms
Retention of Personal Information
We retain Personal Information that you provide us as long as we consider it potentially useful in contacting you about our services, or as needed to comply with our legal obligations, resolve disputes and enforce our agreements, and then we securely delete the information. However, we will maintain your personal information longer where required for tax or accounting purposes, to ensure we would be able to defend or raise a claim, or where we have a specific need to retain, though we will generally not keep personal data for longer than seven years following the last date of communication with you.
International transfer of information
Complying with the Law
We reserve the right to use or disclose your Personal Information if required by law or if we reasonably believe that use or disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a law, court order, or legal process.
6. Navigational Information
We use "cookies" to help you personalise and enhance your online experience. A cookie is a text file that is placed on your hard disk by a Web server. Cookies are not used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you and can only be read by a Web server in the domain that issued the cookie to you. One of the primary purposes of cookies is to provide a convenience feature to save you time. The purpose of a cookie is to tell the Web server that you have returned to a specific page. For example, if you personalise pages on our Websites, for instance completing a form, a cookie helps us to recall your specific information on subsequent visits. When you return to the same Website, the information you previously provided can be retrieved, so you can easily use the customised features.
You have the ability to accept or decline cookies. Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of the webpages you visit. We use the platform HubSpot to keep track of the pages you visit, in order to determine what portion of our site is the most popular or most used. This data can be used to deliver customised content and promotions within the T-Three website to visitors whose behaviour indicates that they are interested in a particular subject area.
In addition, when you’re accessing our website, your device may provide us with information about the device you’re using, this could include the type of device or what operating system you’re using. Your device manufacturer or operating system provider will be able to provide you with more details about the information your device makes available to us.
T-Three may gather information about your computer hardware and software that is automatically collected by the HubSpot marketing platform, and also by other website analysis software, such as Hotjar. This information can include: your IP address, browser type, domain names, internet service provider (ISP), the files viewed on our site (e.g., HTML pages, graphics, etc.), access times and referring website addresses. This information is used by T-Three to maintain and improve quality of our website user experience, and for general statistics regarding use of our website.
We sometimes use Google Analytics to help us understand how visitors are using and engaging with our website. This again allows us to make improvements to our web services and your online experience. The Google Analytics tracking tool uses a number of cookies to collect information and report website usage statistics and does so without personally identifying individual visitors to Google or T-Three.
7. Social Media and Marketing
Our legal basis for contacting you is our legitimate interest – to study how customers use our products/services, to develop them, to grow our business and to inform our Marketing strategy. This is in line with Article 6 (1)(f) of the General Data Protection Regulation (GDPR).
We will get your express opt-in consent when you enter your details on www.t-three.com. By doing this, you are agreeing that we can send you emails containing materials that we think will be of interest to you. This includes, but is not limited to, promotional information, event invitations and newsletters. There is an unsubscribe link on all our emails, and you can unsubscribe at any time, should you wish. In order to send this correspondence, the personal details you provide will be stored within MailChimp and Hubspot. Please click the links to view their respective privacy policies. We may also call you to confirm attendance at events you have registered for.
You always have a choice as to whether and how you want to receive communications about our content and services. As inbound marketers, your permission or consent is central to how we engage with you, for example, you will need to specifically opt-in to receive blog notifications from us.
If you ever want to change your contact preferences, or opt out of communications, you can do this at any time by clicking the “update my preferences” or “unsubscribe” link at the bottom of any email from us.
If you choose not to be contacted by us we will never send you marketing communications, but we may keep your details on a ‘suppression list’ to ensure you aren’t contacted.
You may also let us know via our general email email@example.com or at our address: T-Three, 5 Caxton House, Broad Street, Great Cambourne, Cambridge, CB23 6JN
We monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
9. Job applicants, current and former t-three employees
T-Three is the data controller for the information you provide during the process unless otherwise stated. If you have any queries about the process or how we handle your information, please contact us at firstname.lastname@example.org
What will we do with the information you provide to us?
All of the information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.
We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.
What information do we ask for, and why?
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t.
We ask you for your personal details including name and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Our recruitment team will have access to all of this information.
You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including hiring managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.
We might ask you to participate in assessment days; complete tests or occupational personality profile questionnaires; and/or to attend an interview – or a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information is held by T-Three.
If you are unsuccessful following assessment for the position you have applied for, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we would proactively contact you should any further suitable vacancies arise.
If we make a conditional offer of employment we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We are required to confirm the identity of our staff, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability.
You will therefore be required to provide:
If we make a final offer, we will also ask you for the following:
How long is the information retained for?
If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus 6 years following the end of your employment. This includes your criminal records declaration, fitness to work, records of any security checks (if applicable) and references.
If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 6 months from the closure of the campaign.
Information generated throughout the assessment process, for example interview notes, is retained by us for 6 months following the closure of the campaign.
Equal opportunities information is retained for 6 months following the closure of the campaign whether you are successful or not.
How we make decisions about recruitment?
Final recruitment decisions are made by hiring managers and members of our recruitment team. All of the information gathered during the application process is taken into account.
You are able to ask about decisions made about your application by speaking to your contact within our recruitment team or by emailing email@example.com
10. Your Rights
Under the General Data Protection Regulation Act 2018, you have rights as an individual which you can exercise in relation to the information we hold about you. You can read more about these rights here – https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
T-three tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the General Data Protection Regulation Act 2018.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
You have the right to:
Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
To make a request to T-three for any personal information we may hold you need to put the request in writing addressing it to the Office Manager.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
12. Complaints or queries
T-three tries to meet the highest standards when collecting and using personal information. For this reason, we will take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
If we receive a complaint from a person we will follow our ISO27001 process and make up a file containing the details of the complaint. This will contain the identity of the complainant and any other individuals involved in the complaint. We will only use the personal information we collect to process the complaint and to check on the level of service we provide.
We will have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for three years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of T-three’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.
13. Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 24 May 2018.
14. How to contact us
The Office Manager
T-Three Consulting Ltd
5 Caxton House
Cambridge CB23 6JN