Privacy Policy

Privacy Policy

Data Collection
All the information that we hold about you is provided to us by yourself or the commissioning body
when you seek to use our services. We will tell you why we need the information and how we will use
it.

Our Lawful Basis for processing your information.
The General Data Protection Regulation (GDPR) requires all organisations that process personal data
to have a Lawful Basis for doing so. The Lawful Bases identified in the GDPR are:
● Consent of the data subject
● Performance of a contract with the data subject or to take steps to enter a contract.
● Compliance with a legal obligation
● To protect the vital interests of a data subject or another person
● Performance of a task carried out in the public interest or in the exercise of official authority
vested in the controller.
● The legitimate interests of us, or a third party, except where such interests are overridden by
the interests, rights or freedoms of the data subject.

Examples of legitimate interests include:
● Where the data subject is a client or in the service of the controller.
● Transmission within a group of undertakings for internal administrative purposes.
● Processing necessary to ensure network and information security, including preventing
unauthorised access.
● Processing for direct marketing purposes, or to prevent fraud; and
● Reporting possible criminal acts or threats to public security.
Our Lawful Basis are legitimate interests, performance of a contract, consent, legal obligation and
public interest.

We use your information to:
▪ Provide Services
▪ Process or support payments for services:
▪ Maintain the safety, security and integrity of our services.
▪ Direct your enquiries to the appropriate customer support staff.
▪ Investigate and address your concerns.
▪ Communicate with you about products, services, promotions, studies, surveys, news, updates
and events.
▪ Investigate or address legal proceedings relating to your use of our services, or as otherwise
allowed by applicable law.
▪ Make statutory returns as required by commissioning or regulatory bodies.

Personal data we process.
We collect and process both personal data and special categories of personal data as defined in the
GDPR. This includes:
Service User / Tenant data
▪ Name.
▪ Email.
▪ Phone number.
▪ Address.
▪ Date of birth.
▪ Location details.
▪ Device IP address.
▪ Other relevant data as required to provide our services. Next of kin details

Employee Data
▪ Name.
▪ Email.
▪ Phone number.
▪ Address.
▪ Payment or bank details.
▪ Date of birth.
▪ Family & next-of-kin detail
▪ Location data

Sensitive and special data including:

• Information about physical and mental health
• Racial or ethnic origin
• Political opinions
• Religious, philosophical or other beliefs
• Trade union membership
• Sex life or sexual orientation
• Genetic and biometric information of natural persons.

We may share your personal data with:
▪ Our business partners.
▪ Our subsidiaries.
▪ Our legal advisors in the event of a dispute or other legal matter.
▪ Law enforcement officials, government authorities, or other third parties to meet our legal
obligations;]
▪ In connection with, or during negotiations of, any merger, sale of company [assets,
consolidation or restructuring, financing, refinancing, or acquisition of some or all our business
by another company.
▪ Any other party where we ask you and you consent to the sharing.

Transfers to third countries and international organisations
We do not transfer any personal data to third countries or international organisations outside of the
UK.
In addition, we may we process personal data pertaining to EEA citizens. We are satisfied that such
transferred data is fully protected and safeguarded as required by the UK GDPR and the EU-General
Data Protection Regulation

We retain your personal data while you remain a service user/tenant or employee, unless you ask us
to delete it. Our Retention and Disposal Policy (copy available on request) details how long we hold
data for and how we dispose of it when it no longer needs to be held. We will delete or anonymise
your information at your request unless:
● There is an unresolved issue, such as claim or dispute.
● We are legally required to; or
● There are overriding legitimate business interests, including but not limited to fraud
prevention and protecting customers’ safety and security.

Your Rights
The GDPR gives you specific rights around your personal data. For example, you have to be informed
about the information we hold and what we use it for, you can ask for a copy of the personal
information we hold about you, you can ask us to correct any inaccuracies with the personal data we
hold, you can ask us to stop sending you direct mail, or emails, or in some circumstances ask us to
stop processing your details. Finally, if we do something irregular or improper with your personal
data you can seek compensation for any distress you are caused or loss you have incurred. You can
find out more information from the ICO’s website https://ico.org.uk/your-data-matters/ and this is
the organisation that you can complain to if you are unhappy with how we deal with you.

Accessing and Correcting Your Information
You may request access to, correction of, or a copy of your information by contacting us at
dpo@tarasis.com

Marketing Opt-Outs
You may opt out of receiving emails and other messages from our organisation by following the
instructions in those messages.

Cookies
Cookies are small text files that are stored on your browser or device by websites, apps, online media,
and advertisements. We use cookies to:
▪ Validate users.
▪ Remember user preferences and settings.
▪ Determine frequency of accessing our content.
▪ Measure the effectiveness of advertising campaigns; and
▪ Analyse site visits and trends.

We will occasionally update our Privacy Notice. We will also publish the updated Notice on our
website.