Processing Information
Scope and purpose or processing
Personal data is held for the purposes of the provision of IT and telecom services and related products. The personal data held is obtained in support of contractual arrangements and is necessary under the ‘legitimate interests’ pursued by the controller (Cloud Business) as defined in article 6.1 of the GDPR. The facility to opt out of marketing communications remains, but excludes operational or pricing communications.
Nature of processing
Cloud Business does not undertake any automated decision making as defined by article 22 of the GDPR. Data will be processed internally by the marketing department for the purposes of objective and permission-based marketing.
Duration of processing and retention
Cloud Business will maintain personal data for the duration of contracts during the provision of IT and telecommunication services and products. Thereafter, the data will be held for a ‘reasonable’ period, depending on the nature of the relationship with the customer. The data will be deleted when the retention of that data can no longer be justified under the provisions of the Data Protection Act and is not overruled by competing legislation or regulations. The terms against which data are held vary and are dependent on the business cycle, regulations and legislation.
Requests for information
Persons whose data are held by Cloud Business and its associated companies may request their own data. These are called subject access requests. These should be submitted in writing to our postal address or via email to hello@cloudbusiness.com We will need to verify the identity of the requestor and in the unlikely event there is substantial cost to Cloud Business in terms of retrieving the data, we may charge a maximum of £10. The regulations require us to respond within 28 days of the request.
Deletion of information
Persons whose data are held by Cloud Business and its associated companies may request that their data be permanently deleted as stated in Data Protection Regulations and Data Protection Legislation, and such requests will be complied with as soon as practicable where a customer no longer has a relationship with Cloud Business or its associated companies. Where a requestor continues to have a business relationship with Cloud Business or its associated companies, we may need to ensure that the requestor’s details are replaced with those of an alternative contact to enable the continued effective management of our relationship with our customers and partners. Any such requests should be submitted in writing to our postal address or via email to hello@cloudbusiness.com. We will need to verify the identity of the requestor in all circumstances.
Types of Personal Data
The personal data held will include: Name, Position, Telephone Number(s), email address.
No ‘sensitive data’ (as defined by the Data Protection Act) or ‘special categories of personal data’ (as defined by the GDPR) are held against any current, former or prospective (wholesale only) customers.
Categories of Data Subject
The data subjects whose data may be held by Cloud Business is restricted to that of existing, former or prospective customers and associated contacts. These data fall under the category of ‘personal data’ and do not include any ‘sensitive data’ (as defined by the Data Protection Act) or ‘special categories of personal data’ (as defined by the GDPR).
Data sharing
There is no routine data sharing of person identifiable data. Where exceptions exist, these concern the management of systems where providers require sample data for the purposes of de-bugging systems or processes. In these circumstances we would implement a formal data sharing agreement to ensure the transaction is handled for the purposes of the ‘system fix’ and to obtain a legal platform to ensure that access, security and disposal of the data adheres to our requirements in terms of current and future ISO accreditation and Data Protection legislation.
In terms of transactional data (non person identifiable data), for example direct debit data, there is a robust data sharing agreement and corresponding process for exchanging data with all suppliers. No person identifiable data is exchanged or transferred routinely.
Data hosting
The majority of our data is hosted in secure cloud/data centre environments accessible only through VPN, and or in the case of our CRM, a two factor authentication process, to which we intend to add a fixed IP as an additional protocol. Our data is held within the EU, and where practicable these data will be held in a UK based environment. Some data is held in secure local servers with the relevant backup and security protocols. Access to all systems is managed through robust permission structures based on the requirement of the individual’s role, and these are regularly reviewed.
Out of hours access
There are a number of specific roles within our organisation that require that ‘specified individuals’ have access to data outside of operational hours. For example, to manage and react to incidents and to access systems remotely or on site for the purposes of maintenance or in managing system failures or errors. In these circumstances access is either on our premises or is governed by the same security measures outlined in data hosting.
Voice recording
On-site call recording is under the control of each customer; call recording data is not accessible to Cloud Business. Customers should ensure that they are compliant with all relevant regulations and legislation applicable to the customer in terms of consent, security, access, resilience, backups, archiving and deletion.
eve hosted call recording is only accessible by the customer, who in turn has the ability to access and download individual call recordings. The customer determines the accessibility of the call recording data and is responsible for ensuring that access is restricted to and managed in accordance with the customer’s own security policies. The customer is able to determine the duration for which the call recording is retained on the server in line with the terms of the customer’s licence. eve call recordings are stored in a tier 3 data centre on resilient RAID6 servers. Physical access to the data is secure and monitored single person point of entry, physically guarded 24/7 and monitored by integrated digital video surveillance. The data centre conforms to the following certifications: ISO9001:2008; ISO27001:2005; PCI-DSS; BS25999-2:2007; ISO14001. Virtual access to recordings is restricted to company admins and sub access can only be granted by the company call recording administrator. The security of recordings has been, and will continue to be tested by industry leading penetration testers who found no security hole to the call recordings. Unless otherwise agreed in writing with Cloud Business, all call recording data is deleted after 30 days on a rolling basis, or by written request by an authorised and verifiable agent of the customer. Requests for deletion of call recording data sooner than 30 days must be made in writing to Cloud Business (or other retail supplier to the customer), contain sufficient information for the request to be verified and implemented without impacting on the customer’s resilience and operational ability. Where a customer defines longer periods of data retention, these data will be retained and remain accessible to the customer in accordance with the terms of the customer’s licence.
ISO and risk management
- Cloud Business retains 9001 accreditation and is currently running an implementation programme with BSI to attain 27001 accreditation.
- There have been no significant security incidents in the last 12 months.
- The organisational risk register contains all risks identified to date and these are managed as determined by our internal processes, reporting to the organisational risk management group.
Cloud Business
8 North Street
Guildford
GU1 4AF
08456 808538
hello@cloudbusiness.com
2024 © Cloud Business Enterprise Ltd
Registered Company in England and Wales 15375773
