Privacy

Your privacy’s important to us and we go to great lengths to protect it. This privacy notice tells you about the personal data we hold about you and it explains how we may collect, use and share your details and tells you about your rights under data protection laws.

For the purposes of data protection law, we are a data controller in respect of your personal data. We collect and use your personal data and where applicable this may include information related to your spouse/partner, directors, partners and owners (your “representatives”). Esmeron Ltd. is responsible for ensuring that it uses your personal data in compliance with data protection law.

We are Esmeron Ltd. (also referred to as 'Medusa', ‘we’, ‘us’ or ‘our’) and our registered office is at The White House, 164 Bridge Road, Southampton, Hampshire, SO31 7EH (registered in England and Wales no. 09127943).

We are registered with the Information Commissioner’s Office and our registration number is ZA925344.

What do we mean by "Personal Information"?

“Personal information” means information that relates to you as an individual, whether linked to your name or any other way which you could be identified, such as your driving licence number.

How we use your personal information

The personal information that we collect will depend on our relationship with you. We have included a number of sections below – simply read those which most apply to your relationship with us.

If you provide personal information to us about other people you must provide them with a copy of this Privacy Notice, and obtain relevant consent from them where we have indicated in this Privacy Notice that we need it.

What personal information may we collect and where will we collect it from?

We may collect the following information provided by you by phone or web:

• Individual details: Your name, address, former address, contact details (e.g. email /telephone), gender, date of birth, Body measurements etc.
• Marketing preferences: Where relevant, including whether you have requested not to receive marketing information.
• Website usage, including Cookies: See section below for details.
• Other information: that we capture during recordings of our in-bound and out-bound telephone calls, or if you make a complaint. This may include special categories of information you volunteer when communicating with us (we will not further process these without your explicit consent).

What will we use your personal information for?

We may process your personal information for a number of different purposes. We must have a legal ground for each purpose, and we will rely on the following grounds:

• We need your personal information because it is necessary to enter into or perform a contract.
• We have a legitimate interest to use your personal information (e.g. to keep a record of the decisions we make when different types of applications are made, keep business records, carry out strategic business analysis, review our business planning and/or develop and improve our products and services). When using your personal information in this way, we will always consider your rights and interests.

Who will we share your personal information with?

On occasion, we may share personal information with the following third parties:

• Providers of demographic data.
• The police and other crime prevention and detection agencies. We and fraud prevention agencies may enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
• Selected third parties in connection with any sale, transfer or disposal of our business.
• To our professional advisers in order to enforce or apply the terms of use and other agreements you have with us.
• If we sell any of our business or assets, in which case we may disclose your personal data to the prospective buyer for due diligence purposes.
• With your consent, to third party affiliates who may wish to offer you products and services which may be of interest to you.
• If we are acquired by a third party, in which case personal data held by us about you will be disclosed to the third-party buyer.

Any third parties will be subject to confidentiality requirements and they will only use your personal data as described in this Privacy Notice.

We may also share your personal data outside of Esmeron Ltd. to the extent required by law, for example if we are under a duty to disclose your personal data in order to comply with any legal obligation including but not limited to disclosures made to Credit agencies and Companies House; and to establish, exercise or defend our legal rights.

Any third parties will be subject to confidentiality requirements and they will only use your personal data as described in this Privacy Notice.

We may also share your personal data outside of Esmeron Ltd. to the extent required by law, for example if we are under a duty to disclose your personal data in order to comply with any legal obligation including but not limited to disclosures made to Credit agencies and Companies House; and to establish, exercise or defend our legal rights.

What will we use your personal information for?

We may process your personal information for a number of different purposes. We must have a legal ground for each purpose, and we will rely on the following grounds:

• We need to use your personal information because it is necessary to enter into or perform the contract that we hold with you (e.g. we may need certain information in order to operate our business partnership arrangement).
• We have a legitimate interest to use your personal information such as maintaining our business records, keeping records of business entities we interact with, and analysing and improving our business model and services. When using your personal information in this way, we have considered your rights and ensured that our business need does not cause you harm.

For special categories of information, we must have an additional legal ground for processing. We will rely on the following:

• You have given us your explicit consent to our use of your special categories of information.
• We need to use your special categories of information< for purposes relating to managing our business relationship with you there is a substantial public interest in such use. Such purposes include preventing and detecting fraud.
• To establish, exercise or defend legal rights (e.g. legal proceedings are being brought against us or we want to bring a legal claim ourselves).

Use of Our Website

What personal information we may collect and where will we collect it from?

We may use various software including cookies and tags to improve your digital journey and to identify and prevent fraud. We collect and store information about how you access and use our website (including the website you visited before coming to our websites). We automatically receive the IP address of your computer, mobile device, or the proxy server you use to access the Internet and this may include information to identify your browser or device to analyse web traffic.

Fraud prevention cookies collect information about certain features of your device, such as your IP address, device type, browser type, screen resolution and operating system. This is to prevent and detect devices associated with fraudulent or other malicious activity and allows us to authenticate your account.

What will we use your personal information for?

We may process your personal information for a number of different purposes. We must have a legal ground for each purpose, and we will rely on the following ground:

• We have a legitimate interest to use your personal information such as maintaining our business records, monitoring usage of our website and marketing our services and improving our business model and services. When using your personal information in this way, we have considered your rights and ensured that our business need does not cause you harm.

What is our approach to sending your personal data abroad?

Sometimes we may transfer personal information that we collect about you to countries outside of the European Economic Area (“EEA”).

Where a transfer occurs we will take steps to ensure that your personal information is protected. We will do this using a number of different methods including:

• Some countries have been deemed by the UK to have adequate privacy legislation and are then deemed to be equivalent to processing within the UK.
• Putting in place appropriate contracts. We will use a set of contract wording known as the “standard contractual clauses” which has been approved by the data protection authorities.
• Transferring personal data only to those companies in the United States who are certified under the “Privacy Shield”. The Privacy Shield is a scheme under which companies certify that they provide an adequate level of data protection.

Marketing

We take privacy very seriously and will only use your personal information for the purposes laid out in this Privacy Notice. We may contact you about similar products and services unless you have opted out. We will contact you about marketing – for example, to offer other services or to ask if you want to take part in a competition we might run.

You are free to object to receiving any marketing material and can edit your marketing preferences at any time. To opt out of marketing communications please click “unsubscribe” on any marketing message we send you or call in to change your preferences.

How long do we keep your personal information for?

We will keep your personal information for as long as you are subscribing to the service, free accounts could be purged after 2 months of inactive use, you will receive warning emails before this deadline is reached. Subscribing customers data will be retained until they stop their subscription and then the 2 month rule will apply.

How we protect your information

The protection of your personal data is important to us. We take a number of technical and procedural measures to protect personal data. For example:

• Where we capture your personal information through our website, we will do this over a secure link using recognised industry standard technology (SSL) which encrypts data that is transmitted over the internet. Most browsers will indicate this by displaying a padlock symbol on the screen.
• We prevent unauthorised electronic access to servers by use of suitable firewalls and network security measures. We use strong internal antivirus and malware monitoring tools and conduct regular vulnerability scans to protect our internal infrastructure and also to protect communications we may send you electronically. Our servers are located in secure datacentres that are operated to recognised industry standard. Only authorised people are allowed entry and this is only in certain situations.
• We ensure that only authorised persons within our business have access to your data and conduct regular checks to validate that only the correct people have access. We promote responsible access to data and segregate who can see what data within Esmeron Ltd..
• Internally in our organisation, we have password policies in place which ensure passwords are strong and complex and are changed regularly.
• We use secure email exchange where necessary for sensitive data and have monitoring on all email we send and receive.
• We schedule periodic checks of all security measures to ensure they continue to be efficient and effective, taking into account technological developments.

Your rights

Under data protection law you have a number of rights in relation to the personal information that we hold about you. You can exercise these rights by contacting us. We will not usually charge you in relation to a request.

The right to access your personal information

You are entitled to a copy of the personal information we hold about you and certain details of how we use it. We will usually provide your personal information to you in writing unless you request otherwise. Where your request has been made electronically (e.g. by email), a copy of your personal information will be provided to you by electronic means where possible.

The right to rectification

We take reasonable steps to ensure that the information we hold about you is accurate and where necessary up to date and complete. If you believe that there are any inaccuracies, discrepancies or gaps in the information we hold about you, you can contact us and ask us to update or amend it.

The right to erasure

This is sometimes known as the ‘right to be forgotten’. It entitles you, in certain circumstances, to request deletion of your personal information. For example, where we no longer need your personal information for the original purpose we collected it for or where you have exercised your right to withdraw consent. Whilst we will assess every request, there are other factors that will need to be taken into consideration. For example we may be unable to erase your information as you have requested because we have a regulatory obligation to keep it.

The right to restriction of processing

In certain circumstances, you are entitled to ask us to stop using your personal information, for example where you think that the personal information we hold about you may be inaccurate or where you think that we no longer need to use your personal information.

The right to data portability

In certain circumstances, you can request that we transfer personal information that you have provided to us to a third party.

The right to object to marketing

You have control over the extent to which we market to you and you have the right to request that we stop sending you marketing messages at any time. You can do this either by clicking on the “unsubscribe” button in any email that we send to you or by contacting us. Please note that even if you exercise this right because you do not want to receive marketing messages, we may still send you service related communications where necessary.

The right to object to processing

In addition to the right to object to marketing, in certain circumstances you will also have the right to object to us processing your personal information. This will be when we are relying on there being a legitimate interest to process your personal information. Please note, in some circumstances we will not be able to cease processing your information, but we will let you know if this is the case.

Rights relating to automated decisions

If you have been subject to an automated decision and do not agree with the outcome, you can ask us to review it.

The right to withdraw consent

Where we rely on your consent in order to process your personal information, you have the right to withdraw such consent to further use of your personal information. Please note that for some purposes, we need your consent in order to manage your loan. We will advise you of any issues this may cause at the point you seek to withdraw your consent.

The right to lodge a complaint with the ICO

You have a right to complain to the Information Commissioner’s Office if you believe that any use of your personal information by us is in breach of applicable data protection laws and / or regulations. More information can be found on the Information Commissioner’s Office website: www.ico.org.uk. This will not affect any other legal rights or remedies that you have.

Please note, there may be some circumstances where we cannot comply with your request such as where complying with it would mean that we couldn’t comply with our own legal or regulatory requirements. In these instances we will let you know why we cannot comply with your request.

Automated processing

You may contact our Data Protection Officer if you would like to exercise the rights set out above, or if you have any questions about how we collect, store or use your personal information, Write to:

‘The Data Protection Team’ at Esmeron Ltd.

or

Email: podriscoll@esproviders.co.uk

Updates to this Privacy Notice

We may need to make changes to this Privacy Notice periodically, for example, as the result of government regulation, new technologies, or other developments in data protection laws or privacy generally or where we identify new sources and uses of personal information (provided such use is compatible with the purposes for which the personal information was original collected). The Data Protection Officer will ensure that this document is updated regularly or as legislation requires.