This Privacy Notice describes how Crossbow Education Limited collects, uses, shares, and retains personal data you provide. We’ve made some changes to our Privacy Notice to align with the new data protection law being introduced on 25th May 2018; the changes to the Notice don’t alter the way we use your data but do give greater transparency about that use.

Your Data and Crossbow Education

With the introduction of the General Data Protection Regulation (GDPR) businesses need to be much more transparent about the customer data they hold and how they use it. This puts the power back in your hands. It has always been Crossbow Education’s approach to keep things clear and simple, and that’s why we want to make sure you know how we gather, store and use your personal data.

Your ‘personal data’ is defined as data which by itself or with other data available to us, can be used to identify you. We are Crossbow Education Ltd, and under the GDPR we are known as both a data controller and a data processor. This Privacy Notice sets out how we use your personal data; if you have any questions, you can contact us at Garnet House, 18-19 Wolseley Court, Staffordshire Technology Park, STAFFORD. ST18 0GA. Tel. 01785 242878.

What we won’t do with your data

First, we want to let you know that we are committed to maintaining your privacy and will always treat your personal data fairly, lawfully, and transparently. Treating you with the respect you deserve, we will never:

1. Collect it or store it unnecessarily or for longer than necessary.
2. Sell it.
3. Leave it unprotected.

The types of personal data we collect and use

When you become a customer, we use your personal data to manage your account; the purchase orders, and/or services you have given it for. We will collect most of this directly from you. We may also maintain information about you that you do not directly provide to us, for example; information received from third parties, such as business partners for whom we provide products and/or a ‘drop-shipment’ service.

The personal data we use may be about you as a personal customer or a business customer and may include:

• Name and personal details including contact information (e.g. home and business address and address history, email address, home, business and mobile telephone numbers);
• Job title or position;
• Payment Card details. (Although we do not store this information in our database)

Providing your personal data

We'll tell you if providing some personal data is optional, including if we ask for your consent to process it. In all other cases you provide your personal data for our legitimate business purposes; e.g. so we can process your orders and/or services you have given it for.

Using your personal data: the legal basis and purposes

We'll process your personal data:

1. As necessary to perform our contract with you for the relevant account, purchase order and/or service:

1. To take steps at your request before entering into it;
2. To decide whether to enter into it;
3. To manage and perform that contract;
4. To update our records; and
5. To trace your whereabouts to contact you about your account and if necessary, recovering debt.

2. As necessary for our own legitimate Interests or those of other persons and organisations, e.g.:

1. For good governance, accounting, and managing and auditing our business operations;
2. To search at credit reference agencies at your home and business address if you are over 18 and apply for credit with us;
3. To monitor emails, calls, other communications, and activities on your account;
4. For market research, analysis and developing statistics; and
5. To send you marketing communications

3. As necessary to comply with a legal obligation, e.g.::

1. When you exercise your rights under data protection laws and make requests;
2. For compliance with legal and regulatory requirements and related disclosures;
3. For establishment and defence of legal rights;
4. For activities relating to the prevention, detection and investigation of crime;
5. To verify your identity, make credit checks, fraud prevention and anti-money laundering checks;
6. To monitor emails, calls, other communications, and activities on your account.

4. Based on your consent, e.g.:

1. When you request us to disclose your personal data to other people or organisations such as a company handling a claim on your behalf, or otherwise agree to disclosures;
2. To send you marketing communications where we have asked for your consent to do so.

You’re in Control

You are always in control of the data we hold about you and you're free at any time to request to see it, to correct it, or change your mind and withdraw your consent where it is given. In the latter case the consequence might be that we can't do certain things for you, but it’s your choice. You can amend your marketing preferences at any time by contacting us.

Sharing of your personal data

Subject to applicable data protection law, we may share your personal data with:

• Third parties who help us provide our products and services;
• Companies and other persons providing services to us;
• Our legal and other professional advisors, including our auditors;
• Fraud prevention agencies, credit reference agencies, and debt collection agencies if and when we open your account and periodically during your account or service management;
• Government bodies and agencies in the UK and overseas (e.g. HMRC who may in turn share it with relevant overseas tax authorities and with regulators e.g. the Prudential Regulation Authority, the Financial Conduct Authority. the Information Commissioner's Office);
• Courts; to comply with legal requirements, and for the administration of justice;
• In an emergency or to otherwise protect your vital interests;
• To protect the security or integrity of our business operations;
• To other parties linked with your account
• When we restructure or sell our business or its assets or have a merger or re-organisation;
• Payment systems (e.g. Visa or Mastercard, WorldPay) who may transfer your personal data to others as necessary to operate your account and for regulatory purposes, to process transactions, resolve disputes and for statistical purposes, including sending your personal data overseas; and anyone else where we have your consent or where it is required by law.

Your marketing preferences and related searches

According to your preferences, we'll use your address, phone numbers, email address and social media (e.g. Facebook, Google and message facilities in other platforms) to contact you.

You can change your preferences or unsubscribe at any time by contacting us. In the case of social media messages, you can manage your social media preferences via that social media platform.

If you have previously told us that you don't want information on other products and services or to be included in market research, we will continue to respect your wishes.

Criteria used to determine retention periods

The following criteria are used to determine data retention periods for your personal data:

• Retention in case of queries. We'll retain your personal data for as long as necessary to deal with your queries;
• Retention in case of claims. We'll retain your personal data for as long as you might legally bring claims against us; and
• Retention in accordance with legal and regulatory requirements. We'll retain your personal data after your account, purchase order or service has been closed or has otherwise come to an end based on our legal and regulatory requirements.

Your rights under applicable data protection law

Your rights are as follows (noting that these rights don't apply in all circumstances and that data portability is only relevant from 25 May 2018):

• The right to be informed about our processing of your personal data;
• The right to have your personal data corrected if it's inaccurate;
• The right to object to processing of your personal data;
• The right to restrict processing of your personal data;
• The right to have your personal data erased (the “right to be forgotten");
• The right to request access to your personal data and information about how we process it;
• The right to move, copy or transfer your personal data ("data portability”); and
• The right to complain to the Information Commissioner's Office. (It has enforcement powers and can investigate compliance with data protection law: ico.org.uk.)

Data anonymisation and aggregation

Occasionally, your personal data may be converted into statistical or aggregated data which can't be used to identify you but would then be used to produce statistical research and reports. This aggregated data may be shared and used in all the ways described above.w

International Visitors

Crossbow Education Limited is in the United Kingdom (of Great Britain & Northern Ireland) which is part of the European Union. If you are providing personal data and are not a resident in the European Union, your country’s laws governing data collection and use may differ from those in the European Union. By providing information to Crossbow Education Limited, you are transferring your personal data to the European Union, and that you consent to the transfer to, retention of and processing of your data in the European Union.

Security

Crossbow Education Limited uses a comprehensive information security programme designed to protect our customers’ Personal Data using administrative, physical, and technical safeguards; measures which are appropriate to the type of information maintained and follows applicable laws regarding safeguarding any such information under our control. In addition, in some areas of our Sites, Crossbow Education Limited may use encryption technology to enhance data privacy and help prevent loss, misuse, or alteration of the information under Crossbow Education Limited control. It is also important for you to guard against unauthorized access to your Personal Data by maintaining strong passwords and protecting against the unauthorized use of your own computer or device.

Links to Third-Party Sites

From time to time, Crossbow Education Limited will provide links to third-party web sites, or advertisements will contain links to third-party sites. For example, Crossbow Education Limited may link to a third party who is assisting in or is providing online training services. These links are provided as a service to you. These sites are operated by independent entities that have their own privacy policies. Crossbow Education Limited’s Privacy Notice does not apply to such other sites or to the use that those entities make of your information. Crossbow Education Limited has no control over the content displayed on such sites, nor over the measures, if any, that are taken by such sites to protect the privacy of your information.

Children

Crossbow Education Limited does not knowingly collect personal data from persons under the age of 13 and strives to comply with the provisions of the GDPR. If you are a parent of a child under 13, and you believe that your child has provided us with information about him or herself please contact us at privacy@crossboweducation.co.uk

Modifications to this Notice

From time to time, Crossbow Education Limited may need to update or modify this Privacy Notice, including to address new issues or to reflect changes on our web sites, including our main site located at www.crossboweducation.com (“sites”). To the extent required by law, Crossbow Education Limited will notify you of material changes to this Privacy Notice, by posting the most recent version of the Privacy Notice and information about the changes from the previous version on Crossbow Education Limited sites. The Notice was last modified on 18 May 2018 to be fully compliant with the new General Data Protection Regulations (GDPR).

How to Contact Crossbow Education Limited and Modify Your Information or Preferences

Questions regarding this Privacy Notice should be directed to Crossbow Education Limited’s Customer Support by email at privacy@crossboweducation.co.uk To help us keep your personal information up to date, or to request access to the personal data Crossbow Education Limited maintains about you, you may also contact us at Garnet House, 18-19 Wolseley Court, Staffordshire Technology Park, STAFFORD. ST18 0GA, United Kingdom. or by fax to 0845 269 7373. Or, if you are a registered user of one of our Sites, you may go online to your personal profile and update your information in that area.