Privacy Policy
Scope
All data subjects whose personal data is collected, in line with the requirements of the GDPR.
Responsibilities
The Data Protection Lead is responsible for ensuring that this notice is made available to customer and data subjects prior to Virtue Technologies processing their data.
All Employees of Virtue Technologies Limited who interact with customer data are responsible for ensuring that this notice is drawn to the customer’s attention and, where appropriate, their consent to the processing of their data is secured.
Privacy notice
Who are we?
Virtue Technologies is a leading provider of IT solutions to Primary and Secondary schools, Academies and Multi-Academy Trusts, FE colleges and Universities.
We understand that all educational institutions have individual requirements and work in partnership with our customers, aiming towards a common goal of improving teaching and learning, ultimately supporting a school, college or University towards its ICT vision. We do this by providing a customised and local service that is both flexible and innovative.
GDPR Lead
Our GDPR Lead, Will Stead can be contacted directly by emailing will.stead@virtuetechnologies.co.uk or by phone on 01695 731233.
Data
Virtue Technologies is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified, then you can be assured it would only be used in accordance with this privacy statement.
Data we collect
| Function | Data Collected | How we manage this data |
|---|---|---|
| Account Management | Name, Role, Contact information (including address, phone numbers and email addresses) and product preferences. | Centrally stored in our CRM Solution, Microsoft Dynamics 365 in Microsoft’s environmentally managed and redundant UK based Data Centers. |
| Order Processing | Name, Role, Contact information (including address, phone numbers and email addresses) and products ordered. | Centrally stored in a combination of our accounting system, Sage, and Microsoft Dynamics 365. Both in environmentally managed and redundant UK based Data Centers. |
| Support Services1 | Name, Role, Contact information (including address, phone numbers and email addresses), services and IT related support information. | Centrally stored in our CRM Solution, Microsoft Dynamics 365 in Microsoft’s environmentally managed and redundant UK based Data Centers. |
| Offsite Backups | Any data that the customer has agreed to be backed up off site, including user and student information, SIMS database, etc. | Stored in an environmentally managed Tier 4 UK based data center and fully encrypted during transit and at rest. Virtue Technologies Limited to not have access to this data. |
| Marketing | Name, Role, Contact information (including address, phone numbers and email addresses) | Centrally stored in our CRM Solution, Microsoft Dynamics 365 in Microsoft’s environmentally managed and redundant UK based Data Centers. |
1 Additional information is available in our ‘Remote Support Policy’
Our legal basis for processing for the personal data:
In line with Article 6(1b), for all cases (except marketing), processing is necessary for the performance of a contract to which the customer has agreed. For our marketing activities, we gain consent from each data subject and this consent may be withdrawn using a link on the bottom of any marketing related email.
By consenting to this privacy notice you are giving Virtue Technologies Limited permission to process the personal data supplied specifically for the purposes identified. In doing so, Virtue Technologies Limited must assume that the data has been collected under the terms identified in Article 6 ‘Lawfulness of processing’ of the General Data Protection Regulation.
Disclosure
Virtue Technologies Limited will share limited personal data to third parties to enable us to perform our contract, such as arranging deliveries and licenses with manufacturers. Unless legally obliged to, we will never give or sell your data to a third party and we will not allow your personal data to be used by a third party for any reason other than originally intended. Under the GDPR, we will have in place an appropriate data sharing agreement with any third party supplier or manufacturer we use.
Retention periods
Virtue Technologies Limited process personal data for the following periods;
- Account Management: Duration of engagement plus 8 Years*
- Order Processing: Duration of engagement plus 8 Years*
- Support Services: Duration of engagement plus 8 Years*
- Offsite Backups: Duration of the contract plus 1 month
- Marketing: Until withdrawal of consent.
* includes the legal requirement of retention of financial data for 7 years.
For more information on storage and processing security, see Information Security Policy
Your rights as a data subject
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records. Virtue Technologies Limited Privacy Notice Document Control: Issue No: 1 Issue Date: 26/01/2018 Page: 3 of 3
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: in the event that Organisation Name refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 3.6 below.
All of the above requests will be dealt with in line with Virtue Technologies Limited Subject Access Procedure and will shared with the customer should a request come from directly a subject.
Complaints
In the event that you wish to make a complaint about how your personal data is being processed by Virtue Technologies Limited (or third parties as described above), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and Virtue Technologies Limited’s GDPR Lead.
Document Owner and Approval
The GDPR Lead is the owner of this document and is responsible for ensuring that this record is reviewed in line with the review requirements of the GDPR.
A current version of this document is available to all members of staff on the company network and is published on the company website