Efficio Privacy Statement

Privacy Policy

Efficio Privacy Statement

Efficio Global Consultancy Ltd and its subsidiaries (“Efficio Group”) respect and are dedicated to protect the confidentiality and privacy of information entrusted to it. As part of this fundamental obligation, Efficio Group is committed to the appropriate protection and use of information that relates to an identified or identifiable individual ("Personal Data”) that has been collected by or provided to it through its clients, users of our procurement platform eFlow, suppliers, business contacts, shareholders, website users (hereinafter "you", "your") and other online and mobile services that link to or post this Privacy Statement.

This Privacy Statement is issued on behalf of Efficio Group so when we mention "Efficio", "we", "us" or "our" in this Privacy Statement, we are referring to the relevant company in the Efficio Group being the controller and therefore responsible for processing your Personal Data. The relevant company responsible for processing your Personal Data will usually be Efficio Limited with its registered office address at 1 Pall Mall East, London, England, SW1Y 5AU, +44 (0) 2 3908 4040 telephone number, privacy@efficioconsulting.com email address. If any other company in the Efficio Group is the controller for your Personal Data, we will let you know when we obtain your Personal Data. 

We have appointed Ian McNally as our Data Protection Officer ("DPO") who is responsible for overseeing questions in relation to this Privacy Statement. If you have any questions about this Privacy Statement, concerns regarding compliance with this Privacy Statement, comments about our administration of your Personal Data or any requests to exercise your legal rights related to Personal Data (see below), please contact the DPO using the following email address: privacy@efficioconsulting.com.

This Privacy Statement is effective as of 21 November 2022. Please note that this Privacy statement will be regularly updated to reflect any changes in the way we handle your personal data or any changes in applicable law. 

Please review this Privacy Statement to learn more about how we collect, use, share and protect the Personal Data that we have obtained as well as your legal rights related to this Personal Data. 

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

1. Which categories of personal data do we collect?

Personal Data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together as follows: 

•  Identity Data (which includes first name, last name, etc);
•  Contact Data (which includes email address, billing address, delivery address, etc);
• Technical Data (which includes IP address, browser version, operating system, time stamp of login, website traffic date, weblogs, etc);
• Usage Data (which includes information about how eFlow users use the system);
• Financial Data (which includes bank account details, etc);
• Transaction Data (which includes details about payments made to suppliers, items purchased from suppliers and the time of their occurrence);
• Profile Data (which includes username (usually email address), feedback responses and help desk requests, etc); and
• Marketing and Communication Data (which includes company name, job title, level of seniority, email preferences for marketing campaigns, details of engagement with our website, engagement with marketing campaigns and participation in past events, details of how a contact is known to us and which Efficio employee holds the relationship, etc). We use Leadoo’s tracking service to follow what users are doing on the site and combine this behavioural data with other data we can gather from e.g. chat interactions. Leadoo uses ETag tracking in order to hook together the same user’s behaviour over several sessions. Please check out Leadoo Marketing Technologies Ltd’s Privacy Policy (https://leadoo.com/privacy-policy/) for more information on what is tracked and what your rights are. Leadoo works as the Processor and we work as the Controller for the data in terms of GDPR. You can stop the tracking by emptying your browser’s cache after the visit. For more on how Leadoo works as a GDPR compliant processor, see https://leadoo.com/privacy-policy-processor

We do not generally seek to collect any special categories of Personal Data about you, which needs more protection because its sensitive. It includes racial or ethnic origin, political opinions, religious, philosophical, or other similar beliefs, membership of a trade union, physical or mental health, biometric or genetic data, sexual life or orientation, or criminal convictions and offences (including information about suspected criminal activities). In the limited cases where we do seek to collect such data, we will do this in accordance with applicable data protection law requirements and/or ask for your consent.

We also collect and use Aggregated Data. Aggregated Data could be derived from your Personal Data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. We collect e.g. website traffic data, location data or weblogs like the number of visits to our website, the pages a website user views and the resources he/she accesses in a way which does not identify individuals. We use this information to track the number and behaviour of website users like calculating the percentage of users accessing our website. We do occasionally aggregate Technical and Usage Data from eFlow to see which browsers our users are using. We make no attempt to find out the identities of those website users and we do not associate any data gathered from the website with any identifiers from another source. Please see also our cookie policy for further details.

Except for certain information that is required by law, or under the terms of a contract, your decision to provide any Personal Data to us is voluntary. You will therefore not be subject to adverse consequences if you do not wish to provide us with your Personal Data. However, please note that if you do not provide certain information, we may not be able to accomplish some or all of the purposes outlined in this privacy statement, and you may not be able to use certain tools and systems (eFlow) which require the use of such Personal Data.

If you provide us with Personal Data of another person (for instance, a potential employee/referral), you are responsible for ensuring that such person is made aware of the information contained in this Privacy Statement and that the person has given you his/her consent for sharing the information with Efficio.

2. How is your Personal Data collected?

The above-mentioned categories of Personal Data are obtained  

• directly from you: This includes Personal Data you provide us with when you:
  • correspond with us by post, phone, email, over the website or otherwise;
  • fill in forms in our website, including subscribing to newsletters and alerts, registering for marketing campaigns or event invites, or requesting a white paper or further information;
  • activate your account to use and access eFlow; 
  • complete surveys we use for research purposes;
  • post and or upload any comment or other content on our website;
  • raise tickets within our helpdesk system and/or give feedback; and
  • Participate in user feedback studies to inform our product development.
• indirectly from automated technologies or interactions: When you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns by using cookies. Please see also our cookie policy for further details [Cookie policy | Efficio UK (efficioconsulting.com)].
• indirectly from certain third parties or publicly available sources: We receive Personal Information about you from the following third parties and public sources:
  • Usage Data from analytic providers such as Google Analytics and advertising partners such as Leadoo Marketing Technologies Ltd (Leadoo); and
  • Identity and Contact Data from publicly available sources such as social media profiles like LinkedIn.

Leadoo's tracking service allows us to follow what users are doing on the site and combine this behavioural data with other data we can gather from e.g. chat interactions. Leadoo uses ETag tracking in order to hook together the same user’s behaviour over several sessions. Please check out Leadoo's Privacy Policy (https://leadoo.com/privacy-policy/) for more information on what is tracked and what your rights are. Leadoo works as the processor and we work as the controller of the data in terms of GDPR. You can stop the tracking by emptying your browser’s cache after the visit. For more on how Leadoo works as a GDPR compliant processor, see https://leadoo.com/privacy-policy-processor.

3. For which purposes and on which legal basis do we use your Personal Data?

Efficio uses your Personal Data only where required for specific purposes and when the law allows us to. Most commonly, we will use your Personal Data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation we are subject to.

Legitimate interests means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). 

We have set out below, in a table format, a description of all the ways we plan to use your Personal Data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground, we are relying on to process your Personal Data where more than one ground has been set out in the table below.
 

Where the above table states that we rely on our legitimate interests for a given purpose, we are of the opinion that our legitimate interests are not overridden by your interests, rights or freedoms, given (i) the transparency we provide on the processing activity, (ii) our privacy by design approach, (iii) our regular privacy reviews and (iv) the legal rights you have in relation to the processing activity.

We will only use your Personal Data for new purposes (i) if they are compatible with the purposes of which you have been informed (like archiving purposes in the public interest, scientific or historical research purposes and statistical purposes), or (ii) if we get your consent for the new purpose or (iii) it is required or authorized by law to do so.

4. Will we share your personal data with third parties?

We may share and transfer Personal Data for the purposes set out in the table above to other companies within the Efficio Group or external third parties like our service providers, professional advisors, public and governmental authorities or third parties in connection with a (potential) corporate or commercial transaction. We require all third parties to respect the security of your Personal Data and to treat it in accordance with applicable data protection laws. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for the specified purposes and in accordance with our instructions.

Whenever we transfer your Personal Data for the purposes set out in the table above to any third parties outside of the EEA/UK, we ensure a similar degree of protection is afforded to it by ensuring that either the country where the third party is located has been deemed to provide an adequate level of protection for Personal Data or the transfer is governed by standard contractual clauses adopted by the EU Commission from time to time (where the EU GDPR applies to the transfer) or adopted by the UK Information Commissioner's Office from time to time (where the UK GDPR applies to the transfer) (a copy of which can be obtained through the contact information included below).

5. What about data security?

Efficio attaches great importance to your right to privacy and the protection of your Personal Data. We want you to feel secure when you deal with Efficio and that your Personal Data is in good hands.
Efficio protects your Personal Data in accordance with applicable data protection laws and our data privacy policies. We also maintain organisational, physical and technical security arrangements for all the Personal Data we hold to protect it against unauthorized or unlawful processing and/or against accidental loss, alteration, disclosure or access, or accidental or unlawful destruction of or damage thereto. We have protocols, controls and relevant policies, procedures and guidance to maintain these arrangements taking into account the risks associated with the categories of Personal Data and the processing we undertake.

We have adopted market leading security measures to protect your Personal Data. This includes (without limitation):

• We hold the ISO27001 certification, which indicates that we adhere to the highest and strictest information security standards. This is a security standard awarded by United Kingdom Accreditation Service (UKAS) that serves as sole national accreditation body for the United Kingdom, recognised to assess against internationally agreed standards. This certification is the only auditable international standard that defines the requirements for an Information Security Management System (“ISMS”) and confirms that Efficio’s processes and security controls provide an effective framework for protecting your and our own information.
• We have regular penetration testing performed by a third-party provider, which continues to show the strength of our technical defences.
• We limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.

Regarding your use of our websites, you should understand that the open nature of the internet is such that information and Personal Data flows over networks connecting you to our systems without security measures and may be accessed and used by people other than those for whom the data is intended.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

6. How long will your personal data be retained by us?

We will retain your Personal Data only for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements. 

We maintain specific records management and retention policies and procedures, so that Personal Data is deleted after a reasonable time according to the following retention criteria:

• We retain your Personal Data as long as we have an ongoing relationship with you (in particular, if you have an active account with us) and it is therefore needed to provide services to you.
• We retain your Personal Data as long as needed to comply with our global legal and regulatory obligations, like for example income tax and audit purposes.

In some circumstances you can ask us to delete your Personal Data: see your legal rights below for further information.
In some circumstances we will anonymise your Personal Data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

7. Which legal rights do you have with respect to the processing of your Personal Data?

Under certain circumstances and subject to the exceptions set out in applicable data protection laws, you have the following rights in relation to your Personal Data:

• Request access to your Personal Data: this right entitles you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it. 
• Request correction of your Personal data: this right entitles you to have your Personal Data be corrected if it is inaccurate or incomplete, though we may need to verify the accuracy of the new data you provide to us.
• Object to the processing of your Personal Data: this right entitles you to request that Efficio no longer processes your personal data where Efficio is relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request erasure of your Personal Data: this right entitles you to request the deletion or removal of your Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 
• Request restriction of processing your Personal Data: this right entitles you to request that Efficio suspends the processing of your Personal Data in the following scenarios:
  • If you want us to establish the data's accuracy.
  • Where our use of the Personal Data is unlawful but you do not want us to erase it.
  • Where you need us to hold the Personal Data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your Personal Data but we need to verify whether we have overriding legitimate grounds to use it. 
• Request transfer of your Personal Data: this right entitles you to receive the Personal Data that you have provided to Efficio in a structured, commonly used and machine-readable format and request that Efficio transmits such personal data to another data controller, provided that the legal basis for the processing is consent or the performance of a contract and the processing is carried out by automated means. 
• Withdraw your consent: To the extent that the processing of your Personal Data is based on your consent, you have the right to withdraw such consent at any time. Please note that this will not affect Efficio’s right to process personal data obtained prior to the withdrawal of your consent, or its right to continue parts of the processing based on other legal bases than your consent.

If you wish to exercise any of the legal rights set out above, please contact Efficio’s Data Protection Officer (privacy@efficioconsulting.com).

You will not have to pay a fee to access your Personal Data (or to exercise any of the other legal rights stated above).

However, we may charge a reasonable fee for the administrative costs if your request is manifestly unfounded or excessive. Alternatively, we could refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other legal rights stated above). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than one month if your request is particularly complex or you have made several requests. In this case, we will notify you within one month of receiving the request and keep you updated.

If, despite our commitment and efforts to protect your Personal Data, you believe that your data privacy rights have been violated, you have the right to make a complaint at any time to the relevant supervisory authority (the UK regulator for data protection issues is the Information Commissioner's Office (ICO) (www.ico.org.uk)). We would, however, encourage and welcome you to turn to Efficio on first instance to seek a resolution of any complaint before approaching a supervisory authority.