Privacy Policy and Notice

Privacy Notice

We are committed to safeguarding your privacy and take our responsibilities under GDPR very seriously. We do not trade data commercially and will only disclose data with your consent, or if we are required to do so by law. If you have a query or request regarding the way we handle data, please get in touch.

Our registered address is:

Tank
5 Kayes Walk
Lace Market
Nottingham
NG1 1PY

Why we process data

Below, we have outlined the reasons for us processing data. We believe these purposes to be justified to allow us to run and promote our business, fulfil contractual requirements and deliver services for our clients, and meet our legal obligations. Email marketing falls outside of this but we operate such activity on a consent basis. We have provided details below on the types of information we hold about different groups of people, so read on if you are interested in finding out more.

Clients

If you are a client of ours, it is likely we will hold the following information about you:

Name and contact details.
Information and documents relating to the service we are providing you with, including communications with you.
Billing and payment details.

We use the personal data listed above to meet our contractual requirements as part of providing a PR / SEO / PPC / social media service to you. We also use the data as part of legal requirements for elements such as tax purposes. In addition, we will use your information to invoice you and to keep track of the payments you make.

We will hold your information for the duration of our working relationship to allow us to continually deliver our contracted services to you, and for a further 3 years once our contract comes to an end. We retain financial records for 6 years following the end of the current financial year.

We use the following third-party services for some of our client work and this sometimes involves the use of client data.

Infusionsoft: This is a form of marketing automation software that we sometimes use to act as a data processor and distribute marketing emails on behalf of our clients to their database. Infusionsoft’s servers are based in the US, so data is transferred outside of the EEA. For information, you can view Infusionsoft’s privacy notice here.
Hootsuite: We use Hootsuite to schedule social media posts for some clients. You can view Hootsuite’s privacy notice here.
Google Analytics: We use Google Analytics to collect standard online log information about visitor behaviour patterns for some clients’ websites. This helps us find out things like visitor numbers. You can view Google’s privacy notice here.
Google Ads: We use Google Ads to run PPC, Display and Retargeting ads for clients. For some clients this will mean the use of financial data. You can view Google’s privacy notice here.
Google Merchant Centre: This is an extension of the Google Ads platform and can involve the use of client’s financial data. You can view Google’s privacy notice here.

Prospective clients

If you are a prospective client, it is likely we will hold the following information about you:

Name and contact details.
Information about your business activities.
Information and documents relating to the service we could be providing you with, including communications with you.

If you make an enquiry with us by phone or email, we will use that information to follow up on that enquiry to see how we can help you. We will retain that information for the duration of the enquiry, then for a period of one year should you not become a client of ours.

Current and former employees

If you are an employee of Tank, it is likely that we will hold the following information about you:

Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
Date of birth.
Gender.
Marital status and dependants.
Next of kin and emergency contact information.
National Insurance number.
Bank account details, payroll records and tax status information.
Salary, annual leave, pension and benefits information.
Start date.
Location of employment or workplace.
Copy of driving licence / passport.
Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
Employment records (including job titles, work history, working hours, training records and professional memberships).
Performance information.
Disciplinary and grievance information. Information about your use of our information and communications systems.

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

Information about your health, including any medical conditions and health and sickness records.

We use this personal data to perform the contract that we have entered into with you, to comply with legal obligations and where it is necessary for ours and your legitimate interests. We may also use your personal information in the following situations, which are likely to be rare:

Where we need to protect your interests or someone else’s interests.
Where it is needed in the public interest or for official purposes.

We may have to share your data with third parties, including third-party service providers. The following activities are carried out by third-party service providers: payroll, pension administration, IT services, Human Resources.

Your personal data will be stored by us throughout your employment and for a period of six years once your contract with us has come to an end. A full copy of our data privacy notice for staff is included in the Tank staff handbook, which is provided to all staff as part of the induction process.

Job applicants

If you apply for a job with us, it is likely we will hold the following information about you:

Name and contact details.
The information you have provided us with as part of your CV and covering letter, including communications with you.
Any information you provide to us during the interview process.

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

Information about your health, including any medical conditions and health and sickness records.

We use this personal data to assess your skills, qualifications and suitability for the role, to communicate with you during the recruitment process, to keep records relating to our recruitment process, to comply with legal and regulatory requirements. We will use any information that you provide to us regarding your health and disability status to make any necessary adjustments during the recruitment and interview process.

If your application is not successful, we will retain your personal data for a period of 6 months after we have informed you of our decision. If you are successful, then your data will be transferred to your staff file and handled in line with the ‘current and former employees’ section above.

The above also includes anyone applying for work experience placements.

Further information regarding the way we handle data during the recruitment process can be found here.

Event attendees

If you are on the database for launches / openings / events, it is likely we will hold the following information about you:

Name and contact details.

We operate our database on a consent basis. You will have already have given consent to be on our events list but will always be provided with an opt-out option when you receive an invite.

We currently use third-party online tools:

Infusionsoft: a data management and email marketing platform that we use to distribute emails relating to events and to manage our database and their preferences. Infusionsoft’s servers are based in the US, so data is transferred outside of the EEA. For information, view Infusionsoft’s privacy notice here.

E-newsletter

If you are on the database for our e-newsletter, we will hold the following information about you:

Name and contact details.

We operate our database on a consent basis. You will have already have given consent to be on our e-newsletter distribution list but will always be provided with an opt-out option when you receive a copy.

We currently use third-party online tools:

Infusionsoft: a data management and email marketing platform that we use to distribute emails relating to e-newsletter subscribers and to manage our database and their preferences. Infusionsoft’s servers are based in the US, so data is transferred outside of the EEA. For information, view Infusionsoft’s privacy notice here.

Website visitors

When you visit http://www.tankpr.co.uk/, we use Google Analytics (third-party service) to collect standard online log information about visitor behaviour patterns. This helps us find out things like visitor numbers to certain parts of our website. This information is processed in a way that does not identify anyone individually.

Our website uses session-based cookies as part of Google Analytics and these are not used for re-marketing purposes. You can view Google’s privacy notice here.

If you want to opt-out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

Social media

If you contact us via a private or direct message on social media, these will be stored within that individual social media channel. It will not be shared with any other organisation and will be deleted within 1 year.

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from a director at Tank.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Your rights

If your data is processed by Tank, you have the following rights:

The right to be informed, which is what this privacy policy is for.
The right to access what data we hold about you.
The right to object to direct marketing – either use the unsubscribe option or contact us directly.
The right to object to processing carried out on the basis of legitimate interests.
The right to erasure (in some circumstances).
The right to data portability.
The right to have your data rectified if it is inaccurate.
The right to have your data restricted or blocked from processing.

If you ever want to verify, update or amend your personal data, please email info@tankpr.co.uk.

You also have the right to lodge a complaint about our processing with the UK’s Information Commissioner’s Office.

Changes to our privacy notice

We constantly review information to ensure that we comply with GDPR requirements and, therefore, keep this privacy notice under review. This was last updated on 19/07/18.