privacy

1. This Privacy Notice sets out details about the personal data that we, Pub Ocean Ltd, may collect and process about you.

2. It covers:

This Privacy Notice is non-contractual, regularly reviewed and may be amended by us from time to time.

THE TYPE OF DATA WE HOLD, PURPOSE OF PROCESSING, LEGAL BASIS, DATA SHARING AND RETENTION PERIODS

3. We have provided this information in a layered format below to ensure it remains clear and concise. Please click on the sub-heading below that best describes you and this information will be displayed.

Please note that if we intend to further process your personal data for a purpose other than that for which it was collected, we shall provide you with information on this other purpose and all other information as set out in this notice.

TRANSFERS OUTSIDE THE EEA
4. We may transfer the personal information we collect about you to our Group company in the United States of America (“USA”), Hexagram Advertising Exchange (“Hexagram”), in order to perform our contract with you, for day to day business activities, recruitment purposes (in the case of job applicants) and for auditing purposes. Such information may be hosted on our Cloud system provider and accessed by Hexagram on a business need to know basis.

5. There is an adequacy decision by the European Commission in respect of the USA (limited to the safeguards set out in the Privacy Shield). This means that the USA is deemed to provide an adequate level of protection for your personal information.

6. Any transfers to the USA will be subject to the safeguards set out in the Privacy Shield. For data transferred to the USA, to ensure that your personal information receives an adequate level of protection we have put in place the following appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection:

7. We will only transfer such personal data as we believe is necessary for the purposes of hosting the data on our Cloud provider and for auditing processes (or other purposes specified above); and

We will ensure any data processed by Hexagram is only processed by those individuals who require the data on a need to know basis

RETENTION

In terms of retention periods, we will not keep your data for longer than is necessary. When deciding how long to hold your data we have regard to legal requirements (including any contractually agreed periods) and statutory limitation periods (under which it is prudent for us to retain records for longer periods).

SPECIAL CATEGORY DATA/CRIMINAL CONVICTION DATA

We do not envisage that we will be processing any special category data or any information on criminal convictions.

CONSENT

8. Where we rely on consent to process your personal data, you have a right to withdraw your consent at any time.  This will not affect the lawfulness of processing based on consent before its withdrawal.

9. You can withdraw your consent to our processing at any time by contacting dataprotection@pubocean.com. Please specify the type of processing that you are withdrawing your consent to in your email.

YOUR RIGHTS

You have a number of rights in relation to the personal information that we process about you.  You:

  • Have the right to be informed about your data (as set out in this Privacy Notice);
  • Can request access to your personal data;
  • Can request that your personal data be rectified if it is inaccurate or incomplete;
  • Can request that the processing of your personal data be restricted or erased in certain circumstances, for example, where the data is no longer necessary to meet its purpose;
  • Can object to processing in certain circumstances, for example where this is based on legitimate interests or involves direct marketing;
  • Can request to receive personal data that you have provided in a structured, commonly used and machine-readable format and to have this transmitted without hindrance where the data is processed on the basis of consent or performance of a contract; and
  • Can lodge a complaint with the Information Commissioner’s Officer.

AUTOMATED DECISION MAKING (“adm”)

ADM occurs when decisions are made about you by a computer or some other information analyzing machine. Examples of this include the machine scanning of CVs, computer processed aptitude or personality tests and website profiling.  We do not use ADM as any such processes are reviewed, for example as part of any recruitment process, by us manually before making any decisions.

CONTACT DETAILS FOR DATA CONTROLLER and inquiries 

Pub Ocean Ltd (registered in England and Wales with company no. 07469603) can be contacted at 1st Floor, Buckhurst House, 42/44 Buckhurst Avenue, Sevenoaks, Kent, United Kingdom, TN13 1LZ.

11. If you have any enquiries regarding data protection or wish to exercise any of your rights please do contact dataprotection@pubocean.com.

 

JOB APPLICANTS
Types of data we may process

Recruitment Stage

We may process the following information at the recruitment stage:

  • Personal contact details including name, address and email;
  • Information collected during the recruitment process such as your CV/application (including details of previous work experience, education and references) and answers to any interview/recruitment questions relevant to the role you applied for;  
  • Equal opportunities information. This is not mandatory and is not made available to anyone outside of the recruitment team (including hiring managers and HR) save in an anonymised format so as not to identify you;   
  • Recruitment Agencies – we may collect your personal details, details of your application and details of your experience and qualifications from the recruitment agency you applied via.

12.

13. With the exception of the equal opportunities information, you are obliged to provide this personal data to us as it is necessary for us to explore potentially entering into a contract with you.  If you fail to provide it we may be unable to process your application and, if appropriate, offer you employment. The equal opportunities form is not mandatory and there are no consequences if you fail to provide it.

14. Conditional Offer/ShortlistedWe may process the following information after you have been shortlisted and/or as part of a conditional job offer:

  • Proof of your identity (such as driving license) and any relevant right to work checks;
  • We will contact your referees (with express consent), using the details you provide in your application, directly to obtain references.

16. The above is usually part of a conditional offer of employment and therefore you are obliged to provide this as it is necessary to enable us to enter into a contract with you. Right to work checks are a statutory requirement which you are obliged to provide.  A failure to provide this may result in us being unable to offer you employment.

1. The purposes of processing

  • For recruitment purposes i.e. to ensure you are suitable for the role being advertised and so we can contact you about this role;
  • To comply with legal obligations including right to work checks;
  • To seek professional advice/defend claims arising from the recruitment process;
  • In relation to the equal opportunities form, to monitor equality in recruitment practices.

2.

3. Legal basis for processing  

4. We process your personal data on the basis of consent and/or because it is necessary for our legitimate interests, namely to ensure that you are qualified and suitable for the role you are applying for and to ensure we have a record of the recruitment process for the defense of legal claims.

5. We process details of your right to work checks in line with our legal requirements to do so.

6.

17. Sharing your data

18. Your data will be shared internally with the recruitment team which consists of HR, the interviewing staff and managers at Pub Ocean Ltd, as relevant and their support staff and subordinates where appropriate.


WEBSITE USERS
Types of data we hold
When you access our website, we may collect the following personal data:

  • Data you input into online forms. For example, if you are signing up to our marketing updates, you will be asked for your name and email address.
  • Time and date of visit.
  • Session identifier.

 

We also collect technical data via Live Yield (who in turn may use Google Analytics), however, these reports do not contain any personal data. However, we may keep limited contact details inputted into our forms (your name and email address) for authentication purposes.

For information you are asked to provide (as part of signing up to a service), you are obliged to provide this to enable us to perform the contract with you and to ensure our IT systems remain secure and effective. A failure to provide this may mean we are unable to provide you with the services you require.

When you access our website, cookies will be created.

Cookies are pieces of data created when you visit a site, and contain a unique, anonymous number. They are stored in the cookie directory of your hard drive, and do not expire at the end of your session.

We use two types of cookie- session detail cookies (which are used for session recognition during a session) which we store in browser local storage, and Device ID cookies (which expire after 30 days). Cookies do not contain any personal information about you and cannot be used to identify an individual user. If you choose not to accept the cookie, this will not affect your access to the majority of facilities available on our websites.

Although your browser may be set up to allow the creation of cookies, you can specify that you be prompted before a site puts a cookie on your hard disk, so that you can decide whether to allow or disallow the cookie. You can also opt-out of cookie storage via our domain found at pubocean.com. Alternatively, you can set your computer not to accept any cookie.

Log files are also created when persons visit our website. They allow us to record visitors’ use of the websites and include your IP address. We may put together log file information from all our visitors, which we use to make improvements to the content and layout of the websites and to the information in it, based on the way that visitors move around it. We also use your IP address for geographic analysis (IP2Geo mapping). This can identify your IP geographical address based on your city used to access our website. However, your individual address cannot be deduced by the IP address alone.

Your IP address is recorded automatically when you access our website to assist us in monitoring and improving content and for security reasons. You are, therefore, obligated to provide this when accessing the website. Once you have provided your IP address and we have completed our geographic analysis, we amend the last octet of your IP address so it is set to zero. As such, we do not store your full IP address.

The purposes of processing

  • To register you as a new client and provide services to you as requested;
  • To be able to contact you in relation to the service and effectively manage our relationship with you;
  • To enable us to ensure efficiency and security of our systems (e.g. prevention of unauthorised access) and make improvements where necessary, including for user experience of the website;
  • To monitor and manage the use of our website; and
  • To make business decisions about the provision of services and our website.

Where you have signed up to events or updates your data is also processed for marketing purposes (please see marketing below).

Legal basis for processing

We process this data as it is necessary for our legitimate interests, namely to keep records of user experiences, provide the information you have requested, improve our services, ensure our services remain accurate and up to date, study how our website is used and popular content, for marketing strategies/communications and to maintain and grow our business.

We also process data as required by law, including, to comply with legal obligations such as security obligations in data protection legislation (such as prevention of unauthorised access).

We do not rely solely on consent to process your data, however, where you have signed up for services we may also process your data on the basis of your consent.

Sharing your data

19. Your data will be shared internally with our IT and Marketing departments. It may also be provided to our managers (and their support staff and subordinates where appropriate) to the extent necessary for their role and to make decisions about the business, however, this will usually be in an anonymised format (e.g. statistics).

Our website contains links to third-party websites.  Clicking on those links may allow third parties to collect your personal data. We do not have control over such websites and would encourage you to read the privacy notices for websites you visit.


CLIENTS/POTENTIAL CLIENTS AND PARTNERS
Types of data we hold

  • Contact details of those instructing us (such as name, job title, address and email address) or potential clients;
  • Information about the matter you are instructing us on; and
  • We may also need to process personal data from third parties which are necessary for the performance of the contract with you.

You are obliged to provide this information to enable us to perform our contract or to take steps to enter into a contract with you and to enable us to comply with statutory obligations, such as verifying identity and source of funds for anti-money laundering purposes. If you do not provide this information we may not be able to provide any services to you.

The purposes of processing
To enable us to:

  • Perform our contractual obligations (e.g. to contact you, assist you with any matter or project) or take steps to enter into a contract (e.g. provide a cost estimate);
  • Take preparatory steps to deal with your enquiry to potentially engage you as a client;
  • Retain a record for the defense of legal claims or insurance purposes;
  • Market services to you (such as updates and event invitations) which we consider would be of interest to you; and
  • Retain a record for the purpose of regulatory audits or audit requests from clients and for external audits/quality checks.

Legal basis for processing

  • To perform the contract that we have entered into with you or take steps to enter into a contract (e.g. provide a costs estimate);
  • It is also necessary for our legitimate interests (to provide the service efficiently, to maintain accurate records for the defense of legal claims, to retain accreditations and to grow our business); and
  • To comply with our legal and regulatory requirements including regulatory audits.

Sharing your data

Your data will be shared internally to the extent necessary to carry out our obligations under our contract with you and/or in line with the purposes set out above.  This is likely to include the employee responsible for the project or matter, their supervisor and subordinates, IT and Finance. Your data may also be shared with our bank as necessary where you are making payments to us.

Your contact details may also be shared with our Marketing team to ensure you are invited to events and provided with updates that we believe may be of interest to you. Please note, you have a right to opt out of any marketing communications (see below section on ‘Marketing’).

We may need to share your data with professional advisers we contract with in relation to the matter you have instructed us on.

We will also share your personal information with third parties where required by law and where it is necessary to administer the working relationship with you (as stated above).

We may also need to share personal data with third parties such as potential buyers of the business where applicable (the recipient of this information will be bound by confidentiality restrictions if the data cannot be anonymised).

Once we have completed our obligations under our contract with you, your personal data will be archived and stored in our Cloud system for the retention period set out in this notice.


MARKETING RECIPIENTS 
Type of data we hold

We may process your personal data including your name, employer, job title and email address for marketing purposes.

In most cases we will have received this data from you directly when you have signed up for services or events, however, we may also obtain data from publicly available sources (such as your employer’s website).

You are not obliged to provide this information, however, if you do not do so we may not be able to provide the services requested (for example, to receive updates, we would need a valid email address).

You may opt out of marketing communications on any marketing communications you receive by selecting the ‘opt out’ hyperlink contained within so that you can opt out easily at any time.

Purposes for processing

We may process this personal data to send you marketing updates by email (and in some cases by post) such as new services and relevant business know-how that we believe may be of interest to you or that you have expressly requested.

If you have opted out of marketing updates, we may retain your personal data as a record of those who have opted out to ensure that we do not contact you further for these purposes.

Legal basis for processing

We process this data on the basis of consent and legitimate interests, namely to maintain and grow our business.

Sharing of data

We will always treat your personal data securely and with respect and do not share this with other organizations save where you have expressly asked us to do so.

Your personal data is shared internally with our Marketing and IT teams. We may use external marketing companies for marketing purposes, however, we do not envisage needing to share your personal data with them and will only do so if it is necessary for particular tasks assigned to them pursuant to their role.  Where fees are charged for a service, our Finance team will also have access to your personal data to the extent necessary to recover payments from you and record your payment record and financial details.


20. THIRD PARTIES WE CONTACT (OR WHO CONTACT US)  
Type of data we hold

We may process your personal data including your name and contact details where you have contacted us (e.g. for information) or where we have obtained your information from a public source or third party and wish to request information. If we receive any communication from you then we will also process any data contained within your request.

An example may be where you are a prospective employer and contact us for a reference or, similarly, where we seek a reference for someone we intend to employ.  Another example may be where we contact you to see if you would be interested in hosting a joint event or where we seek to use your business service, vice versa, or where you market to us.

This covers a variety of requests and, in most cases, we do not envisage you being obliged to provide your personal data. If you are requesting information from us, not providing this data may mean we are unable to respond.

Purposes for processing

The purpose of us processing your personal data is to allow us to respond to your request or to seek information.

Legal basis for processing

We process this data on the basis of our legitimate interests.  These are likely to include assessing job applicants’ suitability for roles and growing our business and network.

Sharing of data

Your data will be shared internally with those parties relevant to the information request.  If your request requires this, it may be shared with other external parties.