Privacy Policy

Introduction

We are InChorus Group Ltd, a company registered with Companies House in England and Wales under number 11755917 (“InChorus”/“we”/“us”/”our”). We are committed to protecting your privacy.

This privacy policy (“Policy”) sets out the basis, under applicable data protection law (including the UK General Data Protection Regulation and the UK Data Protection Act 2018), on which we will collect and process personal data through your use of the InChorus website www.inchorus.org or and the InChorus online software platform and the accompanying software app, and any other sites operated by or on behalf of InChorus (together the “Sites”). It applies to our Clients, App Users, Client Users, Marketing Contacts, our Site visitors and to other individuals whose data we may process, except for our employees (“you”/”your”). You may fall within more than one of these categories depending on your relationship and interactions with us.

When we refer to “personal data” in this policy, we mean any information relating to you from or in relation to which you may be identified (directly or indirectly). Any references to the UK Information Commissioner’s Office shall be deemed to include reference to any successor.

Please read this Policy carefully to understand how we will use and look after your personal data. If you visit our Sites, your data will be processed in line with this Policy.

INCHORUS ROLE

InChorus acts in different capacities depending on the personal data being processed.

InChorus acts as a data processor in respect of personal data (if any) submitted to or collected via the Platform by: (i) App users who are typically employees, contractors or consultants of our clients who have been granted access to our Platform (“App Users”); and (ii) administrative users of the Platform dashboard who are acting on behalf of our clients (“Client Users”). In these circumstances we process personal data on behalf of our client, i.e. the relevant employer or organisation that has engaged us to provide the Platform. Where we act as a data processor, the relevant employer or organisation that has engaged us to provide the Platform is responsible for providing information to App Users and Client Users about how their personal data is processed. However, please note that certain InChorus services and platforms (for example, Culture Tracker) are designed to operate on an anonymous basis and are not intended to be used to process personal data. App Users should therefore not include names or any other information that directly or indirectly identifies an individual in free-text fields made available through those services or platforms.

InChorus acts as a data controller in respect of personal data relating to: (i) trial users or potential new users of the Platform, including those who we have identified as possible future clients and to whom we are marketing or promoting the Platform and our services (“Marketing Contacts”); (ii) points of contact at our existing (“Client Contacts”); and (iii) our Site visitors. This Policy only applies to personal data we process as a data controller.

HOW DO WE COLLECT YOUR PERSONAL DATA?

For Client Contacts, we will collect your personal data directly from you or your employer organisation who is our client.

For Marketing Contacts, we will collect and process personal data from you directly which you provide when you complete an enquiry via our Sites or register for a trial or otherwise contact us to request information about our products and services.  We may also receive further personal data about you which is publicly available from third party service providers.

For Site Visitors, we collect personal data about you automatically when you use our Sites.

PERSONAL DATA WE COLLECT ABOUT YOU, WHY WE PROCESS IT AND THE LAWFUL BASES RELIED UPON

The personal data we collect depends upon our relationship with you. The below table set outs the personal data we collect about you, why we process this personal data, and the lawful basis we rely on to do so. The UK GDPR requires that we provide this information to you.

We will also anonymise and/or aggregate your personal data so that it can no longer be associated with you. Once anonymised this information is no longer personal data and we may use it for our own purposes, including for statistical and benchmarking purposes.

MARKETING COMMUNICATIONS

We may send marketing communications (relating to InChorus news, updates, events, developments, products and services). We will only send these to you where you have specifically consented to receiving such communications or where we have a legitimate interest in sending this to you and you have not opted-out of receiving such communications. If you no longer wish to receive marketing communications from us, you can withdraw your consent at any time or otherwise unsubscribe by contacting us at rosie@inchorus.org or by clicking the unsubscribe link you can find at the bottom of each communication.

WHO DO WE SHARE YOUR PERSONAL DATA WITH?

We will only share your personal data with other organisations where we have your permission to do so in accordance with this Policy or where we believe it is necessary for a legitimate reason connected with the Sites or our services.

Accordingly, we may share your personal data with service providers, for example of IT services (including website hosting, landing page hosting, form capture providers), business partners, suppliers and/or sub-contractors, cloud-based communications, analytics, storage, and other services, for the performance of any contract that we enter into with our clients or in the course of undertaking marketing activities. We require all our third party service providers to take appropriate and security measures to protect your personal data. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes in accordance with our instructions and the agreement we have with them.

We may also disclose your personal data to other third parties in the following circumstances:

• We may disclose your personal data to our legal advisers if they need to have access to this information in order to advise us on our legal rights and obligations;
• We may disclose your personal data if we are under a duty to disclose or share your personal data in order to comply with any legal obligation or where we think this is required and we are permitted to do so, for example to respond to a request for cooperation from a relevant authority.
• We may also share your personal data in order to protect or enforce our rights, for example in order to enforce or apply our Terms of Use or other contracts between us and our clients; or to protect the rights, property or safety of us, our customers or others.
• We may also share your personal data with third parties in connection with any merger or acquisition of our business by a third party in the future, whether by share sale or the sale of some or all of our assets.

COOKIES AND SIMILAR TECHNOLOGIES

Cookies are small text files or other pieces of information that are stored on, or accessed from, your device when you visit a website. Cookies can help a website recognise your device and provide information about how and when pages are accessed. Other similar technologies, such as pixels, beacons, tags, scripts, local storage and web streams, can work in a similar way. In this Policy, we use the term “cookies” to refer to cookies and similar technologies that collect or access information in this way. To find out more about cookies please visit www.allaboutcookies.org.

In particular, we use technology such as Google Analytics (including through Google Analytics web streams) to collect information about your visit to our Sites You can find more information about Google Analytics here: https://analytics.google.com/analytics/web. In essence, Google Analytics enables us to analyse how you and others interact with our Sites. We have configured our current Google Analytics implementation so that it does not use embedded analytics cookies. However, Google Analytics may still involve the use of tracking technologies described above or the collection of usage data to provide analytics services.

Where required by applicable law, we will only use non-essential cookies or tracking technologies with your consent. You can withdraw or manage your consent at any time through our cookie settings tool.

We may also use ‘necessary’ or ‘essential’ cookies help make our Sites usable by enabling basic functions. Our Sites may not be able to function properly without these cookies. They include, for example, a cookie that is set for security reasons or to remember your cookie consent preferences. We do not need your consent for these cookies.

INTERNATIONAL DATA TRANSFERS

The information that we collect from you may be processed outside the United Kingdom and European Economic Area (EEA). In these cases, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy, by ensuring at least one of the following safeguards is implemented:

• transferring your personal data to countries that have been deemed to provide an adequate level of protection for personal data under UK data protection laws and/or by the UK Information Commissioner’s Office;
• entering into specific contractual terms which have been approved by the UK Information Commissioner’s Office and which give personal data the same protection as within the UK. This may include the UK International Data Transfer Impact Assessment or the standard contractual clauses approved by the European Commission incorporating the UK Addendum. Where required, we will undertake a Transfer Risk Assessment where required pursuant to the Schrems II decision in order to verify, on a case-by-case basis, whether the law in the recipient country ensures adequate protection for personal data transferred under this tool.

For further information on the safeguards used, please contact us at rosie@inchorus.org.

RETAINING YOUR PERSONAL DATA

We will not store your personal data for longer than is reasonably necessary to use it in accordance with this Policy or with our legal rights and obligations. When determining this retention period we take into account any record retention requirements under law and any limitation periods relevant to legal action. For the avoidance of doubt, aggregated and anonymised data and any information other than personal data can be stored indefinitely.

In particular:

• For Client Contacts: we will typically retain your personal data for at least six years after the end of our relationship with the client that you represent.
• For Marketing Contacts: we will retain your personal data for a period for so long as we have a lawful basis to do so. This will typically be until you withdraw consent or have unsubscribed from receiving marketing communications.

YOUR RIGHTS

You have various rights in relation to the personal data which we hold about you. Some of these rights may not always apply, as there are sometimes requirements and exemptions which may mean we need to keep processing the personal data or not disclose it, or other times when the rights may not apply at all. We will always tell you if we think we do not have to comply.

• Right to access your personal data. You have the right to access information about the personal data we hold about you.
• Right to object to processing. You have the right to object at any time where we are relying on legitimate interest lawful basis to process your personal data, including where we are using it for direct marketing purposes.
• Right to rectification: You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you.
• Right to erasure. You have the right to request that we erase any personal data that we hold about you, based on one of a number of grounds, including if it is no longer necessary for us to hold that personal data or where you withdraw your consent and we have no other legal basis to process that personal data.
• Request to restriction of processing. This enables you to ask us to restrict the processing of your personal data in certain circumstances. This means that you may be able to limit the way that we use your personal data.
• Right to portability. You have the right to obtain copies of your personal data to enable you to reuse your personal data across different services and with different companies. You may also request that your personal data is transmitted directly to another organisation where this is technically feasible using our data processing systems.
• Right to withdraw consent: Where we are processing your personal data based on your consent, you have the right to withdraw your consent at any time. This includes where you have given your consent to direct marketing, but have changed your mind. Please note that the withdrawal of consent will not affect the processing based on consent before the withdrawal.
• Right to complain: You have the right make a complaint to the UK Information Commissioner’s Office, the UK data protection regulator, as directed on their website at www.ico.org.uk. Please think about telling us first though, so we have a chance to address your concerns.

You can exercise any of these rights by contacting us at rosie@inchorus.org.

CHANGES TO OUR PRIVACY POLICY

Any changes we may make to this Policy will be posted on this page.  We encourage you to check this page periodically to make sure you are aware of our current Policy. Where it makes sense because the changes are material, we will notify you by e-mail or in another appropriate manner such as when you next interact with the relevant Site.

CONTACT US

We really do welcome any questions, comments and requests you may have regarding this Policy. You can contact us by emailing us at rosie@inchrous.org.