Under data protection law, individuals have a right to be informed about how The TransforMATive Group Ltd (heron referred to as 'we' or 'the Company') uses any personal data that we hold about them. We comply with this right by providing privacy notice to individuals where we are processing their personal data.
This privacy notice explains how we collect and use personal data about users of our Eclipse redaction platform (hereon referred to as 'you' or 'Customers') before, during and after your relationship with us in accordance with the requirement of United Kingdom General Data Protection Regulation (UK GDPR).
We will also explain what rights you have with regards to your personal data and how you can exercise those rights.
You can find details on specific areas of our privacy notice in the sections below:
Contents
Responsibilities
The Company's Data Protection Officer is responsible for ensuring that this notice is made available to data subjects prior to The TransforMATive Group Ltd collecting or processing their personal data.
All employees and associates of The TransforMATive Group Ltd who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject's attention and where necessary their consent to the processing of their data is secured.
The personal data that we collect is essential in order for us to provide our services to Customers and meet legal requirements.
1. Who we are
The TransforMATive Group Ltd is a digital transformation consultancy based in Leeds, England, offering innovative solutions to businesses across the UK.
2. Key Contact
Please read this notice carefully. In the event that you have any questions or concerns regarding the processing of your data you can contact:
Data Protection Officer: Jonny Wathen
Email: info@transformativegroup.co.uk
Telephone: 0113 526 7246
3. The categories of personal data that we collect, process, hold & share
The categories of information that we process as a 'data controller' includes:
- Personal identifiers (such as full name, address, contact email, job title & employer)
We collect information from you for one or more of the following purposes:
- Setting up an account on eclipse.education
- Providing our contractual service to Customers
- Receiving payment for the product
- Addressing any queries or concerns
- Business management and administration
- Sending communications related to our services
- To comply with the law regarding data sharing
- For the detection and prevention of crimes such as fraud
Transformative is a 'data processor' of the data that customers upload to the Eclipse redaction platform. Consequently any information we collect and process in our capacity as a 'data processor' is entirely dependent upon what a 'data controller' engaging our services elects to upload to the platform.
4. How is your personal information collected
The Company collects personal information about Customers and members of their workforce when you engage with our services, sign contracts, or interact with our teams.
The Company collects and processes data in its capacity as a processor whenever a Customer uploads it to the web based platform.
5. Lawful basis for processing
When processing your personal data as a 'data controller' we will rely on one of the following grounds as set out in Article 6 of UK GDPR:
Contractual Obligation
The main lawful basis used for the processing of Customer personal data is 'contractual obligation' as we are engaged by Customers under a written contract. This will apply when accounts are created by individuals who will use the platform for their own purposes as opposed to that of their employer.
Legal Obligation
Many of our record keeping requirements are set by parliament through statutory legislation.
Legitimate Interests
The processing is necessary for our legitimate interests or that of our Customers. Account details such as the full name of the individual who created the account and their organisational email would be processed under this basis.
The Company predominantly processes Customers personal data based on contractual obligations and legitimate interests as outlined in UK GDPR.
As a 'data processor' we are not required to identify a lawful basis for processing as we process solely on the instructions of the 'data controller' and it is for that organisation to identify a lawful basis. The Company is of the opinion that this would be Legal Obligation due to the obligations to redact third party data under Schedule 2 DPA 2018 and first party data (if appropriate) under Schedule 3 DPA 2018.
6. Special Category Data
Under UK GDPR there are certain types of data that are recognised as needing greater protection due to its sensitive nature. This includes data such as racial or ethnic origin, religious or philosophical beliefs, trade union membership, data concerning sex life and sexual orientation as well data concerning health. To process this type of data an organisation is required to identify an Article 9 exemption as well as an Article 6 lawful basis as set out in section 5 above.
The Company does not process special category data of our Customers or their workforce in our capacity as a 'data controller'.
The Company may process special category data of any data subjects whose data is uploaded to the platform by a 'data controller'.
7. How does this work in practice
To assist with your understanding of how this all works in practice we have prepared the table below.
| The data being processed | Our lawful basis | What else we need to tell you |
|---|---|---|
| Personal identifiers (such as name, address, contact email, job title, phone number & employer) of key Customer contact(s). | Contract | Key Customer contact(s) in this regard refers to data subjects who are named within the contract and/or have the overall responsibility for its management. |
| Personal identifiers (such as name, address, contact email, job title & employer) of Customer workforce. | Legitimate Interests | We may be asked to work with members of the Customer workforce to deliver our service. It is in the legitimate interests of both the Company and Customer that we process details of these data subjects. |
| Customer ID, email address used for billing receipt, billing name and address. | Contract | This will apply if you are purchasing a license as an individual opting to pay by card through the Stripe platform. |
| Customer ID, email address used for billing receipt, billing name and address. | Legitimate Interests | This will apply if you are purchasing a license on behalf of an organisation and opting to pay by card through the Stripe platform. |
8. How we may share personal information
We may have to share your data with third parties, including third-party service providers and other organisations. In particular, we may share your data with organisations including but not limited to, the following:
- Police or other law enforcement agencies
- Our legal advisors
- Our internal associates
- External consultants
- Insurance providers
- Google Ireland Ltd as we use Google Workspace as our productivity and collaboration tool
- Hubspot Inc as our customer relationship management tool
- Xero Limited as our financial system
- Pwned Data Intelligence Ltd as technical developers and maintenance support providers for the product.
We do not share information about our Customers or their workforce with any third party without consent unless the law and our policies allow us to do so.
We do not share any data uploaded to the Eclipse platform as we are unable to access that data.
The Company reserves the right to use or disclose any personal information as needed to satisfy any law, regulation or legal request, to fulfil your requests, or to cooperate in any law enforcement investigation or an investigation on a matter of public safety.
9. International Transfers
While most of our operations are UK-based, there may be instances where data is transferred internationally. We ensure all such transfers comply with UK GDPR.
A small number of data processors that we use are based outside the UK and so their processing of your personal data will involve a transfer of data outside the UK. These processors are predominantly applications and information systems used by us to facilitate our services (such as Google Workspace, Google Analytics and HubSpot CRM). Some UK based processors may also use sub-processors (such as cloud service providers) which are located outside of the UK.
Whenever we transfer your personal data out of the UK, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the Secretary of State.
Where we use certain service providers who are outside of the adequacy regime, we will use standard data protection clauses approved by the Secretary of State which give personal data the same protection it has in the UK.
10. Storage, Retention & Disposal
The Company will only store the minimum amount of personal data necessary to provide our services to you. Your data will be stored securely and will be subject to access controls.
We will only retain your personal information for as long as necessary to fulfil the purposes that we collected it for, including for the purposes of satisfying any legal, accounting, insurance or reporting requirements.
All data will be disposed of in a secure and confidential manner. All electronic and physical data will be disposed of ensuring that it cannot be reconstituted by any third party.
Data that is uploaded to Eclipse is processed in memory and automatically deleted after your session completes.
Data uploaded to Eclipse is stored at a Google Cloud Platform data centre in England.
11. Data Security
We have robust security measures in place to protect your data from unauthorised access, alteration, or disclosure.
Third parties who are processing personal data on our behalf will only process your personal information in line with our instructions and where they have agreed to treat the information confidentiality and to keep it secure.
We have put in place procedures to address any suspected data security breach and will notify you and any applicable regulators of a suspected breach where we are legally required to do so.
Data uploaded to the Eclipse platform is encrypted throughout the process using enterprise-grade encryption.
12. Artificial Intelligence: Customer Management
The Company uses a number of AI systems to assist with customer management including:
- Google Gemini is a feature of our workspace platform and may be used to process reports which include personal data of customers such as their name and role within the organisation. Gemini would also be used when a Google meet is recorded and transcribed to provide the transcript of the meeting. This would include identification of customers who are present in that meeting.
- Xero is an accounting system which includes AI powered features which may be used to assist in processing customer invoices which may include the personal data of customers employees.
- HubSpot is a CRM system which includes AI powered features which may be used to assist in managing customer relationships which will include the personal data of customers' employees.
The Company does not use AI systems for automated decision making or profiling.
13. Artificial Intelligence: Eclipse
Eclipse itself has an AI element which is used for identification and categorisation of data subjects and categories. The output of the AI subsequently prompts the system which redacts those fields and applies the redactions.
Eclipse uses a closed AI model that we operate directly. The data uploaded to the platform is not used to train the model further or transferred to a third-party AI provider.
14. Your rights
Under the United Kingdom General Data Protection Regulation 2018, you have the following rights:
The right to be informed
As a data controller, we are obliged to provide clear and transparent information about our data processing activities. This is provided by this privacy notice and any related communications we may send you.
The right to rectification
When you believe we hold inaccurate or incomplete personal information about you, you may exercise your right to correct or complete this data. Please keep us informed if your personal information changes whilst you are a Customer of goods and/or services from us. This may be used with the right to restrict processing to make sure that incorrect/incomplete information is not processed until it is corrected.
The right to erasure
Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data. This includes personal data that may have been unlawfully processed. We will take all reasonable steps to ensure erasure. This is also known as 'the right to be forgotten'.
The right to access
You may request a copy of the personal data we hold about you free of charge. Once we have verified your identity and, if relevant, the authority of any third-party requester, we will provide access to the personal data we hold about you as well as the following information:
- The purposes of the processing
- The categories of personal data concerned
- The recipients to whom the personal data has been disclosed
- The retention period or envisioned retention period for that personal data
- When personal data has been collected from a third party, the source of the personal data
If there are exceptional circumstances that mean we can refuse to provide the information, we will explain the same. If requests are malicious or manifestly unfounded we reserve the right to refuse them. If answering requests is likely to require additional time or unreasonable expense (which you may have to meet), we will inform you.
The right to restrict processing
You may ask us to stop processing your personal data. We will still hold the data, but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies you may exercise the right to restrict processing:
- The accuracy of the personal data is contested.
- Processing of the personal data is unlawful.
- We no longer need the personal data for processing but the personal data is required for part of a legal process.
- The right to object has been exercised and processing is restricted pending a decision on the status of the processing.
The right to data portability
You may request your set of personal data be transferred to another controller or processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was on the basis of consent, the processing is by automated means and if the processing is based on the fulfilment of a contractual obligation.
The right to object
The right to object to us processing certain types of information when:
- Processing is based on legitimate interest;
- Processing is for the purpose of direct marketing;
- Processing is for the purposes of scientific or historical research; or
- Processing involves automated decision-making and profiling.
The Information Commissioner's Office provides more information about these rights.
Contact Us About Your Rights
If you would like to contact us about any of these rights, please email us at info@thetransformative.com or write to us at:
Data Protection Officer
The Transformative Group Ltd
Nelson House
George Mann Road
Leeds
LS10 1DJ
We will respond to you within one calendar month of receiving your request to exercise any of these requests and you will not be charged for this service.
15. Complaints
If you have concerns about our data processing activities, please contact us using the details provided above.
Should you feel unsatisfied with our handling of your data, or about any complaint that you have made to us about our handling of your data, you are entitled to escalate your complaint to a supervisory authority.
For the UK, this is the ICO (Information Commissioner's Office). The ICO's contact information can be found at https://ico.org.uk/global/contact-us/.
Privacy Questions?
Contact our Data Protection Officer for any privacy-related inquiries.
Get in Touch