We are Exigia Ltd – a small consultancy company, based in the UK, which specialises in providing a range of services for SME clients, including support for information governance compliance, cyber security compliance and a range of web services.
Most of our clients are UK organisations working in the health and social care sector, either within the NHS, supporting it or supplying it. We also serve charities, local government organisations such as parish councils, small businesses and individuals.
This is our Privacy Notice that describes how we handle personal data. It was last updated on 21 November 2024.
The personal data we collect varies depending on the relationship we have with the data subjects and how we interact with them. It may include the following:
We may collect names, address, phone numbers, email addresses, IP addresses, passwords, ages, genders and dates of birth.
We may collect names, bank account numbers and sort codes. For example, we may need these details to pay suppliers or issue clients with refunds.
We may collect some technical information from devices and applications used to access our web services (e.g. computers, mobiles, tablets, smart speakers, web browsers etc. This might include IP addresses and device IDs.
We may collect information on how clients access and use our services, for example the pages or articles read.
We may collect the names, location and a summary of messages or opinions expressed by enquirers and clients who call, text, email, chat online, videoconference or otherwise communicate with us. Please note that depending on what is said, this may include confidential information.
We may ask for addresses in order to offer services and exchange information. We may also collect our contact’s general geographic locations based on IP addresses.
When we are contacted via a form or comment, noticeboard, blog or other website facility, we may use the data you answer an enquiry or provide services. We will record details of answers supplied and services provided.
In particular, we collect contact details, records and attainments of students attending our online courses. Where students are sponsored by an organisation or employer, we will be acting on their behalf as a processor and they will have access to the information we hold about their students.
We do not normally collect any sensitive personal data (unless it is provided voluntarily), and will, in any event, ask for express consent to hold this information if we need to do so. We ask that enquirers and users of our services do not submit sensitive information if they do not wish us to collect it.
We may obtain additional information from trusted third parties and public sources.
We need to have a valid purpose to use personal data. This is called a “lawful basis for processing”. We process personal data for the following lawful bases:
You have the right to withdraw consent at any time. Where consent is the only legal basis for processing, we will cease to process data after consent is withdrawn.
We may process your data when we need to fulfil a contract with you.
We process your data when it is in our legitimate interest to do this and when these interests are not overridden by your data protection rights. Our legitimate interests include being able to:
We may process your personal data to comply with our legal and regulatory obligations e.g. taxation, preventing, investigating and detecting crime, fraud or anti-social behaviour and to comply with actions taken by law enforcement agencies.
We may pass personal data to our external third-party service providers; companies who act either as our (data) processors or in exceptional cases as data controllers in their own right e.g. some professional advisors. Our providers may include:
These third parties (and any subcontractors they are be permitted to use) are legally obliged not to share, use or retain your personal data for any purpose other than as necessary for the provision of our services. For further information on our processors and sub-processors, please refer to the list of our Data Processors.
As required by law or regulation
None
Our services are not directed towards individuals under the age of 18.
We do not knowingly use or process the personal data of children under 13 years of age for our own purposes as a controller, but may do so as a processor on behalf of a client.
We hold personal data for different purposes and the length of time we keep it will vary depending on the services or products we are providing.
We only keep data for a reasonable period of time, which is based on the purpose for which we are using it. Once that purpose has been fulfilled, we will securely delete that data or anonymise it (so that neither we, nor anyone else, can tell that the data relates to the original data subject) unless we are required to retain the data longer for legal, tax or accounting reasons.
To determine how long we store personal data, we always use these principles
Personal data supplied to us is generally stored and kept inside the United Kingdom.
However, due to the nature of our business and the technologies required, personal data may sometimes be transferred to third party service providers outside the UK. This is nearly always within the EEA or other countries considered ‘adequate’ in data protection terms by the UK as we are aware that countries without an ‘adequacy’ status may not have the same level of data protection laws and have a lower level of protection.
In the unlikely event that we need to transfer personal data to such countries we will take steps to ensure adequate privacy and security, including, where appropriate, data minimisation, anonymisation, pseudonymisation and encryption.
We will also undertake due diligence on the recipients and their country’s privacy laws and seek alternatives in countries that have been granted Adequacy Decisions by the UK where possible. We will place data recipients under contractual obligations to take care of personal data, for example by using UK standard contractual clauses (SCCs) or their equivalent.
Data subjects have the right to obtain details of the personal data about them. The exercise of this right leads to data subject access requests.
Data subjects have the right to be forgotten.
Data subjects have the right to object to the processing of their personal data. This includes the right to object to direct marketing. Data subjects will always be given the opportunity to opt-out of further direct marketing when they receive such communications from us or can contact us as set out in the Contacting Us section below.
Data subjects have the right to move, copy or transfer certain personal data
Data subjects have the right to restrict the use of their personal data in certain circumstances
Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which significantly affects you or produces legal effects.
Data subjects wishing to submit a request in relation to any of these rights, should contact us as set out in the Contacting Us section below. Please note we may need proof of identity before we provide a response.
We do not charge for requests to exercise these rights unless they are manifestly unfounded or excessive, when we may refuse to respond or charge a reasonable fee before dealing with them.
Please see our separate Cookies Notice
This Privacy Notice primarily sets out how we process personal data as a controller of that data, but at times we may process personal data controlled by others.
This is the situation, defined in data protection law, where we process personal data on behalf of a client. In such situations we are acting as a (data) processor or sub-processor* of personal data which you control.
As a processor, we
When a processor, processing personal data under contract with a controller, employs a second company to do some of that processing, that second company is referred to as a sub-processor.
Sub-processors
Note: Clients should refer to our Terms and Conditions or their contracts with us for the terms under which we act as a processor.
For the avoidance of doubt:
The controller responsible for personal data collected via this and associated websites and associated business transactions is Exigia Ltd. If you have any concerns about his Privacy Notice or any other personal data or data protection issue, we would like to know about them and have the opportunity to deal with them. We encourage you to contact us first so that we can try to help you.
Please contact us at:
Please mark your correspondence for the attention of the Data Protection Officer.
If you do not think we are handling your personal data, enquiry or complaint adequately, you have the right to lodge a complaint with the Information Commissioner’s Office. Further information, including contact details, are available from the Information Commissioner (see below).
In order to comply with current legislation, The Company maintains a Data Protection Act, 2018 Registration No. ZA019088. Further information is available at the Information Commissioner’s website.
