SQW Privacy Policy

Background

SQW Limited (SQW) takes data privacy seriously. We are committed to ensuring the privacy and security of the personal data we process and maintaining the confidence of those whose data we are entrusted with.

This Privacy Policy provides information required under data protection legislation, which comprises the UK GDPR and Data Protection Act 2018. When we refer to ‘personal information’, ‘information’ or ‘data’, this has the same meaning as ‘personal data’ as defined under data protection legislation. Use of other terms such as ‘Controller’ or ‘Processor’ shall have the same meaning as defined under data protection legislation.

This Privacy Policy aims to help you understand how SQW handles personal data. Specifically, it explains:

Who we are and what we do
The personal data we collect
How we obtain personal data
How we use personal data
Who we share personal data with
How we store personal data
How we protect personal data
Who is the Controller in relation to your data
What happens if the ownership of SQW changes
Your data protection rights
How long we keep personal data for
How you can contact us
Your right to complain
How we update this Privacy Policy.

1. Who we are and what we do

SQW is a leading independent provider of research, analysis and advice in economic and social development. Established in 1983, and operating across the UK, Europe and internationally, we work for clients from the public, private and voluntary sectors. We are experts in public policy and work with our clients to research, develop, implement and evaluate social and economic development interventions across a wide range of policy domains.

The company is registered in England under company number 01701564. SQW’s registered address is Oxford Centre for Innovation, Blue Boar Court, 9 Alfred Street, Oxford, OX1 4EH.  SQW is a trading name of SQW Limited, and our VAT number is GB844286704.

2. The personal data we collect

Personal data is any information that can be used to identify a living person such as name, contact details and characteristics.

SQW may collect some or all the following personal (and non-personal) data:

Personal identifiers for example name and date of birth
Contact information such as email address and telephone number
Home address
Employment and education details
Photographs
Online identification such as IP address
Personal data embedded in the messages you may send us on our contact forms e.g., in relation to job applications
Cookie Information (for more information please visit our Cookie Policy).

On some research projects, when acting on behalf of clients/Data Controllers, the nature of SQW's business model requires the firm to collect data on:

Gender
Family and relationship information
Employment
Financial situation
Personal opinions
Personal experiences.

On occasions, SQW collects and processes information which is sensitive, and which requires additional security. Special categories of data include:

Personal data revealing racial or ethnic origin
Personal data revealing political opinions
Personal data revealing religious or philosophical beliefs
Personal data revealing trade union membership
Genetic data
Biometric data (where used for identification purposes)
Data concerning health
Data concerning a person’s sex life
Data concerning a person’s sexual orientation.

SQW may also collect and process sensitive commercial data, disclosure of which could adversely affect another organisation's reputation or operations (for example, confidential information on a business's product development plans obtained through a consultation process).

3. How we obtain personal data

SQW may collect or receive personal data in a number of ways. For example, when:

You complete surveys that we use for research purposes
You provide information via the SQW website e.g. as part of a recruitment process
You contact us via phone, email, social media, Microsoft Teams, in person or via the SQW website, when we may keep your contact details to respond to your query or concern
You visit the SQW website, leaving information about your computer and visits
You consent to our use of your personal data for marketing or other purposes
Third parties send us data e.g. in relation to research projects or to provide a service to you on behalf of the third party.

4. How we use personal data

SQW's use of personal data will always have a valid lawful basis, either because it is necessary for the firm's performance of a contract, because a data subject has consented to its use (e.g. by subscribing to emails), or because it is in the firm's legitimate interests. Specifically, SQW may use personal data as shown in the table below:

Purpose	Personal Data	Lawful Basis
Provide and manage your access to the SQW website	Name, contact details such as email address, IP address and Cookie Information	Legitimate Interests
Supply consultancy services to your organisation	Name, contact details such as email address, IP address and Cookie Information	Contract Performance
Personalise and tailor services for your organisation	Name, contact details such as email address, IP address and Cookie Information	Legitimate Interests
Reply to emails or telephone calls from you	Name and contact details	Legitimate Interests
Assist with a job application you have submitted	Name, contact details and educational or professional background	Contract Performance
Handle your enquiries or complaints and to provide you with customer services	Name and contact details	Contract Performance or Legitimate Interests
Analyse your use of SQW's website (and gathering feedback) to enable us to continually improve the site and your user experience	Name, contact details such as email address, IP address and Cookie Information	Legitimate Interests
Create respondent lists	Name and contact details	Consent
Sharing with external parties that we have business relationships with	Name and contact details	Consent
Marketing purposes which could  include contacting you by email with information, news and developments in relation to SQW's services	Name and contact details	Consent
Fulfil legal obligations when demanded by administrative, governmental, or judicial authorities.	Name and contact details	Legal Obligation

You have the right to withdraw your consent to SQW using your personal data at any time, please contact us using the details provided in the ‘How you can contact us’ section below.

5. Who we share personal data with

Personal data that we collect or which data subjects provide to us may be shared with and processed by any of member of the SQW Group, so that beneficial services can be offered to the data subject.

We may share personal data with our professional advisors such as our outsourced Data Protection Officer to ensure we provide data subjects with the highest level of data protection and comply with applicable law. Our outsourced Data Protection Officer can be contacted at: dpo@sqwgroup.com

Personal data may also be shared in compliance with our regulatory requirements, such as regulators, law enforcement agencies, government bodies in connection with enquiries, proceedings or investigations when compelled to do so.

SQW may sometimes contract with third parties to supply services to data subjects. In some cases, third parties may require access to some personal data. Where personal data is required for such a purpose, SQW will take all reasonable steps to ensure that the data will be handled safely, securely, and in accordance with the data subject’s rights, SQW's obligations, and the obligations of the third party under the law.

SQW may sometimes share data with third parties that are located outside of the European Economic Area (“the EEA”) (The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein) e.g. suppliers or clients. Where we transfer any personal data outside the EEA, we will take all reasonable steps to ensure that your data are treated as safely and securely as they would be within the UK and under the GDPR.

SQW does not sell personal data in any form, including mailing lists.

SQW never shares personal data with third party marketing companies.

6. How we store personal data

SQW ensures that all personal data is stored locally here in the United Kingdom in compliance with industry standards or in a territory recognised by the United Kingdom as adequate or offering the same level of protection to personal data as that provided in the United Kingdom. Where it becomes necessary to store or transfer personal data outside the United Kingdom, SQW ensures that an appropriate level of privacy and security is applied.

7. How we protect personal data

Data security is very important to SQW, so to protect personal data, the firm has taken suitable measures to safeguard and secure all data it has collected. The information that data subjects provide to SQW is stored on SQW owned servers or those of our service providers. Such personal data may only be accessed in accordance with our Information Security Policy or in accordance with the security standard agreed with our service providers. We also ensure that all of our staff and sub-contractors are contractually obliged to respect the confidentiality of personal data. SQW applies robust access controls to all data to ensure access is restricted. SQW has the Cyber Essentials Plus¹ accreditation.

8. Who is the controller in relation to your personal data.

SQW collects personal data for several business functions. In relation to some of those functions, SQW will be the Controller of your personal data. This may include where we collect personal data to enter contracts, to respond to your queries or concerns, or in relation to personal data we collect as part of our recruitment activities.

Where your personal data have been provided to us by a third-party to enable us to provide a service to them, SQW will be the processor of that data and the Controller will be our client who has provided your data to us. If your data are being collected and processed for research purposes, our clients are the Controllers and are responsible for executing your data subject rights related requests. SQW, as a Data Processor, will liaise and cooperate with them to fulfil such requests.

9. What happens if the ownership of SQW changes

SQW may, from time to time, expand or reduce its business and this may involve the sale and/or transfer of control of all or part of the firm. Any personal data that data subjects have provided will, where it is relevant to any part of SQW that is being transferred, be transferred along with that part of the business. The new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use that data for the same purposes for which it was originally collected by the firm.

10. Your data protection rights

The UK GDPR and DPA 2018 affords you certain rights in relation to how SQW handles your personal data. To exercise these rights, please contact us using the details provided in the ‘How you can contact us’ section below.

We will respond to your requests as soon as possible and, in any case, not more than one month after receiving it if required under law. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. We will keep you informed if this is the case.

How can you access your data?

You have the right to know if SQW processes your personal information and ask for a copy of any of your personal data held by the firm. Under the DPA 2018 and the UK GDPR, no fee is payable, except where an exemption applies. An exception may apply where the request is manifestly unfounded and excessive or further copies of the data provided is being requested. In all other circumstances, SQW will provide all relevant information in response to your request free of charge. Your data rights are set out below. Should you wish to exercise any of your data protection rights please contact us by sending an email to: dpo@sqwgroup.com.

Your right to object

For certain services provided by us, you may be required to provide your contact details to assist us in responding to you. You may decide to withhold such information but doing so may affect what services we are able to provide to you.

Your right to be forgotten

SQW only collects data when there is a legal basis to do so. SQW only holds the minimum amount of personal data required and for a limited amount of time. However, you have the right to request that SQW removes or deletes your personal data from its systems if you believe that:

The firm no longer needs to process your information for the purposes for which it was provided
The firm has requested your permission to process your personal information and you wish to withdraw your consent
The firm is not using your information in a lawful manner
You have objected to your data being processed.

Please note that if you request the deletion of your personal data, we may have to suspend the provision of our services or products to you.

Your right to have data rectified

If you believe that any of the information that SQW holds about you is inaccurate, out of date or incomplete, you have a right to request that the firm restricts the processing of that information and to rectify the inaccurate or incomplete personal information.

Please note that SQW is required by law to ensure the accuracy of its data. SQW therefore, proactively cares about the quality of the personal data it holds and may contact you periodically to verify your information to ensure that our personal data records are up-to-date and accurate.

Your right to data portability

You may request SQW to transfer your data to a third-party in a machine-readable format where the:

Personal information was provided on the basis of consent
Processing is by automated means
Processing is based on the fulfilment of a contractual obligation.

Your right not to be subject of a fully automated decision

SQW does not use automated systems or profiling to make automated decisions about you.

11. How long we keep your personal data for

SQW does not keep personal data for any longer than is necessary considering the reason(s) for which it was first collected. Data will therefore be retained for the following periods (or its retention will be determined on the following bases):

General enquiries - completion of enquiry plus six months
Projects - specifically defined for each project and held within SQW’s Processing Activity Record (PAR) in accordance with the Data Controller’s instructions 
Suppliers (excluding sub-contractors on consultancy assignments) - as per current legislation (seven years)
Employees - most data are held for one year from the last day of employment, but there are some exceptions e.g. bank account details and national insurance number (see the SQW employee privacy notice for details) 
Recruitment candidates - six months
Any other data are kept for as long as is required by applicable law, or deleted or destroyed when no longer required.

12. How you can contact us

Should you have questions concerning your personal information or wish to exercise any of your rights under data protection legislation, you may direct your concerns in the first instance to our Data Protection Officer at: dpo@sqwgroup.com.

13. Your right to complain

If you have a concern about any aspect of SQW’s privacy practices, including the way it has handled your personal information, you may complain to our Data Protection Officer at: dpo@sqwgroup.com.

You are also entitled to complain to the Information Commissioner Office (ICO). We hope that before you do so you would afford us an opportunity to resolve your concern. However, should you feel the need to complain to the ICO, their contact details are provided below:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 1113
casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

14. How we update this Privacy Policy

SQW reviews this Privacy Policy on a regular basis (for example, if the law changes and annually). Any changes will be posted immediately on SQW's website, and SQW recommends that you check the SQW Privacy Notice on the firm’s website regularly to keep up-to-date and to make sure that you are happy with the changes.

[1] About Cyber Essentials - NCSC.GOV.UK