Website Privacy Policy

References to the United Kingdom General Data Protection Regulation (UK GDPR) in the jurisdiction of the European Union (EU) and European Economic Area (EEA) are instead references to the EU General Data Protection Regulation (EU GDPR). The UK GDPR and the EU GDPR contain the same rules but apply to EU and the UK respectively.

The person responsible within the meaning of the data protection laws, in particular the UK GDPR, is:

Thornton and Ross Limited
Manchester Road
Huddersfield
HD7 5QH
Phone: + 44 (0)1484 842217

Questions to the Data Protection Officer

If you have any questions about data protection, please write us an e-mail or contact the person responsible for data protection in our organisation directly:

Data Protection Officer of Thornton & Ross Ltd
c/o activeMind.legal UK Ltd.
No 1 Royal Exchange
London, EC3V 3DG
Registered #11814518

Phone: +44 20 89383608
E-mail: [email protected]

Your Data Subject Rights

You can exercise the following rights at any time using the contact details provided by our Data Protection Officer:

• Information about your data stored by us and its processing (Art. 15 UK GDPR),
• Correction of inaccurate personal data (Art. 16 UK GDPR),
• Deletion of your data stored with us (Art. 17 UK GDPR),
• Restriction of data processing if we are not yet allowed to delete your data due to legal obligations (Art. 18 UK GDPR),
• Objection to the processing of your data by us (Art. 21 UK GDPR) and
• Data portability, provided you have consented to the data processing or have concluded a contract with us (Art. 20 UK GDPR).

If you have given us consent, you can revoke this at any time with effect for the future.

You can contact a supervisory authority at any time with a complaint.

For the UK: https://ico.org.uk/make-a-complaint/

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

For the EU: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Collection of General Information when Visiting our website

Nature and Purpose of the Processing

When you access our website, i.e., if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and the like.

In particular, they are processed for the following purposes:

• Ensuring a smooth connection with the website,
• Ensuring a smooth use of our website,
• Evaluation of system security and stability, and
• To optimise our website.

We do not use your data to draw conclusions about your person. Information of this kind is evaluated anonymously by us statistically, if necessary, in order to optimise our website and the technology behind it.

Legal Basis

The processing is carried out in accordance with Art. 6 (1) (f) UK GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

Recipient

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Storage Period

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is generally the case for data used to provide the website when the respective session has ended.

In the case of storage of data in log files, this is the case after 30 days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are anonymised so that it is no longer possible to assign the calling client.

Provision Prescribed or Required:

The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be restricted. For this reason, an Objection is excluded.

Webinars

Nature and Purpose of the Processing

The personal data provided during registration is processed exclusively for the purpose of conducting webinars.

Legal Basis

The legal basis for this is, in the case of free webinars, is our legitimate interest (Art. 6 para. f) GDPR). Our legitimate interest is the practicable and user-friendly implementation of the webinar, including a good user experience for the purpose of external presentation of the company. For paid webinars, the legal basis is Art. 6 para. b) GDPR.

Recipient

Recipients are technical service providers for the implementation of the webinar within the framework of commissioned processing.

All service providers are contractually obligated to treat your data confidentially.

Third Country Transfer

Processing only takes place within the UK.

Storage Period

Data will be deleted no later than 6 months after processing the request.

If a contractual relationship is established, we are subject to the statutory retention periods and your data is deleted 2 years after it is no longer required for the purpose for which it was collected.

Provision Prescribed or Required:

You are not legally or contractually required to provide your personal data. This means that you are not obligated to provide us with your personal data. If you decide not to provide us with your personal data, however, we can only offer the webinars if we can carry out the associated processing.

Right to object

Please read the information about your right to object according to Art. 21 GDPR below.

Account

Nature and Purpose of the Processing

There is a Webinar Portal integrated into our website. In order to access the Webinar Portal, a log-in is required, whereby certain personal data such as name, contact and communication information (e.g. e-mail address), and password are collected. You are also able to provide us with your work address. Your work address will help us verify that you are a UK Healthcare Professional and improve your customer experience with us.

Legal Basis

Given that the underlying processing is necessary to fulfil the obligations stemming from a contract with our customers, the legal basis for this data processing is Art. 6(1)(b) UK GDPR.

Recipient

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Storage Period

Data are only processed as long as they are necessary for the fulfilment of the contract. Thereafter, they will be deleted, unless there is a statutory retention obligation contradicting the deletion.

Provision Prescribed or Required:

The provision of the aforementioned personal data is neither legally nor contractually required. However, without the provision of your personal data, we cannot give you access to our Webinar Portal.

Contact Form and Contact via Mail and Telephone

Nature and Purpose of the Processing

The data you enter will be stored for the purpose of individual communication with you. For this purpose, it is necessary to provide a valid e-mail address as well as your name and, if applicable, telephone number. This is used for the assignment of the enquiry and the subsequent response to it. The provision of further data is optional.

Legal Basis

The processing of data entered in the contact form for the explanation of data subject enquiries and for contact via mail and telephone is based on a legitimate interest (Art. 6 (1)(f) UK GDPR).

By providing the contact form for the declaration of data subject enquiries and the possibility to contact us via email or telephone, we would like to enable you to contact us in an uncomplicated manner. The information you provide will be stored for the purpose of processing the enquiry and for possible follow-up questions.

If you contact us to request an offer, the data will be processed to carry out pre-contractual measures (Art. 6 (1)(b) UK GDPR).

Recipient

Recipients of the data are, if applicable, data processors.

Storage Period

Data will be deleted at the latest 6 months after processing of the request.

If a contractual relationship arises, we are subject to the statutory retention periods according to the applicable laws and delete your data after these periods have expired.

Provision Prescribed or Required:

The provision of your personal data is voluntary. However, we can only process your request if you provide us with your name, e-mail address or telephone number and the reason for the request.

Zoom

Nature and Purpose of the Processing

To conduct the live webinars, we use the webinar solution of the Zoom video conferencing tool. The tool is precisely tailored to the needs of conducting a webinar. It allows effective delivery of content to a larger number of participants over the Internet and helps maintain the quality of the webinars. Following the webinar, we may provide participants with the presentation and additional information via a download link.

A detailed list of the categories of data collected and processed by Zoom, as well as the exact purpose of the processing in each case, can be found at: https://zoom.us/privacy.

Zoom offers administrators the possibility to make extensive settings relevant to data protection. We configure the tool in such a way that only the personal data that is absolutely necessary for the implementation of the webinar is processed and that the collected data is protected in the best possible way. In this way, we enable the most data protection-friendly and secure use possible.

The guarantee of an acceptable level of data protection is realized by means of end-to-end encryption enforced by the system. This limits the transmission of data to the service provider to the data provided by the user during registration and the metadata associated with participation in the seminar. The registered user is responsible for the data he or she discloses during registration. Pseudonymous use is generally possible. Further information on encryption technology can be found here.

Live webinars are recorded but no personal details will be included on the recording.

Legal Basis

Zoom is used on the basis of a legitimate interest (Art. 6 Para. 1 lit. f UK GDPR) in the practical and user-friendly implementation of the webinar, including a good user experience for the purpose of client acquisition and external presentation of the company.

Recipients

Recipients also include technical service providers. In the case of the Zoom Webinar solution, Zoom Video Communications, Inc, 55 Almaden Blvd, Suite 600, San Jose, CA 95113. More information on the handling of user data can be found in Zoom´s privacy policy: https://explore.zoom.us/en/privacy/.

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Third country transfer

When using Zoom, your data will be transmitted to the USA. There is currently no adequacy decision for the USA. We have concluded standard contractual clauses with Zoom in order to implement adequate data protection regulations and to adequately protect your data even after transfer.

Storage period

Data is only collected by us in the context of the respective live session. The recording enabled by the system via Zoom is prevented for all participants. Registration data is deleted after the end of the session. This usually takes place after a maximum storage period of 6 months in our system.

Provision Prescribed or Required:

The provision of your personal data is voluntary. We can only offer the webinar if we can carry out the associated processing.

Right to object

Please read the information about your right to object according to Art. 21 DSGVO below.

Cookies

Like many other websites, we also use so-called "cookies". Cookies are small data sets that are stored on your end device (laptop, tablet, smartphone or similar) when you visit our website.

You can delete individual cookies or the entire cookie inventory. In addition, you will receive information and instructions on how to delete these cookies or block their storage in advance. Depending on the provider of your browser, you will find the necessary information under the following links:

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Internet Explorer: https://support.microsoft.com/en-gb/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d
• Google Chrome: https://support.google.com/accounts/answer/61416?hl=en
• Opera: https://www.opera.com/help
• Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac

If you allow us to use cookies through your browser settings or consent, the following cookies may be used on our websites:

Technically Necessary Cookies

Nature and Purpose of the Processing

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

Legal Basis

The processing is carried out in accordance with Art. 6 (1)(f) UK GDPR on the basis of our legitimate interest in a user-friendly design of our website.

Recipient

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Provision Prescribed or Required:

The provision of the aforementioned personal data is neither legally nor contractually required. However, without this data, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be limited.

Right to object

Please read the information about your right to object according to Art. 21 DSGVO below.

Plausible

Nature and Purpose of the Processing

We use the open-source program Plausible to count website visits, downloads, etc. For this purpose, Plausible collects the following information, among others: Date and time of your visit, title and URL of the pages visited, incoming links, the country you are in and the user agent of your browser software. Plausible does not use or store "cookies" on your terminal device. All personal data (e.g., your IP address) is stored completely anonymously in the form of a so-called hash. A hash is an encryption of data that is not reversible, i.e., cannot be "decrypted". In this way, we can analyse your visit without storing personal data in a form that would be readable for us, plausible or third parties.

Legal Basis

The processing is carried out in accordance with Art. 6 (1) (f) UK GDPR on the basis of our legitimate interest in improving our website. At no time does the data we collect allow us to draw conclusions about an identifiable person.

Recipient

Data is transferred to the provider Plausible. For more information on data processing at Plausible, please visit: https://plausible.io/privacy and https://plausible.io/data-policy.

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Third Country Transfer

Processing only takes place inside the EU.

Provision Prescribed or Required:

The provision of the aforementioned personal data is neither legally nor contractually required.

Right to object

Please read the information about your right to object according to Art. 21 DSGVO below.

Vimeo

We use the provider Vimeo for the integration of videos. Vimeo is operated by Vimeo, LLC, 555 West 18th Street, New York, New York 10011, USA.

On some of our web pages, we use plugins from the provider Vimeo. If you have given your consent and call up a sub-page of our website that is provided with such a plugin, a connection is established to the Vimeo servers and the respective video is loaded. This transmits to the Vimeo server which of our Internet pages you have visited. If you are logged in as a member of Vimeo, Vimeo assigns this information to your personal user account. When using the plugin, such as clicking on the start button of a video, this information is also assigned to your user account. You can prevent this assignment by logging out of your Vimeo user account before using our website and deleting the corresponding cookies from Vimeo.

Legal Basis

The purpose of the processing is to be able to provide you with videos about our activities. The legal basis for this processing is your consent pursuant to Art. 6 (1) a) UK GDPR. You can revoke your consent at any time with effect for the future.

In this context, your personal data will only be processed until the purpose of the processing no longer applies or until you have revoked your consent.

Recipient

Data is transferred to the provider Vimeo. More information on the handling of user data can be found in Vimeo's privacy policy: https://vimeo.com/privacy.

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Third Country Transfer

When using Vimeo, your data will be transmitted to the USA. There is currently no adequacy decision for the USA. We have concluded standard contractual clauses with Vimeo in order to implement adequate data protection regulations and to adequately protect your data even after transfer.

Provision Prescribed or Required:

The provision of your data is voluntary, based on your consent. Without the provision of the data, we can unfortunately not provide you with videos.

Withdrawal of Consent:

You can revoke your consent at any time. Revoking consent will mean you cannot watch any on-demand webinars or attend any live webinars.

Information about your Right to Object According to Art. 21 UK GDPR

Objection on a Case-by-Case Basis

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6(1)(f) UK GDPR (data processing on the basis of a balance of interests); this also applies to profiling based on this provision within the meaning of Art. 4 (4) UK GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Recipient of an Objection

Thornton and Ross Limited
Manchester Road
Huddersfield
HD7 5QH

Email: [email protected]
Website: www.thorntonross.com

SSL encryption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

Changes to Our Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or in order to implement changes to our services in the privacy policy, e.g., when introducing new services. The new privacy policy will then apply to your next visit.