1. Who we are and principles
In line with OFE’s commitment to openness, we want to be transparent about the personal data which we collect, as well as where and how we use that personal data.
OFE does not monetise or sell any of your personal data. We may collect personal data that is necessary to provide services (such as this website, our newsletter or the events which we organise). You can use our website without indicating any personal data, however if you want to use special services via our website, processing of personal data might become necessary.
2. Collection of data and information for operating the website
The OFE website collects general data and information whenever a data subject or automated system calls up the website. This general data is stored in the server log files. The following may be collected: (1) the browser types and versions used; (2) the operating system used by the accessing system; (3) the website from which an accessing system reaches our website (so-called referrers); (4) the sub-websites; (5) the date and time of access to our website; (6) the user’s Internet protocol address (IP address); (7) the Internet service provider serving the accessing system; and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.
When using these general data and information, OFE does not draw any conclusions about the data subject. Rather, this information is needed to: (1) deliver the content of our website correctly; (2) optimize the content of our website; (3) ensure the long-term viability of our information technology systems and website technology; and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, OFE analyzes anonymously collected data and information statistically, with the aim of increasing both data protection and data security, and to ensure an optimal level of protection for the personal data we process. Anonymous data contained in the server log files are stored separately from all personal data provided to OFE by a data subject.
You may at any time prevent the setting of cookies through our website by configuring the settings in your internet browser so as not to accept cookies. Additionally, you can delete previously-set cookies in your browser. If you deactivate the setting of cookies, some functions may not be entirely usable anymore. You can find information how to configure all popular internet browsers on this external website: http://www.allaboutcookies.org/manage-cookies/
4. Comment function on this website
OFE offers users the possibility to leave individual comments on individual pages, which are on the website of the controller. If a data subject leaves a comment on a page published on this website, the comments made by the data subject are also stored and published, as well as information on the date when the comment was added, and on the user’s (pseudonym) chosen by the data subject. In addition, the IP address assigned by the data subject’s Internet service provider (ISP) is also logged. This storage of the IP address takes place for security reasons, and in case the data subject violates the rights of third parties, or posts illegal content through a given comment. The storage of these personal data is, therefore, in the data controller’s own interest, so that the controller can exculpate itself in the event of such an infringement by a contributing data subject. This collected personal data will not be passed to third parties, unless such a transfer is required by law or serves the aim of supporting the data controller’s ability to defend itself.
On the OFE website, users are given the opportunity to subscribe to our newsletter. It is not necessary to enter more than the e-mail address the newsletter should be delivered to. The newsletter can be read completely anonymously via the archive button on the website, though in this case no new newsletters will be delivered upon release.
After sign-up, a confirmation e-mail will be sent to the e-mail address provided by a data subject for the first time to receive OFE’s newsletter (using the “double opt-in” procedure). OFE will use this confirmation e-mail to determine whether the owner of the e-mail address as the data subject is authorised to receive the newsletter.
The personal data collected as part of a registration for the newsletter will only be used to send our newsletter. Personal data collected for the newsletter service will only be transferred to MailChimp, our newsletter provider. The data subject may terminate his or her subscription to our newsletter at any time. The data subject’s consent to the storage of personal data, which the data subject has given for distribution of the newsletter, may be revoked at any time. Each newsletter contains a link which may be used by the data subject to record such revocation of consent.
OFE’s newsletter e-mails may contain so-called ‘tracking pixels’. A tracking pixel is a miniature embedded graphic which is sent in HTML format to enable log file recording and analysis. This allows a statistical analysis of usage of the newsletter. Based on the embedded tracking pixel, OFE may see whether and when an e-mail was opened by a data subject, and which links in the e-mail were called up by data subjects.
Data subjects are entitled at any time to revoke their previously indicated declarations of consent. After any such revocation, the relevant personal data will be deleted by OFE. OFE automatically regards a withdrawal from the OFE newsletter recipient list as a revocation of consent.
OFE uses MailChimp to deliver OFE’s newsletters. MailChimp is a provider of mass e-mail sendouts. MailChimp operates the collection of contact data via the OFE website sign-up form. It stores contact data for the OFE newsletter. It also performs the sendout of the newsletter itself. There is the possibility for MailChimp to transfer your data to a sub-processor of MailChimp. MailChimp operates outside the EEA. It has certified its agreement with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. OFE has signed a data processing addendum with MailChimp to ensure the lawful usage of personal data.
6. Data protection for job applications
OFE shall collect and process the personal data of job applicants for the purpose of the processing to operate the application procedure. This processing may also be carried out electronically. This is the case, in particular, if an applicant submits documents by e-mail in connection with an employment or similar application. If OFE concludes an employment contract with an applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If no employment contract is concluded with the applicant by OFE as the controller, the application documents will be erased two months after notification of the refusal decision, provided that no other legitimate interests of the controller are opposed to the erasure.
7. Links to other websites
8. Usage of social media buttons
The OFE website has integrated social media buttons to allow you to share a web page on popular social media sites. These buttons are configured in such a way that they are not active before they have been clicked by you. This means that no personal data is being processed before you explicitly interact with those buttons by clicking them.
Using social media buttons is completely optional while using the OFE website, but when they are being used, personal data may be processed by these third party social media platforms. After having clicked such a button the personal data processing is happening outside the control of OFE and under the control of the respective social media platform. We do not process or store any data in relation to this activity.
9. Usage of PrintFriendly
The OFE website has integrated components of PrintFriendly. PrintFriendly improves the quality of PDFs of web pages, created for printing, downloading or sharing. It also enables and improves the sharing web pages via email. The usage of PrintFriendly is completely optional and the OFE website can be used without limitations if you do not want your data to processed for this purpose by not using the PrintFriendly service.
When used, PrintFriendly collects personal data when it is necessary to serve the legitimate interests of the individual users. When an individual emails a PrintFriendly page, email address(es) and optional message are required to generate/send the email. This data is encrypted and sent to the data processor (SendGrid) via API to immediately send the email. Email addresses and message is never saved/stored on PrintFriendly servers. If the PDF feature is used, the page content is sent to our server to generate the PDF (“legitimate interest”). We temporarily store the PDF (up to 60 minutes) so you can access/download the PDF, then the PDF is permanently deleted.
PrintFriendly does not collect names, addresses, other individual information, IP addresses, geo information and does not perform web analytic tracking, individual tracking.
10. OFE’s legal basis for processing your data
- Contract: to consider potential or to fulfil an actual contract with you. If you are not able to provide this data, it is possible that OFE will be unable properly or fully to perform its side of any contract with you. This processing is based on Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”);
- Legitimate Interest: in order to consider potential or to fulfil actual contracts with you and others, OFE needs to collect and process personal data about you. This processing is based on Article 6(1)(f) of the GDPR;
- Legal obligation: to satisfy a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations. This processing is based on Article 6(1)(c) of the GDPR;
- Consent: also, OFE may rely on your specific consent for it to use your personal data. You may revoke any such consent at any time, as specified in the second paragraph of section 12 (Data Retention + Termination of Processing) immediately below, and subject to the provisions of that section 12. This processing is is based on Article 6(1)(a) of the GDPR.
11. Data Retention and termination of processing
OFE does not keep your personal data for longer than is necessary for the purpose of the processing. Due to legal obligations, we may hold and process your data for a maximum of seven (7) years from the date when you last interacted with OFE’s services. In this context, “interact” means being (or contemplating being): (i) involved with OFE’s activities (including but not limited to events which OFE organises); or (ii) on a distribution list for receipt of OFE-produced communications (such as the OFE newsletter).
In any event, OFE will stop the processing of your data where you ask OFE to do so by contacting OFE: (i) by email, via the email address stated below; or (ii) in writing, addressed to the postal address stated below.
Please note that OFE reserves the right not to discontinue such processing in any situation to the extent (only) that OFE has:(i) a legal obligation; (ii) a contractual obligation; or (iii) a legitimate interest, to continue processing your data.
12. Your rights
Applicable data protection legislation gives you a number of specific rights, which include the following:
- a right to data erasure;
- a right to make a “subject access request” (i.e., a request for a copy of the data which we hold about you); your right of access can be exercised in accordance with applicable data protection legislation;
- a right of correction (or, where appropriate, erasure) of data which we hold about you where this is inaccurate;
- a right to data portability;
- a right to withdraw your future consent to our processing your personal data;
- a right to contact and make enquiries of our data protection co-ordinator, who can be contacted as follows:
- by email: via firstname.lastname@example.org; or
- in writing, addressed to: OFE Limited at 73 Hillside Road, Ashtead. Surrey. KT21 1SD, UK; and
- a right to complain to the UK Information Commissioner’s Office (sometimes referred to as the ‘ICO’).
If you exercise any of the above-listed rights, please be aware that in order to protect your privacy, OFE may require you to undergo some verification tests to make certain that OFE is dealing with you (rather than with an impostor).
You have the right to ask OFE not to process your personal data for marketing purposes. However, it is not OFE’s practice (and OFE does not intend) either to use your data for any such purpose or to disclose your information to any third party for any such purpose. You can exercise your right to prevent such processing by contacting OFE and so informing OFE; to do that, please contact OFE either via email or physical mail, as stated in the beginning of this policy.
13. Automated decision-making
OFE does not employ automated decision-making or profiling.