Privacy policy

Privacy Policy

AvecTelecom Ltd, company registration number 09678813, all information in this document sets out our compliance and use of personal data held in accordance with the new GDPR legislation.  As an telecommunications service provider, we supply phone services that are normally contracted over a period of time, during this time support is also required which will require AvecTelecom to gather information relating to its clients to be able to support them.  This will include data that we obtain from clients directly and data about the company that we obtain from other organisations.

This document sets out what personal or company information data that we hold, why we process or control that data, who we share this information with, and you rights in relation to the data we hold.

GDPR’s focus is on protecting the individual privacy rights of EU citizens, and compared to previous EU privacy legislation greatly expands the definition of what constitutes personal, private data to include not just financial, government and medical records, but also genetic, cultural, and social information. Businesses must now gain the explicit consent of an individual before using their personal data, and must also honour their “right to be forgotten”, i.e., to have all personal data held by the business to be deleted at the user’s request. Usually this would apply at the end of any contracted term or where support is no longer required for the purpose of supporting the client/customer.

AvecTelecom must also meet a number of new requirements to demonstrate our ongoing compliance with GDPR, appointing one individual responsible for the company’s GDPR issues (the so-called “Data Protection Officer”), reporting on any and all data breach incidents, and storing personal data within the physical confines of the EU.

What information do we process in relation to you or the company?

We will collect, hold and share limited information about you or the company in order to provide our services acting as your support provider.

• Personal information (such as name, business address, potential home address if required, business and mobile numbers, email address)
• Login in credentials (such as email access, server management, admin rights for PCs, Router and switch access, wireless control access, backup access)
• Remote management for phone system in order to remotely fix any such problems that occur
• Financial details (such as bank account details for billing purposes)

We may also require third party information in order to support certain products or equipment from you.

Where do we get you data from?

We obtain all the information from you as a client when you agree for us to provide business phone solutions for your business.

We may also obtain information from you from other sources in order to provide support, this is generally only via your businesses authorisation.

Why do we use your company or personal data?

We will process or control your data for the following reasons (not all would be applicable):

• To provide a business phone solution service
• To provide support for phone connectivity
• To provide internet connectivity to the premise
• To provide or obtain additional services including technical advice and/or support for your business
• To communicate support or sensitive information relating to the company
• To enable payments invoiced monthly via our online payment system

Whilst the majority of processing of personal data we hold about the business will not require your consent, we will inform you if your consent is required and seek that consent before any processing takes place.

Understanding GDPR

To understand GDPR as it relates to data storage and data protection, it is useful to understand the following basic terminology:

Data subject 

A citizen of the EU who is identifiable by their personal data. This may include a consumer making an online purchase, a user on an IT resource system, a citizen accessing online services and so on: any individual providing personal information to use some type of services.

Processor

A commercial business like a cloud service provider that acts as a contractor to a controller, i.e., another business serving EU citizens that captures sensitive data on individuals. Examples include application hosters, storage providers, and providers of cloud services like backup.

Right to be forgotten

The right of every EU citizen “to have his or her personal data erased and no longer processed.” Individuals may request the deletion of all of their personal data stored on a controller’s servers and/or on their system management system.

Controller 

A business operating within the EU — or outside of the EU but dealing with EU residents — that captures sensitive data about EU residents in the course of its operations. This include a provider accepting online orders, addressees, and payment information from consumers, this also extends to customer records for any service related request.

Personal data

“Any information relating to an identified or identifiable natural person.” This is more broadly defined by the EU than other governments, and includes the EU citizen’s name, email address, social media posts, physical, physiological, or genetic information, medical information, location, bank details, IP address, cookies, cultural identity, etc.

Personal data breach 

“A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.” Businesses must report every data breach incident to “the supervisory authority” within 72 hours of becoming aware of it.

Privacy Protection Failures

Our ability to attest to the privacy, integrity, accessibility, and erasure of personal data relies in part on our ability to protect against and recovery in personal data and backup.  These failures fall in to three categories:

• Device failures— the physical failure of any storage hardware component, including disk drives, storage controllers, and data centers.
• Security breaches— failures due to forceful, malicious attacks on IT infrastructure, including networks, servers, applications and endpoints, including those by malicious insiders, online criminals, and hostile state actors. Example include: a ransomware attack that applies unbreakable encryption to contents of a hard drive and demands an online payment in return for the decryption key.
• Logical or soft failures— failures due to human errors, Examples include: the accidental deletion or overwriting of files in the course of executing a backup procedure, accidental file data corruption due to a bug or error in a script or business application; accidental deletion of a hard drive’s master boot record.

Your rights of Personal Data we hold

In addition to protecting against various types of data protection failures, and reporting to EU authorities when breaches occur, we as controllers have a number of obligations to the users whose personal data that we are storing. Controllers must support the ability of users to:

• Access, read and edit their personal data
• Easily delete their personal data, either directly or with a simple request to us
• Export their personal data in an easily-readable format

Complying with user requests may not always be simple. For example, it is easy to address clear-cut requests like, “Delete my mailbox and its entire contents”, not so easy to comply with more complex or ambiguous requests, like “Delete all my information form any backups, this will inevitably will be over written when the backup cycle repeats.”

All requests can be submitted to our “Data Protection Officer” Daren Bowes – [email protected]

GDPR Requirements for Data Protection 

We as a business have additional obligations which we must meet, these Include:

• Offer sufficient guarantees that our services meet GDPR technical and organizational requirements
• Eschew the use of subcontractors to support service contracts between the processor and our clients (controllers) without the express consent of the controller
• On termination of a service contract or solution, remove all client data from their cloud and/or data center infrastructure, and provide sufficient proof that we have done so
• Report data breach incidents to the regulatory body.

The EU is serious about enforcing compliance, wielding the threat of painful financial penalties for businesses that cannot demonstrate their compliance or are caught in clear violation of GDPR rules protecting user privacy. For example, failing to maintain written records, to implement various technical and organizational measures, and/or to appoint a Data Protection Officer can cost the offending business a fine of €10 million or 2% of annual global revenue (whichever is greater). Broadly speaking, to achieve GDPR compliance in the areas of data storage and data protection, processors and controllers should only use services solutions that meet the following technical requirements:

• Data subject control of personal data storage location.We must be able to honour the wishes of the individuals whose data we control or process as to where their personal data is stored
• Ability to modify personal data. We should be able to easily copy, modify and delete personal data at the request of data subjects.
• Data export in a common format. We should be able to export personal data in a common and easily usable format.
• Right to be forgotten. When data is no longer relevant to its original purpose, data subjects must be able to demand that a controller erase their personal data on request.
• Data portability. Data subjects must be able to obtain and reuse their personal data for their own purposes by transferring it across different IT environments. This requires the ability to download personal data in an easily-portable format.
• Data Protection Officers. One employee who owns ultimate responsibility for GDPR compliance, known as the Data Protection Officer

Third party Solutions

As part of our day to day activities, it’s normal practise to use third party providers to deliver some of the services that we offer, such as VoIP connectivity, internet service and line rental.  As such, it’s our responsibility to use providers that fully comply with the new legislation and work with us to protect any data that we may use in order to provide such services.

Below is a list of service providers we use to deliver some of our services, not all services listed would be applicable to all our customers and would only be used as general information. The Important element is to demonstrate our responsibility for GDPR compliance and our commitment to only use providers that have clear policies in-place to protect avecSys and our customers.

SipSynergy

www.sipsynergy.co.uk/about/gdpr/

We are confident that we are fully compliant in readiness for when the General Data Protection Regulation (GDPR) becomes law in the UK on 25^th May 2018. If you require any further information or have any questions regarding data protection, please feel free to contact our data protection officer or call 01234 866688.

AvecTelecom Ltd

27 Mill street

Bedford

Mk40 3EU