Storing your personal data

Data provided to us is primarily stored and processed within the United Kingdom. Our primary production environment is hosted within the United Kingdom, with our disaster recovery environment hosted separately within Microsoft Azure. Where specific customer, contractual or data sovereignty requirements apply, alternative Microsoft Azure regions may also be used.

Where necessary for the provision of our services, we may transfer or provide access to personal data outside the United Kingdom and/or European Economic Area (“EEA”), including where services are provided by members of our group, associates or suppliers operating in other jurisdictions. Where such transfers take place, we will take appropriate steps to ensure that personal data continues to be protected in accordance with applicable data protection legislation and this Policy.

Data that is provided to us is stored on secure infrastructure. We use a range of technical and organisational measures to protect information against unauthorised access, loss, misuse or disclosure. These measures include, but are not limited to, physical security controls, user authentication, role-based access controls, multi-factor authentication where applicable, encryption, firewall technology, endpoint protection, vulnerability management, security monitoring, audit logging and intrusion detection and prevention controls.

Data transmitted between clients, integrated systems and our services is protected using encrypted communications. Data at rest is also protected through multiple layers of encryption.

The transmission of information via the internet is not completely secure and, while we take appropriate measures to protect personal data, we cannot guarantee the security of information transmitted to us electronically. Any transmission is therefore undertaken at your own risk.

Where we have provided you with, or where you have chosen, a password or other authentication credential that enables you to access certain areas of our services, you are responsible for keeping those credentials confidential and must not disclose them to others. Once we have received your information, we use appropriate procedures and security controls designed to prevent unauthorised access.

Access to systems and information is managed according to business need and least-privilege principles. User access is subject to role-based access controls, audit logging and periodic access reviews, with access removed when it is no longer required.

We maintain defined data retention and deletion processes. Production customer databases are deleted following contract termination and backup data is subsequently removed in accordance with the applicable backup retention schedule.

Disclosing your information

Where applicable, we may disclose your personal information to members of our group. This may include our subsidiaries, our holding company and its subsidiaries. Such organisations may be located within or outside the United Kingdom and/or EEA. Where personal data is transferred internationally, appropriate measures will be taken to protect it in accordance with applicable data protection requirements.

We minimise the use of third parties in the delivery of services involving client data. Where third-party suppliers are required, their involvement is primarily limited to infrastructure and specialist services and is subject to contractual terms intended to protect client data.

Third-party suppliers supporting our services may include host providers, geographically isolated providers, and specialist penetration-testing providers operating under confidentiality arrangements.

We may also disclose your personal information to third parties in the following circumstances:

• Where we sell, transfer or otherwise dispose of any or all of our business and/or assets to a third party.
• Where we are legally required to disclose your information, including in response to applicable legal, regulatory or judicial requirements.
• Where disclosure is reasonably necessary to protect our legal rights or the rights of others.
• To assist with fraud prevention, security investigations or the minimisation of credit risk.
• Where disclosure to a service provider or professional adviser is reasonably necessary for the provision, operation or protection of our services.
• We do not sell customer data or use it outside the services being provided without prior agreement.

Whenever personal information is disclosed, we will take reasonable steps to ensure that it is treated securely and in accordance with this Policy and applicable data protection requirements.

Third-party links

This site may contain links and references to websites or services operated by third parties. Please be aware that this Privacy Policy does not apply to those websites or services, and we encourage you to review the privacy policy of every third-party website you visit.

Cotopaxi Limited is not responsible for the privacy practices, security, availability or content of third-party websites or services.

Data quality

The information we collect and store relating to you should be complete, accurate and current. You have the right to contact us regarding any changes to, or inaccuracies in, personal information that we hold about you. Upon receiving such a request, we will take reasonable steps to review the information and correct it where appropriate.

Where information or source data is supplied to our services by a customer or third-party system, the customer remains responsible for the quality, accuracy and completeness of that source data unless otherwise agreed contractually.

To notify us of any changes or inaccuracies, please contact us using the details supplied in the “Contacting us” section of this Policy.

Access to information

You have the right, subject to applicable data protection legislation, to request access to personal information that we hold about you.

To obtain a copy of the personal information Cotopaxi Limited holds about you, or to exercise another applicable data protection right, please contact us using the details provided within the “Contacting us” section of this Policy.

We may require appropriate information to verify your identity before disclosing personal information, in order to ensure that information is not provided to an unauthorised person.