Privacy Statement

Date last revised: October 2024

TRAMS LIMITED (we/us/our) are committed to respecting your privacy and protecting your personal data. We recognise that your personal data is your property and that you have loaned it to us for specific purposes.

Unless otherwise required by law, the Information Commissioner’s Office (ICO) guidance or best practice, or in order to perform our contract with you, we will only process your personal data in the way we tell you or in the way you ask us to, and we will give it back to you at any time.

1. THIS POLICY

1.1 This policy, together with our terms and conditions on our website at www.trams.co.uk (our Website) and any other documents we provide to you as part of your trading relationship with us, sets out how we will process your personal data.

1.2 This policy applies to our contract with you. You are therefore advised to read it carefully. Terms used within it shall have the meaning(s) given in the Data Protection Act 2018 (Act) and/or the General Data Protection Regulation (Regulation), as applicable.

1.3 By visiting our Website, or by providing your personal data to us, you understand, accept and consent to the practices described in this policy.

1.4 Any changes we make to this policy will be posted on this page. You are advised to check back frequently as, unless your consent is required, any changes will be binding on you when you continue to use the Website or work with us after the date of the relevant change.

1.5 For more information relating to your rights under this policy, please see section 9.

1.6 If you have any queries relating to this policy, please contact us at privacy@trams.co.uk in the first instance.

2. WHO WE ARE

2.1 For the purposes of the Data Protection Act 2018 (Act), the data controller is Trams Limited, a company registered in England & Wales (number 02518864) with its registered office at 33 Queen Street, 4th Floor, London EC4R 1AP.

2.2 We are registered with the ICO to process your personal data and our registration number is Z5998485.

2.3 Our nominated data protection officer is Gavin Bell, CEO.

2.4 Your personal data will be held and stored by us in our internal management information systems and allocated to your own customer portal within that system. All personal data is processed by UK based staff who are regulated by our internal staff data protection policy. All of our IT systems are ISO 9001 certified, and all of our staff receive appropriate training and are required to receive appropriate accreditation as part of their induction process.

2.5 Our internal email systems are held on Cloud-based servers located in the UK. Our document management system is also Cloud-based, with servers located in Amsterdam, The Netherlands.

2.6 Any personal data you provide to us through our TramsCloud® platform is held through Amazon Web Services, Inc, who we have engaged on their terms and conditions. More information is available at https://aws.amazon.com/.

3. YOUR CONSENT

3.1 We do not ordinarily rely on your consent to process your personal data. We process your personal data primarily to perform our contract with you, and we consider the personal data we obtain is reasonable and necessary for that purpose.

3.2 By using our Website and/or working with us, you expressly consent to:

3.2.1 the transfers of your personal data to those specifically listed third parties in this policy, for the reasons specified; and
3.2.2 us, and/or our affiliated companies listed in this policy, using your personal data for direct marketing purposes.

3.3 You may exercise your rights under section 9 at any time, which includes withdrawing your consent to our processing of your personal data. However, where this withdrawal prevents us from performing our contract with you, we may not be able to provide our goods and services to you.

4. WHAT WE COLLECT

4.1 We collect the following categories of data from our staff, customers, clients and suppliers (whether actual or potential):

  • Full name
  • Age and date of birth
  • Home address
  • Bank and credit card details
  • Nationality
  • Email address
  • Telephone number (work, home or mobile)
  • Technical information about your Website visit (see section 5.2)

4.2 Where you are a current, potential or former employee, worker or other member of our staff, we may collect additional categories of your personal data from you for the purposes of providing you with the necessary benefits under our contract with you. In those circumstances, a separate privacy notice applies and a copy is available on request.

4.3 We consider that all categories of personal data we obtain are proportionate and relevant to the purposes for which they are obtained. However, we review this intermittently and remove any inaccurate or obsolete data.

4.4 We use CCTV at some of our premises for the protection of our staff and property, and for the prevention and detection of crime, and we are registered with the ICO to process your data in this way. If you visit us at these premises, your biometric data will be taken during your time on site and this will be stored and retained by us in accordance with our internal data retention policy.

5. HOW IT IS COLLECTED

The categories of data listed in section 4 are collected in the following ways:

5.1 When you provide it to us

  • Your personal data is primarily provided to us when you correspond with us by phone or e-mail as part of our business with you. Any of your personal data contained in that correspondence will be retained by us.
  • Where you complete any of our forms at one of our events, seminars or presentations, or when attending an exhibition when we are present, any personal data you put down on that form will be retained by us. Following your registration to one of our events, your details might be shared with fellow registered attendees, through event emails or calendar invites. This is for event based information only and data cannot be used by recipients.
  • Any personal data you give to us in meetings may also be retained by us.
  • Where you provide any personal data relating to you or your staff through the TramsCloud® platform

5.2 When we collect it from you

  • As part of our customer or supplier engagement process, we may send you our Trading Account Form or purchase order (in .pdf form) via email for you to complete and send back to us. This is necessary for us to administer our trading relationship with you and any personal data you give us will be retained by us.
  • When you use our Website, we will automatically collect technical information about the device you use to visit, including your IP address, browser type/version and related settings.
  • We also monitor your use of our Website. This includes the full URLs, your clickstreams through our Website, the pages you view and how you interact with them and how you leave the Website.

5.3 When we receive it from others. On occasion, your personal data may have been stored on third party databases and passed to us by those third parties. We do this for marketing purposes (in relation to the products we offer) on the terms of a written agreement with those third parties. In those circumstances, the relevant third party confirms to us that you have expressly consented to them holding your data and transferring it specifically to us for the reasons we require it.

5.4 The following third parties provide your personal data to us, or we disclose it to them for the reasons listed:

  • Go Demand Limited, a company registered in England & Wales (number 08795339) with its registered address at 1 Church Terrace, Yeovil, Somerset BA20 1HX and whose website is available at http://go-demand.co.uk/ - they provide us with your personal data for marketing purposes;
  • Spotler Limited, a company registered in England & Wales (number 05419529) with its registered office at 3 The Billings, Walnut Tree Close, Guildford, Surrey, GU1 4UL and whose website is available at - https://spotler.co.uk - they provide an analytics service based on Website use;
  • Econocom Limited, a company registered in England & Wales (number 03517197) with its registered address at 33 Queen Street, 4th Floor, London, England, EC4R 1AP and whose website is available at https://www.econocom.co.uk/ - they are the majority owner of Trams Ltd and we share personal data for marketing purposes.
  • The Education Company Limited, a company registered in England & Wales (number 02651241) with its registered address at Riverside House, Sir Thomas Longley Road, Rochester, Kent ME2 4FN and whose website is located at http://www.educationcompany.co.uk/ - we subscribe to their database to invite people who we think may be interested in our events;
  • NMR Consultancy Limited, a company registered in England & Wales (number 07970800) with its registered office in the same building as us and whose website is located at http://www.nmr.com – they are a subsidiary company of ours and we share information with them to pursue our legitimate business interests (such as offering co-branded services or co-operative online marketing);
  • Altered Pixel Limited, a company registered in England & Wales (number 05684108) with its registered office on Finsgate, 5-7 Cranwood Street, London EC1V 9EE who handle our marketing services (where you have consented to it, which you may withdraw at any time).

6. WHAT WE USE IT FOR

6.1 Your personal data is primarily required to enable us to administer our trading relationship with you, and to supply you with the relevant goods, services and support you have requested from us, such as any enquiries or requests you raise with us.

6.2 We also use your personal data to send you information by email about us, our products and our services that are similar to those you have already purchased or enquired about. We only do this where you have given us permission to do so, and you can opt-out at any time. Where you opt out, we will no longer contact you until you ask us to, and we will not prompt you to do so.

6.3 Technical information we collect about your visit to our Website is used to enable us to:

  • personalise and improve its functionality and security (to keep it safe and secure);
  • administer and monitor traffic and behaviours on our Website for analysis, testing, research, statistical and survey purposes; and
  • ensure that we can offer you the most effective and efficient browsing experience, and make improvements where necessary.

6.4 Where we change our services, or any applicable terms and conditions, we will contact you.

6.5 Once collected, your personal data will be retained by us for as long as is necessary for us to provide you with the relevant goods and services, to market our services to you (where requested) and to enable us to improve our Website. Typically, this can be up to 12 months following the termination of our business relationship with you or your last visit to our Website, but this may vary depending on your circumstances.

7. SECURITY

7.1 Access to any personal data held within the TramsCloud® platform is limited to engineers or contractors who specifically require such access in order to support you. Access to any backup databases is further limited only to senior engineers who require such access to support the platform. All access is logged and protected by multi-factor authentication and default encryption.

7.2 Access to the TramsCloud® platform is web-based, via authentication software. All passwords are held securely and any access to back-end servers requires this as well as user-based authentication. Staff have access only for the purposes of performing their roles.

7.3 All data stored within the TramsCloud® platform is encrypted by default.

7.4 We have appropriate data monitoring systems on the TramsCloud® platform which monitor and track data flows, and we audit this for signs of a breach.

8. HOW AND WHY WE DISCLOSE YOUR DATA

8.1 Subject to the rest of section 8 of this policy, the only third parties with or to whom we disclose or receive your personal data are those listed in section 5.4, for the purposes listed in that section.

8.2 Any websites which are linked from the Website are outside of our control and not covered by this policy. If you access those websites using the links provided, the website operators may collect information from you which will be used by them in accordance with their own privacy policies (if any). These policies may differ from ours, and we cannot accept any responsibility or liability in respect of these.

9. YOUR RIGHTS

9.1 In relation to all of your personal data, you have the following rights (in addition to any rights you may have under the Act or the Regulation) to ask us:

9.1.1 not to process your personal data for marketing purposes;
9.1.2 to clarify what data we hold about you, how it was obtained, to whom it has been disclosed and for how long it will be stored;
9.1.3 to amend any inaccurate data we hold about you;
9.1.4 to delete any of your data (where you no longer think we need to hold it, or you think we have obtained or processed it without your consent at any time); and
9.1.5 to only process your personal data in limited circumstances, for limited purposes.

9.2 We have the capacity to extract your personal data from our databases and provide it to you in a structured, commonly-used way (typically by .csv file).

9.3 If you wish to exercise any of your rights at any time, please contact us on the details contained at the beginning of this policy in the first instance. We will require you to verify your identity to us before we provide any personal data, and reserve the right to ask you to specify the types of personal data to which your request relates.

9.4 Where you wish to exercise any of your rights, they may be subject to payment of a nominal administration fee (to cover our costs incurred in processing your request) and any clarification we may reasonably require in relation to your request. Such fees may be charged where we consider (acting reasonably) that your request is excessive, unfounded or repetitive.