Edward James Associates trading as Tickling Trout®; (“we”, “our”, “us”) are committed to protecting and respecting your privacy. Any information you provide will remain our property and under no circumstances will it be sold or rented to a third party.

This policy explains how we might collect any personal data from you and how we will process it.

Should you wish to contact our data controller, who is registered with ICO with any queries you can do so via email or writing to The Data Controller, Edward James Associates, Amphion House, Picket Piece Hampshire UK SP11 6LU.

We will only collect information about you that we need to in order to provide you with a service or enquiry. We have to hold the details of the people who have requested the service in order to provide it. However, we only use these details to provide the service the person has requested and for other closely related purposes.

We collect a variety of information depending on which service you are using. The information you give us may include your name, address, e-mail address and phone number, organisation and payment details.

We also collect personal information about your interactions and transactions with us, including any actions through monitoring and recording any contact we have with you by telephone, email or online for purposes including security, dispute resolution and training.

This may arise from you filling in forms on our site www.ticklingtrout.com (our site)

We use Secure Sockets Layer (SSL) certificates on our website that encrypts the transmission of data to and from your browser. While we use strong encryption, both when your information is moving to or from our web services and also whilst your information is held by us, unfortunately, the transmission of information via the internet can never be completely secure.

Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

This website is built using WordPress. You can learn more about their privacy here. The website is hosted within the EU (Amsterdam, Netherlands). All physical hosting facilities are protected by 24×7 human security, biometrics, access control man traps, bulletproof lobbies, and video surveillance.

We keep all WordPress core software and plugins up to date and use a variety of security tools to mitigate against and monitor security breaches.

When you call us we collect Calling Line Identification (CLI) information. We use this information to help improve efficiency and effectiveness. You have the right to withhold your number before placing a call to us. We reserve the right to record calls for data protection and training purposes.

We do utilise VOIP technology and have the capability of record calls, which are stored securely in our CRM system

On occasions, our calls are handled by a third party. The third-party company resides in the UK and is fully GPR compliant.

The third-party telephone System is an Avaya telephone system. As a general rule the third party do not record calls but instead, use a Messaging System to relay the information to us.

The messaging system is called ‘nCall’ (developed by nSolve) to deliver our messaging to you. http://www.nsolve.com has issued a statement:

Data security

“With the exception of passwords, data stored in the nCall.fdb file, is not encrypted for reasons of performance. The nCall database file (and backups on the server) are only accessible by trustworthy persons/3rd parties.”

To that end, each member of the third party call answering team is bound by their Contract of Employment to protect your data. They are forbidden to remove anything from the office. Each employee has a personal login to the nCall messaging system to ensure there is a clear audit trail. Each PC is password protected. The messaging system security is complete.

We use Google Workspace to process emails. Google uses encryption to protect data in transit and at rest. Data in transit to G Suite is protected using HTTPS, which is activated by default for all users.

Google Workspace and Google Cloud Platform services encrypt customer content stored at rest, without any action required from customers, using one or more encryption mechanisms. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

Access to our email is protected by a 2 step verification process and our system warns us if an unidentified device tries to access a particular inbox..

If you send us a private or direct message via social media the message will be stored for three months. It will not be shared with any other organisations.

We use a third-party provider, to supply and support our Live Chat service, which we use to handle customer enquiries in real-time. The information we capture is volunteered by the chat visitor in response to requests by our live chat operators during the live chat engagement.

If you use the Live Chat service we may collect your name, address, contact telephone number and email address, and it also includes the nature of their interest, such as what type of product or service you’re interested in and any other contextual information.

Additionally, our systems can be used to identify key visitor detail such as location and IP address and, if the visitor is returning to the site, the software can also identify them and retrieve any previous chat data.

Live chat data is stored in data centres that are compliant with data protection regulations.

This information will be retained for two years from the last recorded correspondence and will not be shared with any other organisations.

You can request a transcript of your Live Chat session if you provide your email address at the start of your session or when prompted at the end.

We use a third-party provider, to deliver our e-newsletters. We use double opt-in on our email lists. This means that once you enter your details an email confirmation is sent to you for you to confirm your subscription request.

We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter. Out of respect for our users' privacy we provide a way to opt-out of these communications via the unsubscribe mechanism at the bottom of each email.

Visitors to our website

When someone visits this site we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone.

We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

We may have access to geolocation data as indicated by your IP address. We collect and process IP addresses of all devices where some of our services are made available on such as our live chat. Collecting and processing your geo-location data refers to mobile devices as well as computers.

Use of Cookies

You can read more about how we use Cookies on out Cookies Page. This explains how we collect information about you. We will use your information collected from this website to personalise your repeat visits to our website. You can choose to accept or decline cookies.

Most web browsers automatically accept cookies, but you can modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
For further information visit www.aboutcookies.org or www.allaboutcookies.org.

Clients who use our email management software

We also store and manage information on behalf of some customers so they can manage their email campaigns. This includes information about our customers’ subscribers such as email addresses, emails received, links accessed (we sometimes track this for customers through our software) and other details entered by customers into our systems, which are subject to our Terms of Use but are not otherwise limited or controlled by us.

It is possible that in this respect we could handle sensitive information such as information about professional association membership, political beliefs, health and religion.

We do not use this information for our own purposes.

Third Parties

We occasionally licence information for direct marketing purposes from third parties. All data licences will be data protection compliant and only used in accordance with the obtained licence. https://www.corpdata.co.uk/about-us-legal

We use information held about you in the following ways:

Information you give to us.

We will use this information:
For the provision of services requested and marketing purposes.
Providing always that you have given to us the necessary consent, to provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about;
To notify you about changes to our service(s);

Marketing

We would like to send you information about our products and services and other companies we partner with which may be of interest to you. We will only contact you for marketing purpose if you have given explicit permission.

Explicit permission will include:

• Volunteering your information in our newsletter subscribe form.
• By ticking a checkbox on another form on our website to opt in to our marketing communications.
• If you completed an offline form AND you have ticked the a box indicating they would like to be contacted with more information.
• If you have completed a form from a third party, such as Facebook, as a result of an advert.
• You gave us your business card and we explained to you that we would be sending you commercial email and you verbally agreed.
• We provided you with a service and you opted in by checking a box to receive further marketing from us.
• Verbal permission within a recorded telephone call with us.
• You have agreed your information can be used by the partners of Corpdata

The security of your data such as subscriber lists and campaign content is incredibly important to us.
We have put in place both hardware and software protection to ensure that nobody else has access to your account and the information it contains.

If you have consented to receive marketing, you may opt out at a later date. You have a right at any time to stop us from contacting you for marketing purposes.
If you are already subscribed to us for marketing purposes and wish to no longer be contacted, please click here.

Where we store your personal data

The data we collect from you will be stored within our cloud CRM system and / or our email campaign system.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Use of data Processors

All our data processors are able to demonstrate compliance with data protection laws. The GDPR does not require EU personal data to stay in the EU, nor does it place any new restrictions on transfers of personal data outside the EU.

Where data does reside outside of the EU we are protected by the EU-U.S Privacy shield program. This means processors we use are deemed adequate by the European Commission meaning they are recognised secured mechanisms to comply with EU data protection requirements when transferring personal data from the European Union to the United States.

Accountancy Platform

Our accountancy platform is cloud based, supports SSL (encryption) and resides predominantly, in New Zealand. New Zealand is recognised by the EU as an adequate country (i.e. safe country) to receive and process EU personal data. Transfers to New Zealand are therefore compliant under GDPR.

When EU customer data is processed in other territories, like the USA, other appropriate safeguards are taken that are prescribed by the GDPR. EU Standard Contractual Clauses (also called Model Clauses), that are published by the European Commission are used to protect EU data.

These are standard form data export agreements that have been approved by the European Commission as a lawful basis for transferring personal data to non-EEA countries like the USA. Oaktree Accountants support our accounting process and have access to Xero as an Approved Silver Partner. https://www.oaktreeaccountants.co.uk/

CRM

We use a CRM platform to store customer and prospect information. This cloud system uses a 2 factor authentication login process and all information in in transit is encrypted. The stored data resides in US data centers. The platform is deemed EU-U.S Privacy shield compliant

Email Campaign Software

Our email campaign platform resides in Australia. Australia is recognised by the EU as an adequate country (i.e. safe country) to receive and process EU personal data. Transfers to Australia are therefore compliant under GDPR.
We store data in a US-based data centre in SAN Jose. In addition, we use multiple data processing locations including USA, Australia and Germany. We have a suite of security guidelines with supporting procedures, which have been aligned with the ISO 27001 standard.
To protect data using our email newsletter platform, we encrypt information in transit by supporting TLS 1.0, 1.1 and 1.2. Data at rest is also encrypted using AES-256 encryption.
Our data centre provider is certified to the following compliance standards: HIPAA, PCI-DSS, SOC 1 Type 2, SOC 2 Type 2, ISO 27001 and FISMA/NIST.
Our cloud provider has the following certifications: PCI-DSS, ISO 27001, SOC 1 / 2 / 3, IRAP, ISO 27018 and ISO 9001.
For our email campaign platform we use the NIST Cybersecurity Framework to measure our ability to identify, protect, detect, respond and recover from security events.

In line with GDPR we are;

• Documenting all data processing activities that involve the collection, treatment, and safeguarding of personal data.
• Building and improving processes and features to ensure we can quickly and effectively address any requests from our customers when their subscribers wish to exercise their rights (including the Right of Access, Right to Rectification, Right to Object, Right to be Forgotten, and the Right of Portability).
• Ensuring all of our sub-processors have adequate security measures in place for the safeguarding of personal data processed by them and ensuring our contracts with them require them to also abide by their requirements as sub-processors under the GDPR

Safe Harbour has been replaced by Privacy Shield and is an agreement on data management between the UK and the USA. US companies register to demonstrate that they protect consumer data in line with EU data regulations. Either agreement does not apply to any other country and, as our platform is run by an Australian company, they cannot sign up to either of those registers as they only apply to US based companies. For such companies, the EU provides model contracts that allow a company to guarantee to an EU company that they will hold data in a way that meets the requirements of EU regulations. There aren’t going to be any specific agreements between Australia and the EU, or Australia and the USA. A specific agreement isn’t necessary because EU provides the model contract method to all other countries.

G Suite.

Google uses encryption to protect data in transit and at rest. Data in transit to G Suite is protected using HTTPS, which is activated by default for all users. G Suite and Google Cloud Platform services encrypt customer content stored at rest, without any action required from customers, using one or more encryption mechanisms.

Our business office has three layers of physical security which includes a combination of key codes and key locks. Our computers are all password protected. Each user has their own username and use strong passwords. Should a member of staff leave the organisation or is absent for long period their access to our systems is cancelled. Our network files are all synchronised to the Google Cloud to enable our employees to also access them remotely. This is protected by a 2 step verification process and all remote computers are also password protected. There is also an offline backup procedure to mitigate ransomware attacks.

All equipment used has antivirus regularly scanning the network to prevent and detect threats. There is security built into the operating system preventing outside access, and all major security patches are tested and applied within 2 weeks of release.

Where we might have taken physical notes at a meeting these are immediately shredded after use after transferring the information to our CRM..

Access to personal information

Edward James Associates tries to be as open as it can be in terms of giving people access to their personal information.You have the right to request a copy of the information we hold about you. If you would like a copy of some or all of your personal information, please email or write to us at the following address. The Data Controller, Edward James Associates, Amphion House, Picket Piece Hampshire UK SP11 6LU

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

We keep our privacy notice under regular review.

This privacy notice was last updated in December 2020