Privacy Policy

1. Introduction

Chrysalis FM ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our website, you consent to the data practices described in this policy.

2. Information We Collect

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services
• Process your requests and respond to inquiries
• Send you updates, newsletters, and marketing communications (with your consent)
• Improve our website and services
• Monitor and analyse usage patterns and trends
• Detect, prevent, and address technical issues
• Comply with legal obligations

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Consent: You have given us explicit consent for specific purposes
• Contract: Processing is necessary for performing a contract with you
• Legal Obligation: Processing is necessary for compliance with legal obligations
• Legitimate Interests: Processing is necessary for our legitimate business interests

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Service Providers: Third-party vendors who perform services on our behalf (e.g., email delivery, hosting, analytics)
• Professional Advisors: Legal, financial, or other professional advisors
• Regulatory Authorities: When required by law or to protect our rights

All third parties are required to maintain appropriate security measures and are prohibited from using your data for their own purposes.

6. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. Typically, we retain data for:

• Active clients: Duration of our business relationship plus 6 years
• Marketing contacts: Until you unsubscribe or request deletion
• Website analytics: Anonymised data may be retained indefinitely

7. Your Data Protection Rights

Under UK GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request transfer of your data to another organisation
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at Info@chrysalisfm.co.uk. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Cookies

Our website uses cookies to enhance your browsing experience. Cookies are small files stored on your device that help us understand how you use our site. You can control cookie settings through your browser.

We use:

• Essential Cookies: Required for website functionality
• Analytics Cookies: Help us understand website usage (e.g., Google Analytics)
• Marketing Cookies: Used to deliver relevant content and advertisements

10. Google API Disclosure

• Our Applications: Chrysalis ASSESS and CORE, use Google APIs to facilitate secure user authentication via Google OAuth.
• Use of Data: We only request access to your Google email address and basic profile information (name and profile picture) to verify your identity and manage your account access within the CORE platform. We do not access your Google Drive, Calendar, or other personal data.
• Limited Use: Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. International Data Transfers

Your data may be transferred to and processed in countries outside the UK. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

12. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: Info@chrysalisfm.co.uk
• Address: Chrysalis FM, Prime Apartments, 483 Green Lanes, London, N13 4FG

15. Complaints

If you believe we have not complied with data protection law, you have the right to complain to the UK Information Commissioner's Office (ICO).