Privacy Policy

Your Privacy

This Privacy Policy tells you what to expect when Caboodle Technology Ltd (caboodle) process your personal information.

Our Responsibilities

Caboodle Technology Limited is the controller of your personal information that you provide via this website, unless otherwise stated.

Caboodle’s Lawful basis

Data controllers must define their legal basis for processing personal information. Where caboodle act as data controllers, the lawful basis for processing are either:

Consent: the individual has given clear consent for caboodle to process their personal data for a specific purpose (this applies to caboodle’s marketing function).

Contract: the processing is necessary for a contract caboodle have with the individual, client or organisation in the provision of employee benefits or a contract of employment, or because they have asked caboodle to take specific steps before entering into a contract.

Legal obligation: the processing is necessary for caboodle to comply with the law (this applies to additional regulation, such as HMRC guidance). Caboodle’s additional legal obligations are documented in the company CAISMS0003 Interested Parties and Legal Register. Where caboodle are data processors, caboodle verify the data controller has a lawful basis for processing before completing any activity on the controller’s behalf.

Legitimate Interests: the processing is necessary for caboodle’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. Where this legal basis applies, caboodle have conducted a Legitimate Interests Assessment and kept a record of it, have identified those legitimate interests and use information in a way those individuals would reasonably expect.

Caboodle’s Legitimate Interests are:

• Processing carer details to provide the caboodle Childcare Voucher Scheme as necessary to the performance of our contracts with clients
• Processing independent bike retailer details to provide Bike to Work Scheme as necessary to the performance of our contract with clients

The processing of information is necessary for the purpose and benefits the individuals whose personal information is being processed as it enables those businesses to secure more revenue.

This website gives you information about the cycle to work scheme and an application facility to nominate your company to be contacted by caboodle about running a cycle to work scheme.

You have certain rights under the General Data Protection Regulation (CEU 2016/679) which are listed below.

Caboodle takes adequate steps to prevent unauthorised access to personal information, including implementing technological and operational security measures in accordance with ISO27001, documenting our processing activities, data processing contracts with sub-processors and suppliers, and appointing a Data Protection (Compliance) Officer.

Why we collect your information

Caboodle processes your information for the purposes of taking steps to enter an agreement for Cycle to Work scheme in association with Halfords and as such, you will be contacted to discuss this agreement once you have submitted the required information. Caboodle cannot achieve these purposes without processing your personal data. If you are an employee using this site but asking for your company to be contacted about running a cycle to work scheme, we do not collect any personal information about you but you will provide information about your company and how to contact them.

Your Rights

Under GDPR, you have rights in relation to the processing of your personal information

1. The right to be informed

You have a right to be informed about the collection and use of your personal information. Caboodle tell you how your information will be collected and used in this Privacy Policy.

Caboodle collect your IP address when you visit the Halfords Exchange website for security and performance monitoring.

• Company Name
• Company Short Name
• Company Registered Address
• City
• County
• Postcode
• Company Reg Number
• Number of Employees
• Company Website
• Your Forename
• Your Surname
• Your Job Title
• Your Email
• Your Phone
• Telephone conversations
• Records of correspondence

Use of Information

1. Caboodle services

We use this information to

• Ensure content from our site is presented to you effectively
• To provide you with the further information about Cycle to Work scheme you request from us
• To market additional services from us should you request that we do so

Any personal information shared during a telephone conversation with one of our operators is always kept strictly confidential. Calls are recorded for training and monitoring purposes to ensure caboodle maintains its high standards of customer service

2. Cookies

A cookie is a small file which asks your permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps Salary Extras monitor which pages you find the most useful to help us provide you with a better website. This software is provided by Google Analytics which uses cookies to track visitor usage. You can read Google’s privacy policy here: http://www.google.com/privacy.html

A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can modify your browser setting to decline cookies if you prefer.

If you decline cookies, please be aware that this may impair your ability to use some areas of the website.

3. Communications and Marketing

Caboodle will never share, sell, lease or distribute your data to third parties for direct marketing or to brokers.

You will be emailed about your marketing preferences. If you opt-in to marketing communication, you can tell us whether you prefer to be contacted by email, telephone or by post. You can opt- out of marketing at any time by unsubscribing from the last communication sent to you, or telephoning your preferences directly to caboodle.

Sharing of Information

Your information will be shared with:

• Maxemail - to contact you about your communications preferences and marketing communications and to enable you to opt-out of communications
• Maximizer - to process your communications preferences
• UKFast - server hosts who will process your information if you become a caboodle client

Storage of Information

All information you provide to us is stored on our secure servers in the UK. Unfortunately, the transmission of information via the internet is not completely secure. Although we have certified measures in place to protect your personal data according to ISO27001 (certificate number: 14657), we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to try to prevent unauthorised access to it.

Retention and Deletion

Your personal information will be held according to the following criteria:

1. According to legal obligation
2. According to caboodle’s internal retention schedule
3. Where Right to Erasure or Restriction are granted

While your information is retained, caboodle will respect your applicable privacy rights and its obligations to accountability for data protection under GDPR.

2. The right to be accessed

You have a right to access your personal data so that you are aware of and can verify the lawfulness of the processing.

You may at any time make a written request for a copy of the personal information caboodle has on record for you. This is commonly known as a 'subject access request'.

We will respond to your request within one month. In some cases, we may request further identification from you to confirm your identity before the request is processed. If we process information about you, we will:

1. give you a description of it;
2. tell you why we are holding it;
3. tell you who it could be disclosed to; and
4. let you have a copy of the information in an intelligible form.

3. The right to rectification

You have the right to have personal data rectified if it is inaccurate or incomplete.

We will check that personal information is accurate at the time of collection and give you opportunity to update it. When you ask us to, caboodle will rectify personal data within one month of receipt of the request.

4. The right to erasure

You have the right to request your personal data is deleted or removed where there is no compelling reason for its continued processing. Personal data will be deleted under these circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When you withdraw consent.
• When you object to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
• The personal data has to be erased in order to comply with a legal obligation.
• The personal data is processed in relation to the offer of information society services to a child

Where the right to erasure does not apply, caboodle will refuse to deal with a request. We may retain your information for legal reasons even if you request to delete your information.

5. The right to restrict processing

You have a right to ask us to suspend processing of personal data under the following circumstances:

• you contest the accuracy of your personal data;
• the data has been unlawfully processed (i.e. in breach of the lawful reason for processing) but you do not want us to delete it;
• you no longer need the personal data but you need to keep it in order to establish, exercise or defend a legal claim; or
• You object to caboodle processing your but we need to verify whether we have overriding legitimate grounds to use it.

6. The right to data portability

The right to portability allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, so that you can reuse for their own purposes.

Requests made in relation to your right to data portability can be made using any of the contact methods in the 'contact us' section of this policy.

Caboodle will ensure you obtain a machine-readable copy of the information held by any caboodle Technology system according to procedure, within one month of the request being made.

7. The right to object

You have the right to object to:

• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
• direct marketing (including profiling); and
• processing for purposes of scientific/historical research and statistics;

on grounds relating to your particular situation.

8. Rights in relation to automated decision making and profiling

Caboodle do not process information about you based on automated individual decision-making and profiling.

Limits

Caboodle reserve the right to divulge information when we are required to do so by law, for example under a court order or provisions contained in legislation.

Contacting Us

If you have any questions or concerns relating to the processing of your personal information by caboodle, please contact:

Compliance Officer
Caboodle Technology Ltd
Suite 24 and 25
Edwin Foden Business Centre
Moss Lane
Sandbach
CW11 3AE

Or email: security@caboodle-technology.co.uk

Call: 0330 1000 911