GDPR Privacy notice for employees, secondees, volunteers and contractors

Who we are

33n Ltd (“33n”, “we”, “us”, “our”) is committed to protecting the privacy and security of your personal data and is the controller of your personal data, for the purposes described in this notice. This means we decide how and why your personal data is used.

Company number: 11004779

Registered address: First Floor, Station Place, Argyle Way, Stevenage, SG1 2AD

We have appointed a Data Protection Officer (DPO). If you have any questions about this notice or your personal data, you can contact:

Email: dpo@33n.co.uk

You have the right to complain to the Information Commissioner’s Office (ICO).

What this notice covers

This notice explains how we collect, use and protect personal data when you:

• visit the CLEARnotes website
• contact us or submit enquiries
• use CLEARnotes as a signed-in user (via web or mobile application)

The way your personal data is used depends on how you interact with CLEARnotes.

When we act as a controller or processor

The way your personal data is used depends on how CLEARnotes is used.

When you use the CLEARnotes website or interact directly with 33n, we act as a data controller.

When CLEARnotes is used as part of a service provided by your organisation, that organisation will usually act as the data controller, and 33n will act as a processor, processing personal data on their behalf and in accordance with their instructions.

In addition, 33n acts as a data controller for certain data related to the operation, security and improvement of CLEARnotes, such as system usage and technical data.

This means that both 33n and your organisation may have responsibilities under data protection law, depending on the type of data and how it is used.

The personal data we use

We use personal data relevant to your interaction with CLEARnotes.

When you use the website

We may collect:

• contact data (eg name, email address, organisation)
• enquiry information (eg details you provide)
• technical and usage data (eg IP address, browser type, pages visited)
• marketing preferences (eg subscriptions and opt-outs)

When you use CLEARnotes (signed-in)

We may process:

• identity data (eg name, role, organisation, professional details)
• contact data (eg email address)
• performance or feedback data (eg ratings, responses)
• technical and usage data (eg session data, logs, interaction data)
• audio data (where recording features are used)

We may generate derived data, such as:

• aggregated usage information
• performance insights
• analytical outputs

Where possible this data is anonymised or aggregated so individuals are not identifiable.

How we collect your data (sources of data)

When you use the website

We collect data:

• directly from you (eg forms, emails)
• automatically (eg cookies, logs)
• from limited third-party tools (eg analytics providers)

When you use CLEARnotes (signed-in)

We collect data:

• directly through your use of the system
• automatically through system logs and usage tracking
• through system functionality (eg recordings, interactions)

How we use your personal data

We only use your personal data where we have a lawful basis to do so.

Lawful bases

• Contract – to provide CLEARnotes functionality
• Consent – where required (eg marketing, cookies etc)
• Legal obligation – to comply with legal or regulatory requirements
• Legitimate interests – to operate, improve and secure CLEARnotes

Purposes of processing

We use your personal data for the following purposes:

Cookies and analytics

We use cookies and similar technologies to:

• ensure the website functions correctly
• understand how it is used
• improve performance and user experience

Where required, we will obtain your consent before using non-essential cookies.

You can manage your preferences through our cookie settings.

Automated decision-making and use of AI

We do not make significant decisions about you based solely on automated processing.

A significant decision is one that produces legal effects or has a similarly significant impact on you.

We may use analytical methods and AI-enabled tools to support:

• audio processing
• analysis and modelling
• reporting and insight generation
• system monitoring and security
• quality assurance

These tools:

• support human judgement and do not replace it
• are subject to controls to minimise risk, bias and inappropriate use
• are not used to make decisions about individuals without meaningful human involvement

Mobile application permissions

CLEARnotes may request access to certain device features where necessary to provide its functionality.

This includes:

• Microphone access – to record audio during use of CLEARnotes features
• Storage access – to save and access recordings on your device
• Device and system status – to ensure recordings function correctly and safely (for example, to avoid conflicts with phone calls)

CLEARnotes may use system services to:

• record audio reliably during active sessions
• process and synchronise data while the app is in use

When these features are active, your device will display a notification where required by the operating system.

Audio recordings and related data are processed only for the purposes of providing CLEARnotes functionality and are handled in accordance with this privacy notice.

You can manage or withdraw permissions at any time through your device settings. Some features may not function without them.

Who we share your data with

We do not sell your personal data.

When you use the website

We may share data with:

• authorised 33n staff
• service providers (eg hosting, analytics tools)
• regulators where required

When you use CLEARnotes (signed-in)

We may share data with:

• authorised 33n staff
• service providers supporting the system
• regulators or public authorities where required

Where 33n acts as a processor, we process data only under the instructions of the client organisation.

International transfers

Website and marketing activity

Some service providers we use for website hosting, communications or customer relationship management (for example marketing or CRM platforms) may process personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK data protection law.

CLEARnotes product and service delivery

Personal data processed as part of CLEARnotes functionality is stored and processed within the United Kingdom. We do not transfer this data outside the UK.

How we protect your data

We take appropriate security measures to protect your personal data, including:

• role-based access controls
• restricted access to authorised personnel
• secure systems and environments
• authentication and access management
• encryption in transit where appropriate
• logging and monitoring
• supplier security requirements

How long we keep your data

We retain personal data only as long as necessary.

Where possible:

• data is deleted when no longer required
• data is anonymised where appropriate
• anonymised data may be retained longer

Your rights

You have rights under data protection law, including:

• access
• correction
• deletion (in some cases)
• restriction
• objection
• data portability (where applicable)
• withdrawal of consent (where applicable)

To exercise your rights, contact: dpo@33n.co.uk

We may need to verify your identity before responding to your request.

Complaints

If you have concerns about how we use your data, you can contact us at: dpo@33n.co.uk

You also have the right to complain to the ICO:

Website: ico.org.uk

Phone: 0303 123 1113

Changes to this notice

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your data for a different purpose, we will explain the legal basis where required