GDPR Statement

Switch Utilities Ltd, trading as Switch Voice and Data (SVD), is committed to fulfilling its obligations under the General Data Protection Regulation (GDPR). The following information is provided to clients as evidence of how SVD seeks to satisfy the requirements of the Regulation.

This document is to be read in conjunction with the Privacy Policy and the Terms and Conditions to which all services and contracts are subject. The Privacy Policy details the measures SVD has always had in place in relation to data protection. Those measures remain unchanged and provide clarity about each party's responsibility in handling data throughout its lifecycle.

Definitions

SVD is both a data processor and a data controller.

Data Processor

SVD is a data processor for all client telephony services, and to that end is registered with the Information Commissioner’s Office (ICO), registration number Z2868990. SVD makes use of infrastructure provided by a number of third parties, who are therefore also data processors for SVD’s clients. Please find details of all third parties at the end of this statement, together with links to their equivalent Privacy and GDPR statements. SVD provides the telephony services but it does not control what is information is stored on the platform. The client is the data controller in this relationship due to having the responsibility of deciding what data is collected and reported on.

Data Controller

SVD is a data controller for the information it holds on clients. This information consists of contact names, email addresses, phone numbers and account details. SVD collects this information to ensure it can successfully provide the services clients pay for.

SVD reserves the right to store this information for clients, and to make contact using this information for anything service related. SVD reserves the right to store this information for the duration of the relationship with the client, and for any period thereafter necessary for compliance with legal or audit requirements.

How we handle data about our clients

All personally identifiable information relating to clients is stored within SVD’s closed network, which allows for full control over who has access to the data. SVD will not share any client information with third parties unless absolutely necessary to deliver the services clients have paid for; for example, third party software vendors. SVD does not use any sub-processors in its service delivery.

How we handle data clients host with us

The data clients host through SVD is stored on various third party infrastructures. Please see the information at the end of this statement regarding the security measures each provider has in place, and the location of their infrastructure platforms.

SVD carries out automated back-ups of all data hosted through us at least daily, in order to provide a resilient service and to allow for recovery after unforeseen circumstances.

SVD’s staff will only directly interact with the data clients host with us on the instruction of the client. This may include remedial tasks such as restoration of data from back-ups, merging of duplicate records, troubleshooting, reporting and other tasks as specified by the client.

Notification of a personal data breach

SVD will respond to any data breach discovered and will notify clients within the time frame mandated by the GDPR. It will also alert the ICO in the case of a data breach.

For data breaches that relate to data clients host with us, SVD has a duty of care to inform clients of any breaches we discover, or breaches we are informed about by third party suppliers. The client, as data controller, is then responsible for alerting the ICO of the data breach within the time frame mandated by the GDPR.

For any further information relating to SVD's GDPR efforts, please contact gdpr@switchutilities.com.

Prepared May 2018
Switch Utilities Limited

Third Party Infrastructure Providers

• Business Phones and Networks (BP&N):
    — statement to follow
• EE:
    — https://ee.co.uk/eeprivacycentre
• Invosys:
    — http://invosys.com/privacy-policy
• New Star Networks (NSN):
    — http://nsn.co/privacy-policy
    — http://nsn.co/gdpr-amendment-to-standard-customer-terms-conditions
• PB Communication Services:
    — Click here to download