Last updated: 01/03/2025 Who we are Varley Software Limited, registered number 13792362, registered address: 3 Trent side Business Village, Farndon Road, Newark, NG24 4XB. Our Data Protection Officer can be reached by emailing help@varleysoftware.co.uk Our role Varley Software plays a dual role when it comes to processing. In some situations, we act as a Controller, in others, we are the Processor. When we are a Processor of personal data, we are doing so purely on the instruction of another company (the Controller). If you are a service user or healthcare professional, then that company is likely to be the care provider. To find out more about how your data is protected by them, you should contact them directly. Varley Software does on occasion, act as a Controller. That will usually be the data of potential and existing employees, suppliers or website users and then technical data when you use our app. Being a Controller means that we are trusted to look after and deal with your personal information in accordance with this notice. We determine the ways and means of processing your data and must therefore be accountable for it. This privacy notice refers to the data we process as a Controller only.‍ Technical and operational security All data is password protected, access controlled, backed up securely and encrypted when appropriate. All employees are trained in data protection and are aware of their obligations to ensure the privacy of all data subjects. Data Privacy by Design and Default is an integral part of our development processes. Your rights As a data subject, you have rights over your personal data under Data Protection Laws. If you wish to exercise any of your rights, please contact us on help@varleysoftware.co.uk. Right of access: You can request access to a copy of the personal data which we hold about you, as well as details about why and how we use it. Right to rectification: You can ask us to change or update any personal data we hold about you which is inaccurate or incomplete. Right to be forgotten/erasure: You have a right, under certain circumstances, to ask us to delete any personal data we hold about Please note that there may be situations where we must retain your personal data after a request for erasure where we have a lawful basis for doing so. Right of restriction: You can ask us to restrict (i.e. prevent) the processing of your personal data where you have objected to our use of it, and we have no lawful basis to continue processing your personal data. Right of data portability: In certain circumstances, you can ask us to transfer the data we hold about you to another entity. This would be sent in a structured, commonly used, electronic form. Right to object: You can object to us using your personal data for particular purposes. Right to restrict processing: You can request a restriction on the processing of your personal data. You also have the right to lodge a complaint about our processing with supervisory authority the ICO whose details are here: https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/‍ Changes to our Privacy Notice We may change this Privacy Policy from time to time (for example, if the law changes). We recommend that you check this page regularly to keep up to date. If we make any material changes to the way we process and use your personal data, we will contact you to let you know about the change. Customer Privacy Notice Data that we hold and how we use it ‍As a customer, we hold the contact and payment details required to carry out our contract with you, manage our relationship and keep you up to date with changes and improvements to our services. This data would have been sourced from you directly. ‍Lawful basis for processing ‍Our lawful basis for processing your data is a combination of Contract and Legitimate Interest. We use legitimate interest when we use your data to keep you up to date with changes and improvements to our goods and services. Results of a legitimate interest balancing test indicate that this use is pursuing a legitimate interest, is necessary for the purpose of keeping you updated and growing our business, and unlikely to cause you risk or harm. ‍Data Sharing and Transfers Like most companies, we use various other companies as part of our data processing, for example, cloud services. We have Data Processing Agreements in place with these providers. We use UK based cloud services and cloud services based inside the EEA, data does not transfer outside of the EEA. We do not sell your data to anyone, and we do not share it with anyone other than our contracted processors. ‍Retention Periods ‍We hold data on customer for the length of time that you are a client of ours, then another 7 years in case of any dispute.‍ Employee Privacy Notice If you are an employee of Varley Software Ltd, please refer to the Fair Processing Notice that is stored in the Employee Handbook. Website Browsing Privacy Notice Cookie Policy We are committed to protecting your privacy and ensuring transparency in how we use cookies on our website. What Are Cookies? Cookies are small text files stored on your device when you visit a website. They help websites function properly and can enhance user experience by remembering preferences or enabling secure access. Our Use of Cookies We only use first-party authentication cookies on our website and web applications. These cookies are essential for: User login and session management Secure access to user-specific features Maintaining session integrity during your visit These cookies are set and managed directly by our website and are necessary for its core functionality. Without them, certain features may not work as intended. We do not use: Third-party cookies Advertising or marketing cookies Analytics or tracking cookies This means we do not track your browsing behaviour across other websites, nor do we collect data for advertising or profiling purposes. Managing Cookies Since our cookies are strictly necessary for authentication and security, they cannot be disabled without affecting the functionality of the site. By using our website, you consent to the use of these essential cookies. Contact Us If you have any questions about our cookie policy, please contact us at help@varleysoftware.co.uk. App User Privacy Notice Data that we hold and how we use it ‍As an app user, you provide some data to enter a contract with us and use the app. This will be your contact details. We also process data about the way you use our app, including your IP address and browsing time. This helps us to optimise the performance of our app, monitor it for security purposes and drive improvements for our users. We also use essential cookies for our in-app customer service capability to work. We also process your data so we can drive improvements to the app and to allow bug reporting and analysis. We use your contact details to send you service updates. ‍Lawful basis for processing ‍Our lawful basis for processing your data is a combination of Contract, Legitimate Interest and Consent. We use your contact details to provide you with the app and the appropriate technical support as needed, as well as service messages; this is our contract with you. We use legitimate interest when we use your data to improve the performance of the app, process your data for marketing purposes, and protect it from illegal use. Results of a legitimate interest balancing test indicate that this use is pursuing a legitimate interest, and unlikely to cause you risk or harm. When we send marketing messages to you, we rely on consent under Privacy and Electronic Communications Regulations (PECR). This consent is collected via the app. We are aware that as an employee of a customer subscriber, we could send marketing messages without consent. However, we feel that consent is a better option for you in this instance. You can withdraw this consent at any time. Data Sharing and Transfers Like most companies, we use various other companies as part of our data processing, for example, cloud services. We have Data Processing Agreements in place with these providers. We use UK based cloud services and cloud services based inside the EEA, data does not transfer outside of the EEA. We do not sell your data to anyone, and we do not share it with anyone other than our contracted processors. ‍Retention Periods We hold data used to fulfil the contract for 12 months after the termination of the contract. We delete log data 12 months after you cease using the app. We remove you from our marketing database, onto a suppression list, when you opt-out of receiving communications from us. Supplier Privacy Notice Data that we hold and how we use it ‍As a supplier, we hold the contact and payment details required to carry out our contract with you, manage our relationship and keep you up to date with changes to our services. This data would have been sourced from you directly. ‍Lawful basis for processing ‍Our lawful basis for processing your data is a combination of Contract and Legitimate Interest. We use legitimate interest when we use your data to keep you up to date with changes to our goods and services. Results of a legitimate interest balancing test indicate that this use is pursuing a legitimate interest, is necessary for the purpose of keeping you updated and growing our business, and unlikely to cause you risk or harm. ‍Data Sharing and Transfers Like most companies, we use various other companies as part of our data processing, for example, cloud services. We have Data Processing Agreements in place with these providers. We use UK based cloud services and cloud services based inside the EEA, data does not transfer outside of the EEA. We do not sell your data to anyone, and we do not share it with anyone other than our contracted processors. ‍Retention Periods ‍We hold data on customer for the length of time that you are a supplier of ours, then another 7 years in case of any dispute.‍