Privacy Notice

ABC Services Co Ltd ("ABC", "we", "us", "our") is a company registered in Gibraltar with company number 43177, whose registered office is at Unit 5, 12A North Mole Road, North Commercial Estate, Gibraltar GX11 1AA.

We are the controller of the personal information we hold about you for the purposes of the Gibraltar GDPR (Regulation (EU) 2016/679 as it forms part of the law of Gibraltar by virtue of section 6 of the European Union (Withdrawal) Act 2019) and the Data Protection Act 2004. We process your personal information in accordance with that legislation.

If you have any question about this notice, or you wish to exercise any of your rights, please contact us at the address above or at abcshyrene@gibtelecom.net.

We collect:

• your name and contact details;
• the address of the Premises at which we are to work, and any access information you give us, such as entry codes or alarm details;
• records of the work we have carried out and of the payments made;
• photographs of the Premises and of the work, taken as a record of condition before and after we attend (see clauses 4.3 and 4.5 of our Terms and Conditions);
• any correspondence between us, including any query, complaint or claim; and
• where an incident or injury occurs at the Premises, information about what happened, which may include information about health.

We use your personal information to provide you with a quotation, to carry out and schedule the work, to invoice you and collect payment, to deal with any query or complaint, to investigate any incident or claim, to meet our legal and regulatory obligations, and to keep proper business records.

Providing this information is necessary for us to quote for and carry out the work. If you do not provide it, we will not be able to enter into or perform the contract.

Our lawful bases under Article 6(1) of the Gibraltar GDPR are:

• performance of our contract with you (Article 6(1)(b));
• compliance with our legal obligations (Article 6(1)(c)); and
• our legitimate interests (Article 6(1)(f)) in running our business, investigating incidents and complaints, and establishing, exercising or defending legal claims.

We may share your information with our insurers and insurance brokers, our professional advisers, and our payment and accounting providers, including another company in our group which handles our accounting and invoicing on our behalf.

Where an incident or a complaint arises, we may need to make enquiries of, and share relevant information with, our insurers, our advisers, contractors, utility or service providers, and other companies in our group (for example our legal and HR functions), in order to investigate what happened and to deal with any claim.

We do not sell your information, and we do not share it for marketing purposes.

We keep your information for as long as it is needed for the purposes described in this notice, including for so long as a claim could be brought, and we then delete or anonymise it. Where we are required by law to keep records for a fixed period, we keep them for that period.

We use email, Microsoft and Xero to run our business, and some of our service providers store or access information outside Gibraltar.

Where we transfer your information outside Gibraltar we do so in accordance with Chapter V of the Gibraltar GDPR: either because the destination is covered by an adequacy decision recognised under the Gibraltar GDPR, or under standard data protection clauses that require the recipient to protect your information to the same standard. You can ask us for details of the safeguards that apply and we will provide them.

You have rights over your information under the Gibraltar GDPR. Depending on the circumstances, these include the right:

• to ask for a copy of the information we hold about you (Article 15);
• to have it corrected (Article 16);
• to have it erased (Article 17);
• to restrict how we use it (Article 18);
• to receive it in a portable form (Article 20); and
• to object to our using it (Article 21).

Some of these rights apply only in particular circumstances and we may not always be able to give effect to them; where that is the case we will explain why. The right to data portability, in particular, will not apply to most of the information we hold about you.

To exercise any of these rights, please contact us at the address above. We may need to verify your identity first. We will respond without undue delay and in any event within one month of receiving your request, although Article 12(3) of the Gibraltar GDPR allows us to extend that period by up to two further months where a request is complex or where we have received a number of requests. If we need to extend, we will tell you within one month.

Sometimes you may give us personal information about other people such as other occupiers of the Premises, the owner if that is not you, or a person we should contact about access. If you do, please make sure you are entitled to share it with us, and please make those people aware that we hold it.

Where we hold information about someone that we did not obtain from them directly, we will give them the information required by Article 14 of the Gibraltar GDPR if and when we are required to, unless an exemption applies (for example where doing so would involve disproportionate effort, or where they already have that information).

We do not make decisions about you by automated means and we do not carry out profiling.

If you are not satisfied with how we have handled your information, please tell us first if you can, we would rather put it right.

You also have the right under Article 77 of the Gibraltar GDPR and section 170 of the Data Protection Act 2004 to complain to the Information Commissioner, which under section 123(2) of that Act is the Gibraltar Regulatory Authority, 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar GX11 1AA, info@gra.gi. You do not need to contact us first.

You may also seek a judicial remedy under Article 79 of the Gibraltar GDPR (see also sections 171 and 172 of that Act), and compensation under Article 82 and section 173 of that Act.

We may update this notice from time to time. The current version is always the one published on our website. We will send you a copy at any time on request.