Privacy Policy

1.1This Privacy Policy explains how caaltechs.com ("caaltechs.com", "we", "us" or "our") collects, uses, stores, protects and, where legally permitted or required, discloses personal data when you access or use caaltechs.com (the "Platform"), website, applications, products and related services (collectively, the "Services").

1.2We are committed to protecting the privacy and security of users of the Platform.

1.3Our general policy is that we do not sell, rent, trade or commercially disclose users’ personal data to third parties for their own marketing or commercial purposes.

1.4Personal data may, however, be processed by service providers acting on our behalf where reasonably necessary to operate, secure, maintain or provide the Services, and may be disclosed where we are legally required or lawfully permitted to do so, including in connection with law-enforcement, regulatory, court or criminal investigations.

1.5This Privacy Policy should be read together with our Terms and Conditions and any other policies published on the Platform.

2.1This Privacy Policy applies to personal data processed through:

1. a.our website;
2. b.user accounts;
3. c.mobile or desktop applications;
4. d.online services;
5. e.communications with us;
6. f.customer support;
7. g.transactions and subscriptions;
8. h.user-generated content;
9. i.Platform security and monitoring systems; and
10. j.other services operated by us that link to this Privacy Policy.

2.2It does not necessarily apply to websites, applications or services operated by independent third parties that may be accessible through the Platform.

3.0Depending on how you use the Platform, we may collect the following categories of information.

1. a.name;
2. b.username;
3. c.email address;
4. d.telephone number;
5. e.password or authentication information;
6. f.account preferences;
7. g.profile information; and
8. h.information required to establish or maintain an account (IP Address or MAC Address).

1. a.service requests;
2. b.enquiries;
3. c.communications;
4. d.documents or information submitted through the Platform;
5. e.user-generated content;
6. f.service history;
7. g.preferences; and
8. h.information necessary to fulfil a requested service.

1. a.IP address;
2. b.browser type;
3. c.device type;
4. d.operating system;
5. e.approximate geographic information derived from IP address;
6. f.access times;
7. g.referring URLs;
8. h.session information;
9. i.log information;
10. j.device identifiers;
11. k.security events; and
12. l.information concerning interactions with the Platform.

4.1We may process personal data for legitimate and lawful purposes, including:

1. a.providing and operating the Services;
2. b.creating and administering accounts;
3. c.processing transactions;
4. d.providing customer support;
5. e.communicating with users;
6. f.maintaining Platform functionality;
7. g.improving the Services;
8. h.preventing abuse;
9. i.detecting fraud;
10. j.detecting cyberattacks and security incidents;
11. k.protecting the Platform and its users;
12. l.enforcing our Terms and Conditions;
13. m.investigating suspected misuse of the Platform;
14. n.maintaining records;
15. o.complying with legal and regulatory obligations;
16. p.responding to lawful requests from competent authorities;
17. q.protecting our rights, property and legitimate interests;
18. r.establishing, exercising or defending legal claims; and
19. s.other purposes permitted or required by applicable law.

4.2We will not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted by applicable law.

5.1Where UK data-protection law applies, we process personal data only where an appropriate lawful basis exists. Depending on the circumstances, this may include:

1. a.performance of a contract;
2. b.compliance with a legal obligation;
3. c.legitimate interests;
4. d.consent;
5. e.protection of vital interests; or
6. f.another lawful basis available under applicable data-protection legislation.

5.2Where processing is based on consent, you may withdraw consent where legally applicable. Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

6.1Unless expressly stated otherwise in this Privacy Policy or otherwise required or permitted by law, we do not sell, rent, lease, trade or commercially disclose your personal data to third parties for their own independent marketing, advertising or commercial exploitation.

6.2We do not provide user databases to advertisers or unrelated businesses for the purpose of allowing those businesses to market their products or services directly to you.

6.3We also do not knowingly permit third parties to purchase access to our user database.

7.1Although we do not sell user data, the Platform may depend upon third-party service providers to operate effectively. Such providers may include:

1. a.hosting providers;
2. b.cloud infrastructure providers;
3. c.database providers;
4. d.cybersecurity providers;
5. e.payment processors;
6. f.email delivery providers;
7. g.communications providers;
8. h.analytics or technical service providers;
9. i.customer-support providers;
10. j.identity or authentication providers; and
11. k.other technology providers.

7.2These providers may process personal data only to the extent reasonably necessary to provide services to us or to support the operation, security and administration of the Platform.

7.3Where required by applicable law, we will use appropriate contractual and technical safeguards to protect personal data processed by service providers.

8.1Protecting user privacy does not prevent us from complying with lawful legal or law-enforcement requirements. We may disclose personal data where we reasonably determine that disclosure is:

1. a.required by a court order, warrant, statutory obligation or other legally binding requirement;
2. b.necessary to comply with applicable law or regulation;
3. c.lawfully requested by a competent law-enforcement, regulatory or governmental authority;
4. d.necessary and proportionate for the prevention, investigation, detection or prosecution of criminal offences;
5. e.necessary to investigate suspected fraud, cybercrime, hacking, unauthorised access or other unlawful activity;
6. f.necessary to investigate serious misuse of the Platform;
7. g.necessary to protect the rights, safety, security or property of the Company, Platform, users or another person;
8. h.necessary to establish, exercise or defend legal claims; or
9. i.otherwise permitted by applicable law.

8.2Where we voluntarily disclose information to a law-enforcement authority, we will consider whether the disclosure has an appropriate lawful basis and whether the disclosure is necessary and proportionate to the stated purpose.

8.3We will generally seek to disclose only the information reasonably necessary for the relevant legal or law-enforcement purpose.

8.4UK data-protection guidance recognises that personal data may be shared with law-enforcement authorities where the sharing is lawful, necessary and proportionate, and that disclosure may also be required by court order or another legal obligation.

9.1We may investigate and, where legally appropriate, disclose relevant information concerning suspected:

1. a.fraud;
2. b.identity theft;
3. c.payment fraud;
4. d.cybercrime;
5. e.hacking;
6. f.unauthorised access;
7. g.attempted unauthorised access;
8. h.malware or malicious activity;
9. i.phishing;
10. j.abuse of Platform infrastructure;
11. k.attacks against users or systems;
12. l.threats to Platform security;
13. m.unlawful activity;
14. n.serious harassment or threats;
15. o.exploitation of the Platform for criminal purposes; or
16. p.material breaches of our Terms and Conditions.

9.2Where appropriate and lawful, information may be disclosed to competent authorities for investigation or enforcement.

9.3Any such disclosure will be subject to applicable legal requirements and, where applicable, the principles of necessity, proportionality, data minimisation and lawfulness.

10.1We may process and retain information reasonably necessary to investigate, prevent or respond to material violations of our Terms and Conditions.

10.2Where a user’s conduct presents a serious risk to:

1. a.the Platform;
2. b.other users;
3. c.third parties;
4. d.Platform infrastructure;
5. e.financial systems;
6. f.cybersecurity;
7. g.legal compliance; or
8. h.public safety,

10.3we may take appropriate action, including suspension, restriction or termination of an account.

10.4Where applicable and legally justified, we may disclose relevant information to competent authorities.

10.5A breach of our Terms and Conditions does not automatically mean that personal data will be disclosed to law enforcement. Disclosure will depend on the circumstances, applicable law and whether there is an appropriate lawful basis.

11.1We may disclose personal data where necessary for:

1. a.complying with court orders;
2. b.responding to subpoenas or equivalent legal processes;
3. c.complying with statutory obligations;
4. d.legal proceedings;
5. e.regulatory investigations;
6. f.obtaining legal advice;
7. g.establishing, exercising or defending legal claims; or
8. h.protecting our legal rights.

11.2Where legally permitted, we will seek to limit disclosure to information relevant and reasonably necessary for the applicable purpose.

12.1We may disclose personal data without prior notice where we reasonably believe that disclosure is necessary to:

1. a.protect a person’s life;
2. b.prevent serious physical harm;
3. c.address an immediate threat to safety or security;
4. d.respond to a serious cybersecurity incident; or
5. e.comply with an applicable legal requirement.

12.2Any disclosure will be made subject to applicable law.

13.1We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including where necessary to:

1. a.provide the Services;
2. b.maintain business and transaction records;
3. c.comply with legal obligations;
4. d.resolve disputes;
5. e.enforce agreements;
6. f.prevent fraud;
7. g.investigate security incidents;
8. h.establish, exercise or defend legal claims; or
9. i.comply with legitimate law-enforcement requirements.

13.2When personal data is no longer reasonably required, it will be deleted, anonymised or securely disposed of where practicable, subject to applicable legal, regulatory, security and evidential requirements.

13.3Where information is relevant to an ongoing legal investigation, dispute, fraud investigation, cybersecurity investigation or legal obligation, we may retain it for longer than ordinary account-retention periods.

14.1We implement reasonable technical and organisational measures designed to protect personal data against:

1. a.unauthorised access;
2. b.accidental loss;
3. c.destruction;
4. d.alteration;
5. e.disclosure;
6. f.misuse;
7. g.cyberattacks; and
8. h.other unlawful or unauthorised processing.

14.2Security measures may include, where appropriate:

1. a.access controls;
2. b.authentication mechanisms;
3. c.encryption;
4. d.secure communications;
5. e.monitoring;
6. f.logging;
7. g.backup systems;
8. h.vulnerability management;
9. i.security testing; and
10. j.incident-response procedures.

14.3However, no internet transmission or electronic storage system can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security of personal data.

15.1Users are responsible for maintaining the confidentiality of their account credentials and for taking reasonable precautions when using the Platform. You should not:

1. a.disclose your password to another person;
2. b.allow unauthorised persons to access your account;
3. c.upload information that you are not authorised to provide;
4. d.attempt to bypass Platform security;
5. e.attempt to obtain unauthorised access to another user’s account;
6. f.use the Platform for unlawful activities; or
7. g.intentionally introduce malicious software or code.

15.2Users should notify us promptly if they believe their account or personal information has been compromised.

16.1We may use cookies and similar technologies to:

1. a.operate the Platform;
2. b.maintain sessions;
3. c.remember preferences;
4. d.improve functionality;
5. e.understand technical performance;
6. f.protect against fraud and abuse; and
7. g.obtain analytics where legally permitted.

16.2Where required by law, we will obtain appropriate consent before placing non-essential cookies or similar technologies.

17.1Some service providers may process information outside the United Kingdom.

17.2Where personal data is transferred internationally, we will take appropriate steps required by applicable data-protection law to ensure that the transfer is lawful and that appropriate safeguards are applied.

17.3Such safeguards may include adequacy regulations, approved contractual mechanisms or other legally recognised transfer mechanisms.

18.1The Platform is not intended for children below the minimum age required under applicable law unless expressly stated otherwise.

18.2We do not knowingly collect personal data from children where such collection is prohibited by law.

18.3If we become aware that personal data has been collected from a child contrary to applicable legal requirements, we may take reasonable steps to delete the information.

19.1Depending on applicable law and the circumstances of processing, you may have rights including:

1. a.the right to be informed;
2. b.the right of access;
3. c.the right to rectification;
4. d.the right to erasure;
5. e.the right to restrict processing;
6. f.the right to data portability;
7. g.the right to object to certain processing;
8. h.rights relating to automated decision-making and profiling; and
9. i.the right to withdraw consent where consent is the lawful basis.

19.2These rights are not absolute and may be subject to legal exceptions. For example, applicable law may permit restrictions on certain rights where complying with the request could prejudice the prevention or detection of crime or another lawful investigation.

19.3The existence and scope of any such restriction will depend on the circumstances and applicable law.

20.1You may contact us to request access to or correction of personal data that we hold about you. You may also request deletion where you have a legal right to require deletion.

20.2However, we may lawfully retain certain information where necessary for:

1. a.compliance with legal obligations;
2. b.fraud prevention;
3. c.cybersecurity;
4. d.legal proceedings;
5. e.dispute resolution;
6. f.enforcement of our agreements;
7. g.regulatory requirements;
8. h.law-enforcement investigations; or
9. i.establishment, exercise or defence of legal claims.

20.3Accordingly, deletion of an account does not necessarily result in immediate deletion of every record associated with that account.

21.1Where legally permitted, we may notify an affected user when their personal data is disclosed pursuant to a legal or law-enforcement request.

21.2However, we may be unable to provide notice where:

1. a.prohibited by law;
2. b.prohibited by a court order;
3. c.prohibited by a lawful direction of a competent authority;
4. d.doing so could prejudice an investigation;
5. e.doing so could prejudice the prevention or detection of crime;
6. f.doing so could create a security risk; or
7. g.another applicable legal exemption applies.

21.3We will not promise advance notice where applicable law prevents us from providing such notice.

22.1If we become aware of a personal-data breach, we will assess the incident and take the steps required by applicable data-protection law. Where legally required, we may notify:

1. a.the Information Commissioner’s Office or another competent regulator;
2. b.affected users; and/or
3. c.other appropriate authorities.

22.2We may also take technical and organisational measures to contain, investigate and remediate the incident.

23.1The Platform may contain links to third-party websites, applications or services.

23.2We are not responsible for the privacy practices, security or content of independent third parties.

23.3Users should review the privacy policies of third-party services before providing them with personal information.

24.1We may update this Privacy Policy from time to time. Changes may be made to reflect:

1. a.changes in our Services;
2. b.changes in technology;
3. c.changes in legal requirements;
4. d.regulatory guidance;
5. e.security developments; or
6. f.changes to our data-processing practices.

24.2The updated version will be published on the Platform with an updated "Last Updated" date.

24.3Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes.

25.1If you have concerns about how we process your personal data, you should first contact us using the contact details provided in section 26.

26.1For privacy, data-protection or personal-data requests, contact:

26.5Please include sufficient information to allow us to identify your account and understand the nature of your request.

27.1Nothing in this Privacy Policy creates an absolute guarantee that personal data will never be disclosed.

27.2We will not sell or commercially exploit personal data contrary to the commitments stated in this Policy. However, we may process or disclose information where necessary to operate the Services, where authorised by law, where required by a legal obligation or court order, or where necessary and lawful for the prevention, investigation, detection or prosecution of crime, serious fraud, cybercrime, security incidents or other unlawful activity.

27.3We will seek to ensure that any disclosure is lawful, necessary and proportionate and, where appropriate, limited to the minimum information reasonably required for the relevant purpose.

28.1This Privacy Policy is intended to operate in accordance with applicable United Kingdom data-protection and privacy legislation, including, where applicable:

1. a.the UK/Europe General Data Protection Regulation;
2. b.the Data Protection Act 2018;
3. c.applicable legislation concerning electronic communications and privacy;
4. d.applicable amendments and successor legislation; and
5. e.applicable regulatory guidance.

28.2Where mandatory law applicable to a particular user provides additional rights or protections, those mandatory rights and protections will prevail to the extent required by law.