Last updated: 23 October 2019

At Fabriq, we respect your privacy and are committed to protecting your personal data. The Fabriq sustainability data platform uses some personal data in relation to account holders and this “privacy notice” explains how and why we collect, store, use and that share personal data, as well as your rights to control our use of it.

For the purpose of the Data Protection Act 1998 (the Act), the data controller is Fabriq Ltd trading as Fabriq ("we"/"Fabriq"). We are registered in United Kingdom under company number 07826977 and have our registered office at 8 Hermitage Street, London W2 1BE, United Kingdom.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We process a minimal amount of personal data through the Fabriq platform, and data protection laws require us to explain what data we collect, for what purpose and on what legal (or ‘lawful’) basis.

If you are a Fabriq account holder: we will hold your name, username, organisation, email address and phone number for the purpose of providing you with secure access to your account. We do this on the basis that it is necessary for our legitimate interests in operating the Fabriq sustainability data platform to monitor and improve the performance of buildings. You (or your employer) will have provided these details through the account creation process. If you want to update your details, you can log in and do so. If you no longer require your account or want to delete your data, please email us (see “How to contact us” below). We will hold your information until you or we delete your account.

If you use the Fabriq platform, we may store information relating to you using cookies or similar technologies, which we can access when you visit our site in future. The cookies used do not store information from which you can be identified as an individual. For more information on our use of cookies and how to control them see the Cookie Policy.

The personal data used to create your account on the Fabriq sustainability data platform is not shared with third parties, except for our data processors, who host and maintain the software and database behind Fabriq.

We do not transfer the personal data used to create your account on the Fabriq sustainability data platform outside the European Economic Area (EEA). If our data processors use a hosting provider that stores data outside the EEA, it will always employ one or more of the following mechanisms that are designed to help safeguard your privacy rights:

• Restricting transfers to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
• Use of specific contractual clauses approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
• For providers storing data in the US, self-certification to the EU-US Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield.

The personal data we hold about you is your data, and you have certain rights over the data under applicable data protection laws. This section summarises the rights you have where your personal data is protected under GDPR.

• You have the right to request a copy of all personal data we hold relating to you. You also have the right to require us to correct any mistakes in the personal data we hold relating to you.
• Where we are processing your data based on your consent you can withdraw that consent and we must immediately stop processing your data.
• Where we process your data based on a “legitimate interest” (underlined in the section on “purpose and lawful basis”, above) you still have the right to object to our processing of that data if you feel it impacts on your fundamental rights and freedoms.
• You also have the right to object where we are processing your personal data for direct marketing purposes. The easiest way to do this is to use the unsubscribe links at the bottom of all marketing emails.
• In certain situations, you have the right to require us to erase personal data where there is no good reason for us continuing to process it, or to request restriction of processing of your personal data.
• Finally, you may have the right to request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format in certain circumstances.

For further information on each of these rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of these rights, the easiest way is by dropping us an email (see “How to contact us” below).

At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113. Of course, we hope that we can resolve your issue quickly and fairly ourselves.

You have a right to object to any decisions being taken through the processing of your personal data by automated means if they produce legal effects concerning you or similarly significant effects on you. We can confirm that we do not undertake any automated decision-making, or profiling, based on the processing of personal data, within Fabriq accounts.

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

We may change this privacy notice from time to time by amending this page.

If you have any questions, concerns or just want some more information about our privacy management, drop us a line at info@energydeck.com