Privacy Policy

Introduction

Corient Tech is owned by Corient Business Solutions Limited is registered company in England and Wales registered number 7880941 with office at The Techno Centre, Puma Way, Coventry, CV 1 2TT

Corient Business Solutions Limited which is a Data Controller and is registered with the Information Commissioner Office (ICO) under reference ZA095945

Corient Business Solutions Limited (Corient) is strongly committed to protecting personal data. This privacy statement describes why and how we collect and use personal data and provides information about individuals’ rights. It applies to personal data provided to us, both by individuals themselves or by others. We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.

We may change this Policy from time to time so please check this page occasionally to ensure that you’re happy with any changes. By using our website, you’re agreeing to be bound by this Policy. Any questions regarding this Policy and our privacy practices should be sent by email to info@corientbs.com or by writing to Corient Business Solutions Limited, The Techno Centre, Puma Way, Coventry, CV 1 2TT. Alternatively, you can telephone 02476 103333

What is Personal Data

Personal data is any information relating to an identified or identifiable living person.  When “you” or “your” are used in this statement, we are referring to the relevant individual who is the subject of the personal data. Corient processes personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.

When collecting and using personal data, our policy is to be transparent about why and how we process personal data. To find out more about our specific processing activities, please go to the relevant sections of this statement.

Our processing activities

  • Potential Clients and Business Contacts
  • Our Clients- Individuals, Sole Proprietors, Partnership Firms, LLPs, Limited Companies
  • Individuals whose personal data we obtain in connection with providing services to our clients
  • Recruitment Applicants
  • Our Staff
  • Suppliers
  • Individuals who use our Applications
a. Potential Clients and Business Contacts
 i. Data Collection

Corient processes personal data about contacts (existing and potential Corient clients and/or individuals associated with them) using a customer relationship management system (the “Corient CRM”).

The collection of personal data about contacts and the addition of that personal data to the Corient CRM is initiated by a Corient user and will include

      • name,
      • employer name,
      • contact title,
      • phone,
      • email and
      • other business contact details.   

In addition, the Corient CRM may collect data from Corient email (sender name, recipient name, date and time) and calendar (organiser name, participant name, date and time of event) systems concerning interactions between Corient users and contacts or third parties.  

ii. Personal Data Usage

Personal data relating to business contacts may be used for our legitimate interests including the following:

Managing and developing our businesses and services

      • We may process personal data in order to run our business, including:
        • managing our relationship with clients;
        • developing our businesses and services (such as identifying client needs and improvements in service delivery and learning more about a client, relationship opportunity we have an interest in);
      • Analysing and evaluating the strength of interactions between us and a contact.
      • Performing analytics, including producing metrics for Corient leadership, such as on trends, relationship maps, sales intelligence and progress against account business goals;
      • Administering and managing our website and systems and applications.

Providing information about us and our range of services

Unless we are asked not to, we use client business contact details to provide information that we think will be of interest about us and our services.  For example, our newsletter, blogs, other services that may be relevant.

Corient does not sell or otherwise release personal data contained in the Corient CRM to third parties for the purpose of allowing them to market their products and services.

iii. Data Retention Policy

Personal data will be retained on the Corient CRM for as long as we have, or need to keep a record of, a relationship with a business contact, which is for the duration of our relationship with a contact or their organisation.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights. 

iv. Data Sharing

The Corient CRM is inhouse developed and is hosted on secured cloud servers within United Kingdom.  The information in the Corient CRM may be accessed by Corient Group Companies for the purposes described above.

b. Our Clients- Individuals, Sole Proprietors, Partnership Firms, LLPs, Limited Companies
i. Collection of Data

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data with us where it is strictly needed for those purposes.

Where we need to process personal data to provide professional services, we ask our clients to provide the necessary information to the data subjects regarding its use.  Our clients may use relevant sections of this privacy statement or refer data subjects to this privacy statement if they consider it appropriate to do so.

The categories of personal data processed by us in relation to the services we provide to our clients are generally:

      • Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
      • Contact details (e.g. email address, contact number, postal address);
      • Financial details (e.g. salary and other income and investments, benefits, tax status); and
      • Job details (e.g. role, grade, experience and performance information).

For providing Payroll Services to our clients, we may collect the above data for employees, contractors and sub-contractors of the client

Generally, we collect personal data from our clients or from third parties when providing services to the relevant client.

ii. Use​ ​of​ ​personal​ data

Providing professional services

We provide a diverse range of professional services including Book Keeping, VAT, Payroll, Management Accounts, Accounts Preparation and Personal Tax and Corporate Tax. Some of these services require us to process personal data in order to provide required deliverables

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data). Some of the measures we taken to ensure our clients data is protected are mentioned below:

      • The Network and Data Structure are ISO 27001 Certified
      • Paperless Environment
      • Automated Scans to identify harmful emails
      • Firewalls and other applicable security standards to detect, investigate and eliminate data threats
      • Policies and Procedures to monitor usage of data
      • Restricted use of Mobile Phones on the operations floor
      • 2 Level Authentication for accessing systems
      • Biometric access to ensure authorise access to the operations floor
        • Restriction on Computers, etc for transfer of data

Further, we have procedures in place to monitor the quality of our services and manage risks in relation to our client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures.

iii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is 7 years.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iv. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use group companies to help us deliver our services as agreed with our client on an engagement-specific basis.

c. Individuals whose personal data we obtain in connection with providing services to our clients
i. Collection of Data

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data with us where it is strictly needed for those purposes.

Where we need to process personal data to provide professional services, we ask our clients or our client’s clients to provide the necessary information to the data subjects regarding its use.  Our clients or their clients may use relevant sections of this privacy statement or refer data subjects to this privacy statement if they consider it appropriate to do so.

The categories of personal data processed by us in relation to the services we provide to our clients are generally:

      • Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
      • Contact details (e.g. email address, contact number, postal address);
      • Financial details (e.g. salary and other income and investments, benefits, tax status); and
      • Job details (e.g. role, grade, experience and performance information).

For providing Payroll Services to our clients, we may collect the above data for employees, contractors and sub-contractors of the client’s client

Generally, we collect personal data from our clients or from third parties when providing services to the relevant client.

ii. Use​ ​of​ ​personal​ data

Providing professional services

We provide a diverse range of professional services including Book Keeping, VAT, Payroll, Management Accounts, Accounts Preparation and Personal Tax and Corporate Tax. Some of these services require us to process personal data in order to provide required deliverables

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data). Some of the measures we taken to ensure our clients data is protected are mentioned below:

      • The Network and Data Structure are ISO 27001 Certified
      • Paperless Environment
      • Automated Scans to identify harmful emails
      • Firewalls and other applicable security standards to detect, investigate and eliminate data threats
      • Policies and Procedures to monitor usage of data
      • Restricted use of Mobile Phones on the operations floor
      • 2 Level Authentication for accessing systems
      • Biometric access to ensure authorise access to the operations floor
      • Restricted Data Transfer Controls
      • Accessing Clients data through Clients network only

Further, we have procedures in place to monitor the quality of our services and manage risks in relation to our client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures.

iii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is based on our client’s guidelines.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iv. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

d. Recruitment Applicants

This section of our privacy statement describes why and how we collect and use personal data in connection with our recruitment activities.

If your application is successful, we carry out pre-employment screening checks as part of our onboarding process.  Depending on the role you have applied for, these checks may include criminal records checks.

i. Collection of Data

We will collect personal data in connection with our recruitment activities as described below.

Most of the personal data we collect as part of our recruitment process is provided by you such as:

      • Contact details (name, email, telephone number);
      • Areas of interest;
      • CV, experience, education, academic and professional qualifications;
      • Information provided as part of interviews and assessments;
      • Pre-employment screening information if your application is successful;
      • Information about you and your immediate family’s financial relationships if your application is successful; and
      • Bank account details if your application is successful.

We create personal data in connection with our recruitment activities such as:

      • Interview and assessment results and feedback; and
      • Offer details

We obtain personal data from third party sources such as:

      • References from your named referees;
      • Information from your referrer (where applicable);
      • Results of Disclosure and Barring Service checks (depending on the role applied for);
      • Verification of information provided during the recruitment process by contacting relevant third parties (for example, previous employers, education and qualification providers) or using publicly available sources (for example, to verify your experience, education and qualifications); and
      • Information from social media sites that you are a member of about your engagement with our recruitment campaigns.
ii. Use​ ​of​ ​personal​ data

We process personal data for our legitimate interests to attract and secure the best talent to work with us as follows:

      • To attract talent and market opportunities at Corient by using recruiters to help find talent for us.
      • To identify and source talent by searching our existing talent pool and publicly available sources (such as social media and job websites of which you are a member).
      • To process and manage applications for roles at Corient, evaluate you for open positions that match your interests and experience, manage your candidate profile, send you email notifications and other announcements, request additional information or otherwise contact you about your candidacy.
      • To screen and select talent by evaluating your suitability for employment with Corient, including through interviews and assessments and conducting background checks.
      • To hire and onboard talent by making an offer to successful applicants and carrying out pre-employment screening checks.
      • To conduct statistical analyses and create reports including for example regarding usage of our careers websites, demographic analysis of candidates, reports on Corient recruitment activities, and analysis of candidate sourcing channels.
      • To administer and manage our careers websites and communicate with you about careers at Corient.
      • Any other purposes stated when you provide the information to Corient.
iii. Data retention

We retain personal data processed in connection with our recruitment activities as follows:

      • If your application is successful we will retain relevant personal data as part of your employee record
      • If your application is unsuccessful, we will retain and use the information you provided to Corient as part of your application for a reasonable period of time to deal with any matter which may arise in connection with your application, for purposes of contacting you regarding other employment opportunities and for our legitimate business purposes (for example, to make sure we do not contact an individual about a role they have already applied for)
iv. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

e. Our Staff

We collect personal data concerning our own personnel (Directors, staff and contractors) as part of the administration, management and promotion of our business activities.

Please refer to our internal Privacy Statement available with Human Resources department for information on why and how personal data is collected and processed in relation to your role with Corient.

f. Suppliers
We collect and process personal data about our suppliers (including subcontractors and individuals associated with our suppliers and subcontractors) in order to manage the relationship, contract, to receive services from our suppliers and, where relevant, to provide professional services to our clients.  The personal data is generally business card data and will include name, employer name, phone, email and other business contact details and the communications with us.
i. Use​ ​of​ ​personal​ data

Receiving services

We process personal data in relation to our suppliers and their staff as necessary to receive the services. 

Providing professional services to clients

Where a supplier is helping us to deliver professional services to our clients, we process personal data about the individuals involved in providing the services in order to administer and manage our relationship with the supplier and the relevant individuals and to provide such services to our clients

ii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  Personal data will be retained about our contacts at our suppliers for as long as it is necessary for the purposes set out above (e.g. for as long as we have, or need to keep a record of, a relationship with a contact, which is for the duration of our relationship with a contact or their organisation) and then deleted in line with our deletion and retention policies.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iii. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

g. Individuals who use our Applications
We provide registered users access to various applications managed by us. These applications include Document Scanning Apps, Invoice Processing Workflow, Document Management System, Payslip Portal, Time Sheet Processing Software, etc
i. Use​ ​of​ ​personal​ data

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data with us where it is strictly needed for those purposes.

      • The categories of personal data stored on our application provided to our clients are generally:
      • Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
      • Contact details (e.g. email address, contact number, postal address);
      • Financial details (e.g. salary and other income and investments, benefits, tax status); and
      • Job details (e.g. role, grade, experience and performance information).

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data). Some of the measures we taken to ensure our clients data is protected are mentioned below:

      • The Network and Data Structure are ISO 27001 Certified
      • All the data is stored within UK having following minimum standards:
        • SSAE 16 SOC 1 Type 2 and SOC 2 Type 2 Attestation
        • PCI Data Compliant
        • ISO 27001 Compliant
        • HIPAA and HITECH Compliant
        • Virtual Private Network through private IP address ranges
        • 256 bit AES Encryption
        • Deployment of Anti Malware
        • Multi Factor Authentication
        • Intrusion detection/Distributed Denial of Service (DDoS) Defense
        • Regular Penetration Testing
        • Network Isolation
        • Virtual Networking
      • Automated Scans to identify harmful emails
      • Firewalls and other applicable security standards to detect, investigate and eliminate data threats
      • Policies and Procedures to monitor usage of data

Further, we have procedures in place to monitor the quality of our applications and manage risks in relation to our client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures.

ii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  Personal data will be retained for as long as it is necessary for the purposes set out above (e.g. for as long as we have, or need to keep a record of, a relationship with a contact, which is for the duration of our relationship with a contact or their organisation) and then deleted in line with our deletion and retention policies.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iii. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

Log Files

https://www.corient.tech/ follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services’ analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users’ movement on the website, and gathering demographic information.

Cookie and Web Beacons

Like any other website, https://corient.tech/ uses ‘cookies’. These cookies are used to store information including visitors’ preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users’ experience by customizing our web page content based on visitors’ browser type and/or other information.

Data Security

We take the security of all the data we hold very seriously. We adhere to internationally recognised security standards and our information security management system relating to client confidential data is independently certified as complying with the requirements of ISO/IEC 27001: 2013. We have a framework of policies, procedures and training in place covering data protection, confidentiality and security and regularly review the appropriateness of the measures we have in place to keep the data we hold secure.

Security precautions in place to protect the loss, misuse or alteration of your information

All the data is stored within UK having following minimum standards:

  • SSAE 16 SOC 1 Type 2 and SOC 2 Type 2 Attestation
  • PCI Data Compliant
  • ISO 27001 Compliant
  • HIPAA and HITECH Compliant
  • Virtual Private Network through private IP address ranges
  • 256 bit AES Encryption
  • Deployment of Anti Malware
  • Multi Factor Authentication
  • Intrusion detection/Distributed Denial of Service (DDoS) Defense
  • Regular Penetration Testing
  • Network Isolation
  • Virtual Networking
  • Automated Scans to identify harmful emails
  • Firewalls and other applicable security standards to detect, investigate and eliminate data threats

Policies and Procedures to monitor usage of data

Third-party service providers working on our behalf

We may pass your information to our third-party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing products and / or services to you on our behalf, for example for the purpose of running and measuring the effectiveness of advertisement campaign and/or personalize the advertising campaigns. However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own purposes.
We have put in place measures, based upon model contract clauses supplied by the European commission to ensure your personal data is treated by those third parties in a way consistent with and which respects the data protection legislation. The servers powering and facilitating that cloud infrastructure are located in secure data centers in United Kingdom, and personal data may be stored in any one of them. Further details of these providers are mentioned below:

NameRoleAddress
Microsoft LimitedAzure cloud services, Office 365 and Mail ExchangeMicrosoft Campus, Thames Valley Park, Reading, RG6 1WG, UK
Rackspace LimitedCloud Services for Data StorageHyde Park Hayes, 5 Millington Rd, Hayes UB3 4AZ, UK
OVH CloudCloud Services for Data StorageNew London House, 6 London St, London EC3R 7LP, United Kingdom
Corient Business Solutions Private LimitedProcessing Services101, Sai Sampann, Station Road, Vikhroli East, Mumbai 400083, India
Mail ChimpE Mail Management Software for managing Marketing and Newsletter Servicesc/o The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE Suite 5000, Atlanta, GA 30308 USA

As part of the services offered to you, we may send your data outside of the European Economic Area (EEA).  Where this is the case, we will take reasonable steps to ensure that your data is protected in the same way as if it was being used in the EEA.  For example, where third party suppliers store data in the US, we will ensure that their services fall within the Privacy Shield. https://www.privacyshield.gov

We may use third parties located in other countries to help us run our business. As a result, personal data may be processed outside the countries where we and our clients are located. This includes countries outside the European Union and to countries that do not have laws that provide specific protection for personal data. We have taken steps to ensure all personal data is provided with adequate protection and that all transfers of personal data outside the EU are done lawfully.

Data Inspection

We strive to be as open as we can be in terms of giving people access to their personal data. A Subject Access Request under the GDPR is your right to request a copy of the information that we hold about you. Such requests must be in writing to the contact details provided in this policy. If we do hold your personal data we will respond in writing within one calendar month of your request (where that request was submitted in accordance with this policy).

The information we supply will confirm that:

  • Your data is being processed;
  • Verify the lawfulness and the purpose of the processing;
  • Confirm the categories of personal data being processed;
  • Confirm the type of recipient to whom the personal data have been or will be disclosed, and
  • Let you have a copy of the data in an intelligible form.
  • Please note that you may need to provide identification in order to prove who you are to access your data.
  • If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
  • In the instance that we do not hold information about you we will also confirm this in writing at the earliest opportunity.

Individuals’ rights and how to exercise them

Individuals have certain rights over their personal data and controllers are responsible for fulfilling these rights.

Individuals’ rights may include the right of access to personal data, to rectification of personal data, to erasure of personal data / right to be forgotten, to restrict processing of personal data, to object to processing of personal data, to data portability, the right to withdraw consent at any time (where processing is based on consent) and the right to lodge a complaint with a supervisory authority.

Please see further information about these rights, when they are available and how to exercise them below.

Your right of access to personal data

You have the right to obtain confirmation as to whether we process personal data about you, receive a copy of your personal data held by us as a controller and obtain certain other information about how and why we process your personal data (similar to the information provided in this privacy statement). This right may be exercised by emailing us at info@corientbs.com. We aim to respond to any requests for information promptly, and in any event within the legally required time limits.

Your right to rectification / amendment of personal data

You have the right to request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete personal data completed.

To update personal data submitted to us, you may email us at info@corientbs.com or, where appropriate, contact us via the relevant website registration page or directly amend the personal details held on relevant websites or applications with which you registered.

When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make updates as appropriate based on your updated information.

Your right to erasure / right to be forgotten
You have the right to obtain deletion of your personal data in the following cases:

  • the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
  • our legal grounds for processing is consent, you withdraw consent and we have no other lawful basis for the processing;
  • our legal grounds for processing is that the processing is necessary for legitimate interests pursued by us or a third party, you object to our processing and we do not have overriding legitimate grounds;
  • you object to our processing for direct marketing purposes;
  • your personal data have been unlawfully processed; or
  • your personal data must be erased to comply with a legal obligation to which we are subject.

To request deletion of your personal data, please email us at info@corientbs.com.

Your right to restrict processing

You have the right to restrict our processing of your personal data in the following cases:

  • for a period enabling us to verify the accuracy of your personal data where you have contested the accuracy of the personal data;
  • your personal data have been unlawfully processed and you request restriction of processing instead of deletion;
  • your personal data are no longer necessary in relation to the purposes for which they were collected and processed but the personal data are required by you to establish, exercise or defend legal claims; or
  • for a period enabling us to verify whether the legitimate grounds relied on by us override your interests where you have objected to processing based on it being necessary for the pursuit of a legitimate interest identified by us.

To restrict our processing of your personal data, please email us at info@corientbs.com.

Your right to object to processing
Where we process personal data based on consent, individuals have a right to withdraw consent at any time.  We do not generally process personal data based on consent (as we can usually rely on another legal basis). Where we rely on your consent for our processing of your personal data, to withdraw your consent please email us at info@corientbs.com or, to stop receiving an email from a Corient Marketing list, please click on the unsubscribe link in the relevant email.  Please see the relevant “Use of personal data” sections of this privacy statement for further details about our processing of personal data based on consent.

Online Privacy Policy Only

This privacy policy applies only to our online activities and is valid for visitors to our website with regards to the information that they shared and/or collect in https://www.corient.tech/. This policy is not applicable to any information collected offline or via channels other than this website.

Children's Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity. https://www.Corient.tech/ does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.

Complaints

Please send an email with the details of your complaint to info@corientbs.com. We will look into and respond to any complaints we receive.

You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred within the EU. The Information Commissioner’s Office (“ICO”) is the UK data protection regulator/supervisory authority. For further information on your rights and how to complain to the ICO, please refer to the ICO website.

Consent

By using our website, you hereby consent to our Privacy Policy and agree to its Terms and Conditions.