Claromentis has created this privacy statement in order to demonstrate our firm commitment to privacy. We operate websites based in the UK, Australia, and United States of America.
These websites are owned by Claromentis Limited or its wholly owned subsidiaries. As the central administration for the websites is based in the UK we apply EU/UK law to the privacy principles for each one. This Privacy Statement also applies to any other websites we may establish in the future, in any location, and which are not specifically named here.
2. Definitions and Interpretation
In this Policy, the following terms shall have the following meanings:
|“websites”||www.claromentis.com, discover.claromentis.com, workplace.claromentis.com|
|“cookie(s)”||This is a small text file that is placed on your computer or device by the browser when you visit certain parts of our websites and/or when you use certain features of our websites. Details of the Cookies used by websites are set out below.|
|GDPR||EU Regulation 2016/679 – the General Data Protection Regulation (“GDPR”). The GDPR is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU).|
|“personal data”||Any data that relates to an identifiable person who can be directly or indirectly identified from that data. In this case, it means personal data that you give to us on these websites. This definition shall, where applicable, incorporate the definitions provided in the GDPR.|
|“we/us/our”||Claromentis Ltd – see section 3 for further details|
3. Claromentis Ltd
These websites are owned and operated by Claromentis, a limited company registered in England under company number 03672955, whose registered address is Cardens Accountants, The Old Casino, 28 Fourth Avenue, Hove, East Sussex, BN3 2PJ, and whose main trading address is Claromentis Ltd, 6th Floor, Vantage Point, New England Road, Brighton, East Sussex, BN1 4GW.
Our Data Protection Manager is Will Emmerson, and can be contacted by email at firstname.lastname@example.org, by telephone on UK) 0800 409 6101 US) 1 (844) 238 6868 , or by post at Claromentis Ltd, 6th Floor, Vantage Point, New England Road, Brighton, East Sussex, BN1 4GW.
4. Your Rights
1) As a data subject, you have the following rights under the GDPR, which this Policy and our use of personal data have been designed to uphold:
- The right to be informed about our collection and use of personal data
- The right of access to the personal data we hold about you (see section 10)
- The right to rectification if any personal data we hold about you is inaccurate or incomplete (please contact us using the details in section 12)
- The right to be forgotten – i.e. the right to ask us to delete any personal data we hold about you (we only hold your personal data for a limited time, as explained in section 6 but if you would like us to delete it sooner, please contact us using the details in section 12)
- The right to restrict (i.e. prevent) the processing of your personal data;
- The right to data portability (obtaining a copy of your personal data to re-use with another service or organisation)
- The right to object to us using your personal data for particular purposes; and
- Rights with respect to automated decision making and profiling.
2) If you have any cause for complaint about our use of your personal data, please contact us using the details provided in section 12 and we will do our best to solve the problem for you. If we are unable to help, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.
3) For further information about your rights, please contact the Information Commissioner’s Office or your local Citizens Advice Bureau.
5. What data do we collect?
|Quote requests||We collect basic company and personal data so that we can provide accurate quotes for the products and services we provide|
|Personalised demo||In order to arrange a personalised demo with a member of our team, we ask for a few personal contact details in order to fulfil this request|
|Brochure/advice guide/e-book downloads||We collect basic personal data so that we can provide you with a link to the downloads and information about Claromentis|
|Instant access demo (“try our software) – workplace.claromentis.com||We’ll ask for certain contact details in order to provision an account for this system|
|Contact form||If you’d like to get in contact with us, the contact form require basic personal information that will allow us to email you back|
|Support portal – discover.claromentis.com||Our support portal will collect personal data that will allow us to process support tickets, change requests, upgrades that allow us to fulfil each contract with our clients. We’ll also collect statistics and feedback that allows us to improve the products and services that we provides.|
6. How do we use your data?
1) All personal data is processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with our obligations and safeguard your rights under the GDPR at all times. For more details on security see section 7, below.
2) Our use of your personal data will always have a lawful basis, either because it is necessary for our performance of a contract with you, because you have consented to our use of your personal data (e.g. by subscribing to emails), or because it is in our legitimate interests. Specifically, we may use your data for the following purposes:
- Providing and managing your access to our websites
- Personalising and tailoring your experience on our websites
- Supplying our products and services to you – please note that we require your personal data in order to enter into a contract with you
- Replying to emails from you
- Replying to messages from you that are sent via Hubspot.
- Supplying you with emails sent from HubSpot when you download a brochure/advice guide/e-book on our websites, which provides you with a link to the download and follow-up emails with content offers that are relevant to you (you may unsubscribe or opt-out at any time by clicking the “unsubscribe” link at the bottom of the email, which will allow you to unsubscribe from our HubSpot campaigns). The Sales team may also contact you directly via email and/or telephone (if provided) to see if they can help you with further information.
- Supplying you with emails sent from HubSpot when you request an instant access demo (“try our software”) for workplace.claromentis.com which provides advice on how to use the demo, information about a selection of our clients, and information about how to pursue your interest in Claromentis further (you may unsubscribe or opt-out at any time by clicking the “unsubscribe” link at the bottom of the email, which will allow you to unsubscribe from our HubSpot campaigns). The Sales team may also contact you directly via email and/or telephone (if provided) to see if they can help you with further information.
- Supplying you with emails sent from HubSpot after a period of time subsequent to your initial interest in Claromentis (downloading a brochure/advice guide/e-book or requesting an instant access demo (“try our software”)) which provides you with relevant information about Claromentis products and/or services which we think you may find interesting (you may unsubscribe or opt-out at any time by clicking the “unsubscribe” link at the bottom of the email, which will allow you to unsubscribe from our HubSpot campaigns).
- Supplying you with any other emails/newsletters that you have explicitly opted into (you may unsubscribe or opt-out at any time by clicking the “unsubscribe” link at the bottom of the email, which will allow you to unsubscribe from our HubSpot campaigns).
- Market research
- To gain feedback and opinion on the product and/or services that we provide
- We may contact customers either directly or via a third-party service to request a review based on the customer’s experience of our product and/or services.
3) With your permission and/or where permitted by law, we may also use your data for marketing purposes which may include contacting you by email with information, news and offers on our products and services. We will not, however, send you any unsolicited marketing or spam and will take all reasonable steps to ensure that We fully protect your rights and comply with our obligations under the GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
4) Third parties whose content appears on our websites may use third party cookies, as detailed below in section 9. Please refer to section 9 for more information on controlling Cookies. Please note that we do not control the activities of such third parties, nor the data they collect and use and advise you to check the privacy policies of any such third parties.
5) You have the right to withdraw your consent to us using your personal data at any time, and to request that we delete it. Please refer to section 10 for details on how to do this.
6) We do not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. Data will therefore be retained for the following periods (or its retention will be determined on the following bases):
- Personal data used for Newsletters/Marketing: We’ll maintain a list of subscribers who are actively participating in our email campaigns. If the subscriber signed up over 5 years ago AND hasn’t opened any of the last 5 campaigns we will remove and delete any personal data for this subscriber.
- Personal data used to communicate with potential customers will be kept for up to 5 years after the initial enquiry or until requested otherwise (see section 10)
- We’ll store any personal data used in order to fulfil our contractual obligations for the product and/or service that we provide, for the length of the contract and for up to 5 years after the contract has been terminated.
7. How and where do we store your data?
We only keep your personal data for as long as we need to in order to use it as described above in section 6, and/or for as long as we have your permission to keep it.
Some or all of your data may be stored outside of the European Economic Area (“the EEA”) (The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein). You are deemed to accept and agree to this by using our website and submitting information to us. If we do store data outside the EEA, we will take all reasonable steps to ensure that your data is treated as safely and securely as it would be within the UK and under the GDPR. Data security is very important to us, and to protect your data we have taken suitable measures to safeguard and secure data collected through our websites.
We’ll only provide access to personal data for sub-processors based outside of the EEA so long as they are based in countries that are deemed to have “adequate protection” according to the GDPR article 45 of Regulation (EU) 2016/679.
Some of our sub-processors are based outside of the EU (for example, in the United States) but are classified by the European Commission as providing “adequate” levels of personal data protection. Whilst the Privacy Shield is currently invalidated, we instead will offer SCC’s (Standard Contractual Clauses) to any client, within our DPA (Data Processing Agreement) which is available for you to sign at the following link: https://discover.claromentis.com/pages/gdpr-dpa
In addition to that, our SaaS platform can be hosted in any one of the following regions, depending on your needs:
- London (europe-west2)
- Frankfurt (europe-west2)
- South Carolina (us-east1)
Here are some of the controls that we use to comply with GDPR and ensure the privacy of your data:
We thoroughly review all new sub-processors by conducting a Data Protection Impact Assessment in order to validate the compliance and controls of the sub-processor, assess the risks, and to ensure adequate protection is put in place to mitigate any risks. We update new and existing clients when there are any changes to our list of sub-processors.
Our team maintains a central register of all data so that it’s clear why we’re collecting data, what type of data is collected and how, and a description of any transfer of data.
We maintain security controls according to HIPAA and ISO 27001 standards. This includes, but is not limited to, secure hosting with Google Cloud Platform (https://cloud.google.com/security/overview/whitepaper), strong encryption, background checks for staff, regular vulnerability scanning, monitoring, firewalls, endpoint protection, incident management, and regular audits.
8. Do we share your data?
Personal information will not be released to any other third parties (such as a Claromentis Business Partner) except to progress the matter for which you provided the information in the first instance unless the release of your personal information is required by law or is pertinent to governmental or judicial investigations or proceedings.
‘Business Partners’ are defined as Distributors, Resellers, or Channel Partners of Claromentis with each one delivering varying levels of goods or services depending upon their relationship with Claromentis. If you have any concerns about a particular Business Partner, whether they are listed or not, you should contact us before you provide us with your personal information.
The Claromentis & Claromentis websites may contain links to other, external websites. Operation of these links will not cause your personal information to be transmitted to these sites. Likewise, Claromentis cannot be held responsible for the Privacy Principles of other entities.
We may sometimes contract with third parties to supply services to you on our behalf. These may include search engine facilities, analytics, advertising, and marketing. In some cases, the third parties may require access to some or all of your data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the law.
We may compile statistics about the use of our site including data on traffic, usage patterns, user numbers, sales, and other information. All such data will be anonymised and will not include any personally identifying data, or any anonymised data that can be combined with other data and used to identify you. We may from time to time share such data with third parties such as prospective investors, affiliates, partners, and advertisers. Data will only be shared and used within the bounds of the law.
We may sometimes use third party data processors that are located outside of the European Economic Area (“the EEA”) (The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein). Where we transfer any personal data outside the EEA, we will take all reasonable steps to ensure that your data is treated as safely and securely as it would be within the EU/UK and under the GDPR. We also ensure that each of these sub-processors has signed up to the EU Privacy Shield.
Please see the list below for a summary of our key sub-processors and a link to a confirmation of their Privacy Shield participation:
|Our cloud infrastructure is built on the Google Cloud IaaS named Google Compute Engine. We use this to host our SaaS software and the websites that support this.||https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI|
|HubSpot||We manage marketing email and newsletter campaigns through HubSpot.||https://www.privacyshield.gov/participant?id=a2zt0000000TN8pAAG&status=Active|
|SendGrid||SendGrid is used on our SaaS infrastructure in order to send out email notifications (an email relay service) from the clients digital workplace to the end user(s). For example, a simple notification about a new document upload would be sent out using this service.||https://www.privacyshield.gov/participant?id=a2zt0000000TRktAAG|
|Basecamp||This is used for the management of the initial project launch only, for communication between the Claromentis Service Delivery team and the client.||https://www.privacyshield.gov/participant?id=a2zt0000000TP1OAAW|
|G2||On occasion, we use G2 to collect customer reviews. Either G2 or Claromentis will communicate directly with customers to request a review.||https://www.privacyshield.gov/participant?id=a2zt00000008VveAAE&status=Active|
|Slashdot Media||On occasion, we use Slashdot Media’s software review generation service, SourceForge, to collect customer reviews. Either SourceForge or Claromentis will communicate directly with customers to request a review.||https://www.privacyshield.gov/participant?id=a2zt0000000Gnf1AAC&status=Active|
|Automate.io||We use Automate.io to send customer upgrade feedback to HubSpot.||https://www.privacyshield.gov/participant?id=a2zt00000008VaaAAE&status=Active|
|Survicate||We use Survicate to collect feedback on tickets completed on our Discover support portal.||Survicate have not signed up to Privacy Shield, however, Claromentis have signed a DPIA with them.|
By using our websites, you may also receive certain third party cookies on your computer or device. Third party cookies are those placed by websites, services, and/or parties other than us. Third Party cookies are used on our websites for the reasons shown in the table below.
All cookies used by and on our websites are used in accordance with current laws under GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003;
By giving your consent to the placing of cookies you are enabling us to provide the best possible experience and service to you. You may, if you wish, deny consent to or block the placing of cookies (including essential cookies); however certain features of our websites may not function fully or as intended or you may not be able to access all or parts of our website. Certain features of our websites depend on cookies to function.
The following essential cookies/scripts may be placed on your computer or device:
|Name of cookie/script||Purpose|
|JSESSIONID||Used by sites written in JSP. General purpose platform session cookies that are used to maintain users’ state across page requests.|
|__cfduid||The cookie is set by CloudFare. The cookie is used to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.|
|PHPSESSID||Used by WordPress to maintain user session variables, such as logged in status and UX.|
|Click Cease||This script protects against Click Fraud excluding invalid IPs and fake clicks|
The following first party cookies may be placed on your computer or device:
|Name of cookie||Purpose|
|popup||Claromentis e-book pop-up.|
|downloaded||Remembers if you have downloaded the Claromentis e-book.|
and the following third party cookies may be placed on your computer or device:
|Name of cookie/script||Provider||Purpose|
|UserMatchHistory||LinkedIn – Used to track visitors on multiple websites, in order to present relevant advertisement based on the visitor’s preferences.|
|lidc||This cookie is set by LinkedIn and used for routing.|
|gwcc||This cookie is set by Google Website Call Conversion. The cookie is used to track any call conversions on mobile devices.|
|bcookie||This cookie is set by LinkedIn. The purpose of the cookie is to enable LinkedIn functionalities on the page.|
|__hssrc||HubSpot||This cookie is set by HubSpot. According to their documentation, whenever HubSpot changes the session cookie, this cookie is also set to determine if the visitor has restarted their browser. If this cookie does not exist when HubSpot manages cookies, it is considered a new session.|
|__hssc||HubSpot||This cookie is set by HubSpot. The purpose of the cookie is to keep track of sessions. This is used to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. It contains the domain, viewCount (increments each pageView in a session), and session start timestamp.|
|test_cookie||.doubleclick.net||This cookie is set by doubleclick.net. The purpose of the cookie is to determine if the users’ browser supports cookies.|
|li_sugr||This cookie is set by LinkedIn, it is a browser identifier when IP address is not in a Designated Country|
|__ar_v4, __adroll, __adroll_consent_params, __adroll_fpc, __adroll_shared, __consent||AdRoll remarketing||Claromentis occasionally uses the AdRoll display advertising network to collect visitor data on our site and then serve targeted display ads to you on other sites. Our partners use technology such as cookies and web beacons to collect this data. For more information or to opt-out of this type of advertising, please visit AdRoll’s preference centre.|
|_uetsid||Bing||This is a tracking cookie utilised by Microsoft Bing Ads. It allows us to engage with a user that has previously visited our website. It expires 30 minutes after the browsing session ends. For more information, please visit Remarketing in Paid Search policies – Microsoft Advertising.|
|__utmc||Google Remarketing & Google AdWords Conversion||This cookie is used to personalise online ads based on past actions of our online customers. Expires after the browsing session ends.|
|__utmb, __utma, __utmz, __utmv||Google Remarketing & Google AdWords Conversion||This cookie is used to personalise online ads based on past actions of our online customers and to use analytics services that connects data from the Google AdWords advertising network with actions performed on the Website. Expires after 30min/24m/6m/24m. For more information, please visit Google Analytics Cookie Usage on Websites.|
|Name of cookie/script||Provider||Purpose|
|_ga||This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site’s analytics report. The cookies store information anonymously and assigns a randomly generated number to identify unique visitors.|
|_gid||This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the website is doing. The data collected including the number visitors, the source where they have come from, and the pages visited in an anonymous form.|
|_gat_UA-133450526-1||This is a pattern type cookie set by Google Analytics, where the pattern element on the name contains the unique identity number of the account or website it relates to. It appears to be a variation of the _gat cookie which is used to limit the amount of data recorded by Google on high traffic volume websites.|
|_gat||This cookies is installed by Google Universal Analytics to throttle the request rate to limit the collection of data on high traffic sites.|
|__hstc||HubSpot||This cookie is set by HubSpot and is used for tracking visitors. It contains the domain, utk, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).|
|hubspotutk||HubSpot||This cookie is used by HubSpot to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts.|
|_gat_UA-234921-1||This is a pattern type cookie set by Google Analytics, where the pattern element on the name contains the unique identity number of the account or website it relates to. It appears to be a variation of the _gat cookie which is used to limit the amount of data recorded by Google on high traffic volume websites.|
|_gat_gtag_UA_65661534_1||Google uses this cookie to distinguish users.|
|_session_id||G2||This cookie is set by G2. This cookie tracks whether website traffic is coming from G2’s website.|
|MUIDB, MUID||Bing||These cookies are used by Microsoft advertising to anonymously identify user sessions to help us measure the effectiveness of our marketing campaigns. The cookie is stored for up to two years. For more information, please visit Privacy and data protection policies – Microsoft Advertising.|
|_obid||SoPro||[This cookie is only set when a user is sent an outreach email from our email marketing partner SoPro]. This cookie is set when a user visits the site, and contains a unique ID relating to the email that has been clicked on. It is set to expire in 365 days.|
|_obid_visit||SoPro||[This cookie is only set when a user is sent an outreach email from our email marketing partner SoPro]. This is a session cookie and is used solely to identify a site session across multiple pages. It exists for the duration of a visitor’s session on the website.|
|Name of cookie/script||Provider||Purpose|
|1P_JAR, APISID, APISID, CONSENT, CONSENT, DSID, HSID, HSID, IDE, LOGIN_INFO, NID, PREF, SAPISID, SAPISID, SID, SID, SIDCC, SSID, SSID, VISITOR_INFO1_LIVE, YSC, __utmx, __utmxx||YouTube||Cookies set by Google when a YouTube video is present.|
|_hjIncludedInSample, __hssrc, __hstc, _ga, hubspotutk, intercom-lou-c5ke8zbr, mp_hj_mixpanel, optimizelyBuckets, optimizelyEndUserId, optimizelySegments||HotJar||Measures clicks across https://www.claromentis.com.|
|lang||This cookie is used to store the language preferences of a user to serve up content in that stored language the next time user visit the website.|
|messagesUtk||HubSpot||This cookie is set by HubSpot. This cookie is used to recognise the user who have chatted using the messages tool. This cookies is stored if the user leaves before they are added as a contact. If the returning user visits again with this cookie on the browser, the chat history with the user will be loaded.|
How to manage or opt out of cookies
You can manage your cookies by loading the cookie banner here and clicking “Cookies Preference Centre”.
You can choose to delete cookies on your computer or device at any time, however you may lose any information that enables you to access our website more quickly/efficiently including, but not limited to, login and personalisation settings.
It is recommended that you keep your internet browser and operating system up-to-date and that you consult the help and guidance provided by the developer of your internet browser and manufacturer of your computer or device if you are unsure about adjusting your privacy settings.
10. Request for access / accuracy & retention of data
The Claromentis product: We provide services to organisations, rather than end users. It is therefore the organisation who is the Data Controller, according to GDPR. As an end user of our product and in the first instance, you can edit your profile within the Claromentis product. Some fields may not be editable if these fields are synchronised from an external Identity Provider, User Directory, or if they are restricted fields, controlled by an intranet administrator. You can contact your intranet administrator if you would like to amend/delete personal data or to have your account deactivated, if required. Please speak to the Data Protection Officer/Manager at your organisation if you have any further questions about data privacy when using the Claromentis product.
Our websites: This applies to any data held by us related to websites we control for the purposes of Sales and Marketing, Billing/Administration or Support. You have the right to access, correct, amend or delete personal data held by us (where such data is held). Under the GDPR, no fee is payable and we will provide any and all information in response to your request free of charge. Please contact us for more details at email@example.com, or by using the contact details below in section 12.
11. Your Right to Withhold Information
You may access our websites without providing any data at all. However, to use all features and functions available on our websites you may be required to submit or allow for the collection of certain data.
12. Contacting Us
Last updated 2nd July 2021.