How we store and secure information we collect
Information storage and security
We use data hosting service providers in Frankfurt, Ireland and Massachusetts USA to host the information we collect, and we use technical measures to secure your data.
How long we keep information
How long we keep information we collect about you depends on the type of information, as described in further detail below. After such time, we will either delete or anonymize your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible.
Account information:
We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our
agreements, to support business operations, and to continue to develop and improve our Services. Where we retain information for Service improvement and development, we take steps to eliminate information that directly identifies you, and we only use the information to uncover collective insights about the use of our Services, not to specifically analyse personal characteristics about you.
Information you share on the Services:
If your account is deactivated or disabled, some of your anonymised information and the content you have provided will remain in order to allow your team members or other users to make full use of the Services. E.g. survey data that contributes benchmarking activities.
Marketing information:
We retain information about your marketing preferences for a reasonable period from the date you last expressed interest in our Services, such as when you last opened an email from us. We retain information derived from cookies and other tracking technologies for a reasonable period from the date such information was created.
How to access and control your information
You have certain rights available to you when it comes to your information. Below is a summary of those rights, how to exercise them and any limitations.
Your Rights:
You have the right to request a copy of your information, to object to our use of your information (including for marketing purposes), to request the deletion, correction or restriction of your information, or to request your information in a structured, electronic format. Your request and choices may be limited in certain cases: for example, if fulfilling your request would reveal information about another person, or if you ask to delete information which we or your administrator are permitted by law or have compelling legitimate interests to keep. If you have unresolved concerns, you may have the right to complain to a data protection authority in the country where you live, where you work or where you feel your rights were infringed.
Right of Access:
You have the right to access information held about you and you can ask us for a copy of the information at any time. Where we have good reason, and if the GDPR permits, we can refuse your request for a copy of your personal information, or certain elements of the request. If we refuse your request or any element of it, we will provide you with our reasons for doing so.
Deactivate your account:
If you no longer wish to use our Services, you or your administrator may be able to deactivate your Services account. If you can deactivate your own account, that setting is available to you in your account settings. Otherwise, please contact us. If you are an administrator and are unable to deactivate an account through your administrator settings, please contact us. Please be aware that deactivating your account does not delete your information; your information remains visible to other Service users based on your past participation within the Services. For more information on how to delete your information, see below.
Delete or Correct your information:
You can delete certain information about you from within the Service by making a request to us. Please note, however, that we may need to retain certain information for record keeping purposes, to complete transactions or to comply with our legal obligations. If personal information we hold about you is not accurate, out of date or incomplete, you have a right to have the data rectified, updated or completed.
Request that we stop using your information:
In some cases, you may ask us to stop accessing, storing, using and otherwise processing your information where you believe we don’t have the appropriate rights to do so. For example, if you believe a Services account was created for you without your permission or you are no longer an active user, you can request that we delete your account as provided in this policy. Where you gave us consent to use your information for a limited purpose, you can contact us to withdraw that consent, but this will not affect any processing that has already taken place at the time. You can also opt-out of our use of your information for marketing purposes by contacting us, as provided below. When you make such requests, we may need time to investigate and facilitate your request.
Turn off Cookie Controls:
Relevant browser-based cookie controls are described in our Cookie Policy.
Send “Do Not Track” Signals:
Some browsers have incorporated “Do Not Track” (DNT) features that can send a signal to the websites you visit indicating you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the DNT signal, our Services do not currently respond to browser DNT signals. You can use the range of other tools we provide to control data collection and use, including the ability to opt out of receiving marketing from us as described above.
Data portability:
Data portability is the ability to obtain some of your information in a format you can move from one service provider to another (for instance, when you transfer your mobile phone number to another carrier).
This right exists only in respect of personal information that:
• you have provided to us previously; and
• is processed by us using automated means.
Should you request it, we will endeavour to provide you with an electronic file of your basic account information.
While we are happy for such requests to be made, we are not able to guarantee technical compatibility with a third-party organisation’s systems. We are also unable to comply with requests that relate to personal information of others without their consent. You can exercise any of the above rights by contacting us using any of the methods in the Contact section.
Most of the above rights are subject to limitations and exceptions. We will provide reasons if we are unable to comply with any request for the exercise of your rights.
How we transfer information we collect internationally
International transfers of information we collect
We collect information globally and primarily store that information in Frankfurt, Ireland and Massachusetts USA We transfer, process and store your information outside of your country of residence, to wherever we or our third-party service providers operate for the purpose of providing you the Services. Whenever we transfer your information, we take steps to protect it.
International transfers within the HATCH Companies:
To facilitate our global operations, we transfer information to either Ireland, Frankfurt and Massachusetts USA and allow access to that information from countries in which the HATCH owned or operated companies have operations for the purposes described in this policy. These countries may not have equivalent privacy and data protection laws to the laws of many of the countries where our customers and users are based. When we share information about you within and among HATCH corporate affiliates, we make use of standard contractual data protection clauses, which have been approved by the European Commission, and we rely on the EU-U.S. Privacy Shield Framework to safeguard the transfer of information we collect from the European Economic Area, Australia and USA.
HATCH has implemented various processes to ensure compliance with the GDPR, in particular:
• We developed policies and procedures to address data subjects’ requests in strict compliance with the GDPR;
• We keep data processing records required by the GDPR;
• We appointed a Data Protection Officer to assure well-defined data protection control;
• We conduct GDPR compliance training for the persons who are authorized to process personal data within the company;
• We have a well-established mechanism of regular policies review to guarantee compliance with the data protection legislation;
• The processes within the company allow us to restore data availability and access in a timely manner in case of the unlikely technical accident;
• We are constantly implementing additional technical and administrative measures to secure NO personal data is collected in accordance with the GDPR.
Other important privacy information
Administrators
All our products are intended for use by organizations. Where the Services are made available to you through an organization (e.g. your employer), that organization is the administrator of the Services and is responsible for the accounts and/or Service sites over which it has control. If this is the case, please direct your data privacy questions to your administrator, as your use of the Services is subject to that organization’s policies. We are not responsible for the privacy or security practices of an administrator’s organization, which may be different than this policy.
Administrators are able to:
• restrict, suspend or terminate your access to the Services;
• access information in and about your account;
• access or retain information stored as part of your account;
• install or uninstall third-party apps or other integrations
Even if the Services are not currently administered to you by an organization, if you use an email address provided by an organization (such as your work email address) to access the Services, then the owner of the domain associated with your email address (e.g. your employer) may assert administrative control over your account and use of the Services at a later date. You will be notified if this happens.
If you do not want an administrator to be able to assert control over your account or use of the Services, use your personal email address to register for or access the Services. If an administrator has not already asserted control over your account or access to the Services, you can update the email address associated with your account through your account settings in your profile. Please contact your organization or refer to your administrator’s organizational policies for more information.
Our policy towards children
The Services are not directed to individuals under 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information. If you become aware that a child has provided us with personal information, please contact our support services.
Changes to our Privacy Policy
We may change this Privacy Policy from time to time. We will post any Privacy Policy changes on this page and, if the changes are significant, we will provide a more prominent notice by adding a notice on the Services homepages, login screens, or by sending you an email notification. We will also keep prior versions of this Privacy Policy in an archive for your review. We encourage you to review our Privacy Policy whenever you use the Services to stay informed about our information practices and the ways you can help protect your privacy.
If you disagree with any changes to this Privacy Policy, you will need to stop using the Services and deactivate your account(s), as outlined above.
Internet-based transfers
Given that the Internet is a global environment, using the Internet to collect and process personal data necessarily involves the transmission of data on an international basis. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site via third party networks; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Complaints
If you are unhappy about our use of your personal information, you can contact us using the details below. You are also entitled to lodge a complaint with the UK Information Commissioner’s
Office using any of the below contact methods:
Website: https://ico.org.uk/concerns/
If you live or work outside of the UK or you have a complaint concerning our activities outside of the UK, you may prefer to lodge a complaint with a different supervisory authority.
Contact Us
Your information is controlled by HATCH Analytics Ltd. If you have any enquires or if you would like to contact us about our processing of your personal information, including exercising your rights as outlined above, please contact:
When you contact us, we will ask you to verify your identity.
Email: hello @ hatchanalytics.com
Post:
HATCH Analytics Ltd
Medius House
2 Sheraton Street
London W1F 8BH
HATCH Analytics is a Limited company incorporated in England. Registered number 8967387 Registered office Medius House Lvl2 2 Sheraton Street London W1F 8BH
