Privacy policy

Our details

Registered company name

Rushhh Limited t/a PathLab

Company number

11289773 (England & Wales)

Registered address

128 City Road
London
EC1V 2NX
United Kingdom

Telephone

+44 (0)116 504 6800

Email (General Data Queries)

jit@path2lab.com

Data protection officer

Jitesh Kotak

Email (Data Protection Officer)

jit@path2lab.com

Our role for GDPR purposes

In general, our role for GDPR purposes is categorised as a DATA PROCESSOR, occasionally we may act as a JOINT DATA CONTROLLER.

We only gather data about our client's activities and their customers when we have been given express authority to do so.

Such information is usually supplied directly to Us by the Client electronically.

Occasionally the Client will provide Us with direct access to their managed systems (such as 3rd Party Systems, Google Documents, etc). (we always encourage the use of strong encryption and secure data transfer practises)

We will only access and process our Client's data and that of their Customers in order to complete the required mandate in question. We may retain information in relation to business to business matters where we have express authority to do so.

We actively encourage

• Utilisation of data minimisation pseudonymisation techniques in order to exchange only the required information.
• Secure data through strong encryption and never to re-use passwords or use passwords that are easy to guess.
• Never exchange passwords / access keys through the same medium as the data was transferred (i.e.; e-mail) nor include these with the data itself.

Information we collect

We currently collect and may process the following information:

• Personal identifiers relating to your employees, contacts and characteristics
• Personal identifiers relating to your suppliers or potential suppliers, contacts and characteristics
• Personal identifiers relating to your end customers, contacts and characteristics
• Information about your organisation, systems, processes and procedures some of which may be attributable to a person or person(s)
• Certain business data such as forecast or sales related data some of which may be attributable to a person or person(s)
• Location based intelligence and places of business or activity some of which may be identifiable to a person or person(s)

Your data protection rights

Under data protection law, you have the following rights including:

Your right of access

You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.

Your right to erasure

You have the right to ask us to delete your personal information.

Your right to rectification

You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.

Your right to restriction of processing

You have the right to ask us to limit how we can use your personal information.

Your right to object to processing

You have the right to object to the processing of your personal data.

Your right to data portability

You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.

Your right to withdraw consent

When we use consent as our lawful basis you have the right to withdraw your consent at any time.

You can read more about these rights on the ICO website.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us by e-mailing jit@path2lab.com or using any of the contact details in the "our details" section of this policy.

There is no fee to making such requests provided they are reasonable and lawful.

Lawful purposes for processing data

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

a)

Your consent*

b)

We have a contractual obligation

c)

We have a legal obligation

d)

We have a vital interest^

e)

We need it to perform a public task^

f)

We have a legitimate interest^

*you are able to remove your consent at any time, this can be done by e-mailing jit@path2lab.com or using the contact details in the "our details" section of this policy.
^reasons d, e & f would not usually apply.

How we get information & why

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• For accounting purposes such as raising invoices
• To robustly communicate with the necessary stakeholders within your organisation
• Evaluate and diagnose business processes as agreed
• Recommend and implement changes to business processes as agreed

We also receive personal information indirectly, from the following sources in the following scenarios:

• External businesses you contract, or might contract with and have given consent to two-way communication
• Through relevant documents and data you or your associates have shared with us
• By directly accessing your managed systems, such as MetaPack to obtain information on a self-service basis

Data retention period / storage

Your information is securely stored.

In the event we utilise monday.com as part of any engagement or activity, unless otherwise agreed our standard data retention period (with continued read-only access to monday.com) is two years. We reserve the right to change logins to read-only and in the event monday.com make a charge for logins or KAHA Logistik terminate their relationship with monday.com in part or full, we will discuss data migration options with you.

In general, your options post engagement are:

1.

Data retained by Path2Lab with at least read-only access to monday.com for two years

2.

As above, with a data extract provided in an accessible format

3.

Data removed by Path2Lab (therefore access revoked), data extract provided in an accessible format

We keep organisational information including employee names and telephone numbers for a maximum of six years. We delete all end customer data with two or more identifiable attributes immediately upon completion of the contractual mandate. Data with one or less identifiable attributes may be stored in line with organisational information. This is done by expunging e-mails >6 years as well as regularly reviewing data stored on physical devices and cloud services.

Sharing and storing information outside the UK

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Organisation name

Monday.com

Category of recipient

Data repository / project management tool

Country the personal information is sent to

United States of America

How the transfer complies with UK data protection law

The country or sector has a UK data bridge (also known as Adequacy Regulations)

Exchange of information

Where given express permission to do so by our Client, we may share data with other organisations or individuals, we will always inform you before we do this and unless otherwise stated no more than one piece of customer identifiable data would be shared, for example postcode but never this in addition to another form of identifiable data such as order number, name, address, telephone number etc.

How to complain

If you have any concerns about our use of your personal information you are at liberty to take one of the following courses of action: