Privacy Policy

Privacy Notice: rights of data subjects under the General Data Protection Regulation

EU Regulation 2016/679 (known as the General Data Protection Regulation, hereinafter referred to as “GDPR”) will apply throughout the EU (having commenced on 25 May 2018). This regulation serves as the basis for standardised European data protection law.

GDPR particularly obliges each relevant Scriptum Document Solutions Ltd entity (hereinafter referred to, either individually or collectively, as “Scriptum”) – as an EU personal data processor – to ensure data subjects whose personal data are processed by it are informed of the collection, processing and use of that personal data and to notify them of their rights under GDPR.

The following information therefore describes the processing of your personal data by Scriptum and your rights pursuant to GDPR. The precise data that are processed and the methods that may be used are primarily determined based on the particular services or products requested and/or agreed upon.

This notice applies to scriptumds.co.uk, shop.scriptumds.co.uk and scriptummanagedservices.co.uk.

References to ‘Partner’ in this notice mean a partner with whom Scriptum procures or introduces for the supply of products and services and/or from whom that Partner you the customer are supplied with products and/or services.

Controller in the sense of the GDPR

The controller for data collection, on which Scriptum is processing personal data, is:

Scriptum Document Solutions Ltd, 16 Beaufort Court, Admirals Way, Canary Wharf, London E14 9XL

Purpose of processing and legal basis for processing

Scriptum processes personal data in accordance with the provisions of the GDPR (and/or any other local laws implementing GDPR or otherwise governing data protection in the UK):

• As part of the performance of an existing contract between Scriptum and you or in order to take steps at the request of a customer or Partner prior to entering into a contract with Scriptum (Article 6 (1b) GDPR).
  Here, the purposes of the data processing are primarily determined by the particular product, service or offering. You can find additional details on the purpose of data processing in the product, service or offering related documents and the corresponding terms and conditions issued by Scriptum. However a non-exhaustive list is as follows: (i) provide customer support; (ii) introduce financial products; (iii) deliver the specific products and services requested by you.
• Based on your consent (Article 6 (1a) GDPR).
  In the event you have granted Scriptum consent to process personal data for specific purposes (e.g. for obtaining finance for you or your business), this processing is lawful based on your consent. Consent that has been granted may be withdrawn at any time and via the media through which it was obtained.
• Based on legal requirements Scriptum is obliged to comply with (Article 6 (1c) GDPR) or in the public interest (Article 6 (1e) GDPR). Examples include:
  • General legal, accounting, tax and regulatory reporting requirements
  • Supply chain auditing
  • Anti-money laundering obligations
  • Prevention of fraud
• In the context of legitimate interests (Article 6 (1f) GDPR).
  Where required, Scriptum processes your data in order to pursue our legitimate interests or those of third parties. Examples are:
  • Delivering the specific products and services contracted for
  • Preventing criminal offences
  • Ensuring IT security
  • Asserting legal rights and defence in the event of legal disputes
  • Customer Relationship Management

Source of data and category of data

Scriptum processes personal data that Scriptum obtains from you in the context of our business relationship. To the extent required to provide Scriptum products and services, Scriptum also processes personal data that Scriptum has obtained lawfully (e.g. for the performance of orders, for the fulfilment of contracts or based on consent granted by you) from our trading partners. Moreover, Scriptum processes personal data that Scriptum has lawfully acquired from publicly accessible sources (e.g. commercial registers, registers of associations, credit agencies press, media, websites) and that Scriptum is permitted to process.

Depending on the product / services Scriptum provides to you, the following categories of data might be collected in relation to our provision of maintenance services, managed print services, sales of equipment, supplies and spare parts, IT solutions, Finance & Leasing:

Name, function, employer, postal address/email address, phone number, contract data, IP address.

Recipients of personal data

Within Scriptum we essentially share your personal data with those who need to have access to it or use it, usually as necessary to complete any transaction or provide any product you have requested or authorised. We may also share it with those who wish to use it, in accordance with the law, to undertake marketing, provide rewards schemes or conduct customer surveys for example. In addition, and for the same purposes, we may share personal data among Scriptum controlled affiliates and subsidiaries.

Transfer of personal data to recipients outside Scriptum: We share your personal data with third parties when you tell us to do so. For example, when you provide payment data to make a purchase, we will share payment data with banks and other entities that process payment transactions or provide other financial services, and for fraud prevention and credit risk reduction. We also share personal data with vendors, sub-contractors or agents working on our behalf for the purposes described above. For example, companies we’ve hired to provide customer service support or assist in maintaining and servicing products or offering financial products via our systems and services may need access to personal data to provide those functions.

Duration of data storage

Scriptum processes and stores personal data as long as it is required to provide our products and services and to fulfil our contractual and legal obligations. The latter may include resolving disputes and enforcing our agreements.

However, ordinarily, if the personal data are no longer required for such purposes Scriptum will erase the personal data, unless processing and storage of the personal data is required for the following and similar purposes:

• Anti-money laundering, anti-bribery, currency reporting and record keeping requirements
• Regulatory and reporting compliance
• Prudent management of business risk having regard to contractual and other legal limitation periods

As a result, actual retention periods can vary.

Statutory or contractual requirement for the provision of personal data

You are obliged to provide such personal information to Scriptum as may be required to enable us to enter into a contract, fulfil our contractual obligations, or to comply with applicable legal requirements. Without this personal data Scriptum may not be able to enter into a contract for products and services with you or may not be able to fulfil its contractual obligations under an existing contract.

For example, we may need contact names for the addressing of invoices or for the delivery of parts and consumables.

Automated decision-making and profiling

Scriptum does not usually use automated decision-making and profiling according to Article 22 GDPR.

However there are some exceptions to this, the main one being in respect of providing or introducing leasing and finance services where for example we use directors’/senior employees’ personal data and personal data of smaller business owners and operators. That data is usually provided to be used by third parties such as credit reference agencies where an application for customer ‘credit’ is made by you. Automated decisions may be made as result, such as whether to extend credit and whether to trace defaulters and assets. These decisions may affect the individuals whose personal data is used, usually in a business context but possibly in a personal context too. However, we consider that this is standard and fair business practice.

Right of access, Article 15 GDPR

You have the right to request information as to whether and to what extent Scriptum processes your personal data.

This right includes the right to information on:

• the purposes of the processing;
• the categories of personal data (type of data) processed;
• the recipients or categories of recipients to whom the data have been or will be disclosed, particularly if data have been or will be disclosed to recipients in third countries;
• where possible, the envisaged period for which your data will be stored, but at least the criteria used to determine the period stored for;
• the source of the data if personal data was not collected directly from you.

Where personal data are transferred to a ‘third country’, you have the right to be informed of the safeguards we take, whereby an appropriate level of protection is ensured on the part of the data recipient in the third country.

Right to rectification, Article 16 GDPR

You have the right to request the rectification of your data stored by Scriptum if they are incorrect or incomplete. This includes the right to have incomplete personal data completed by means of supplementary statements or notices.

Right to erasure, Article 17 GDPR

You have the right (subject to certain conditions in GDPR) to request the erasure of your personal data (the ‘right to be forgotten’) if:

• the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
• the data processing is occurring based on consent granted by you and you have withdrawn your consent, provided there are no other legal grounds for the data processing;
• you have objected to data processing pursuant to Article 21 GDPR and there are no overriding legitimate grounds for further processing;
• your personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in the UK, European Union or Member State law.

Right to restriction of processing, Article 18 GDPR

You have the right to have the processing of your personal data restricted. This right exists in the following cases:

• If you have contested the accuracy of your personal data, you may also request that – for a period enabling Scriptum to verify the accuracy – your data not be used for purposes other than the verification of accuracy;
• If the processing of your personal data is unlawful, you may request restriction of the use of personal data instead of the erasure of that data;
• If Scriptum has stored personal data that are no longer needed by Scriptum but are required by you for the establishment, exercise or defence of legal claims, you can request restriction of the processing as an alternative to erasure of the data;
• If you have, under GDPR, objected to certain data processing and it has not yet been verified whether Scriptum’s interests in processing override your interests, you can request restriction of the processing for the review period.

Right to data portability, Article 20 GDPR

You have the right to request that the personal data concerning you be disclosed to you or to a representative designated by you in a commonly used electronic, machine-readable data format. This right only exists for personal data provided by you for processing based on consent or for the performance of a contract and by automated means. The right to data portability is subject to the condition that rights and freedoms of others are not adversely affected by the transmission of data.

Right to object, Article 21 GDPR

Where the processing has been carried out on the basis that it is for the public interest or for us to pursue our legitimate interests, you have the right to object at any time to the processing of that personal data, on the basis of your particular circumstances. In the event of objection, Scriptum will determine whether there are still compelling grounds for the processing of your data and, if applicable, will refrain from further processing of your data.

Right to lodge a complaint with the competent supervisory authority, Article 77 GDPR

You have the right to contact the competent supervisory authority of the Union or Member State regarding any infringement of data protection regulations. The following supervisory authority is responsible for Scriptum in the UK:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow
Cheshire, SK9 5AF

Exercise of the rights of data subjects

Please contact the company at the address shown above, or via e-mail at interface@scriptumds.co.uk, in order to exercise any personal data-related rights regarding Scriptum in relation to data processing procedures.

Requests submitted electronically by you to the company data protection officer are generally answered electronically by Scriptum, provided that you have not stipulated otherwise in your request.

The information, notices and measures to be provided by Scriptum pursuant to GDPR are generally furnished free of charge, including the exercise of the rights of data subjects. Only in the event of blatantly unjustified or excessive requests is Scriptum entitled to collect suitable compensation for processing or to refrain from action.

Requests for access and information are generally processed promptly – certainly within a month of receipt of the request. This period may be extended another two months if required in consideration of the complexity and/or number of the requests; in the event that the period is extended, Scriptum will inform you within a month of the receipt of your request and indicate the reasons for the delay. If Scriptum does act on a request, you will be promptly notified of this within one month of when your request is received with indication of the reasons for this, and you will also be informed of the option of submitting a complaint to a supervisory authority or of seeking judicial remedy.