Privacy Policy

This Privacy Notice describes how we handle your personal information. It explains the basis for processing any personal data we collect or obtain from you. Please read it carefully to understand our practice and views regarding your personal data. 

This Privacy Notice concerns personal data we use relating to visitors to our website and to our actual and prospective customers and suppliers. It does not relate to personal data we use relating to our employees. 

40fi Limited is a company registered and incorporated in England and Wales (Company number 14499017) at 6th Floor 33 Holborn, London, England, EC1N 2HT, and is dedicated to adhering to all relevant data protection legislation. 40fi Limited will formally assign appropriate powers and responsibilities to its personnel to ensure full compliance with these laws and regulations. This privacy notice has been written in line with our obligations under the General Data Protection Regulation (GDPR), UK GDPR and the Data Protection Act 2018 as they apply in the UK. Depending on where you are based there may be local law requirements within and outside the UK which apply instead.  

We may collect, use and otherwise process the following categories of personal information about customers, and prospective customers and suppliers: name, address, phone number, email address, records of meetings, other communication contact and job title, information about products and services you express interest in, instruction you give us or information we note through public information we think might be useful to build a commercial relationship with you. We might collect audio recording if you leave us voice mail message on our equipment. 

We may collect personal information: Directly from you: e. 

From other sources:

We use your personal information for a variety of purposes related to the services that we provide to you.

Financial management including making payments and chasing debts, etc

Audit and regulatory requirements

Managing projects, client instructions, customer relationship, and the delivery of our services

Marketing our products and services, product development, research and events including the use of direct marketing by email, phone and social media or traditional emails to raise awareness of services, products and events that we believe may be of interest to you

Managing relationships with prospective, actual and former customers and suppliers and other who we think may benefit or be of interest to our business including creating and maintaining customer records and to keep in contact with you

Managing enquiries, sales opportunities and leads, and proactive business development activities 

The lawful basis for processing the data involved in the above activities are:

Pursuant to the legitimate interests of 40fi which are: to promote 40fi and our activities, to enable us to run 40fi efficiently and effectively as a commercial business, and to ensure we remain accountable to our customers and other relevant stakeholders 

Steps taken to enter or to fulfil the contract for services that we have with our customers 

We also may process personal data for compliance with our legal obligations.

If we process personal data on the basis of consent, we will ensure that we provide sufficient information for the consent to be specific, informed and freely given. 

1. We may need to share some of your personal data with other parties, such as suppliers or third parties. Third parties will have signed confirming that they adhere to the GDPR and DPA 2018, and have the appropriate security training and safeguards in place to protect your personal data.

2. External processing: we may share some personal information with other trusted businesses or persons to process information, based on our instructions and in compliance with this notice and other security measures. 

3. We may share your data with payment providers.

4. We may share information with your previous or new suppliers to allow us to transfer your services.

5. Where we may occasionally employ other companies and individuals to perform functions on our behalf, we ensure that they are risk assessed and subject to written agreements with us stating how they can use your information. We ensure that they are compliant with applicable data protection laws and regularly audit their processes.

6. Potential buyers of some or all of our business or on restructuring. Where possible, personal data is anonymised.

7. Government bodies as defined by law or other regulations, including, but not limited to, the police, HMRC, NHS, Public Heath England (PHE).

We ensure that appropriate security measures are in place when handling your personal data. Occasionally, we may share your information with third party suppliers that operate outside of the European Economic Area (EEA) or the UK. If we transfer personal information to a company that is outside of the EEA or the UK, we will put in place an appropriate transfer mechanism as required by local law, and the relevant Standard Contractual Clauses.

Information may be held at our offices and those of our group companies, and third party agencies, service providers, representatives and agents, as described above.

We only retain your personal information for as long as is necessary, or in accordance with our legal or regulatory obligations or send you marketing and promotional materials, or provide you with services, and/or protect or defend our business. 

You have several important rights under data protection legislation. We may ask for confirmation of your identify when you request to exercise one of those rights. This is just another way in which we protect your personal data.

 You have the right to request the following with your personal data:

Right to access: access to your personal data free of charge, unless the request is unfounded or excessive. 

Right to rectification: correction of your personal data if it is inaccurate or incomplete.

Right to erasure: also known as the right to be forgotten. To have your personal data deleted or removed where there is no good reason for processing to continue.

Right to restrict processing: processing of your data to be restricted, subject to certain criteria.

Right to data portability: your data is moved, copied or transferred to another platform subject to certain criteria.

Right to object: objecting to the processing of your personal data, either in terms of direct marketing or other reasons for processing.

 We have one month to respond to these requests. In some circumstances, we may require an extension to this time frame. In some circumstances we may refuse your request under your data rights. We will inform you of the reasons for our refusal.

Our notice might change from time to time. We will take reasonable measures to communicate any substantial changes we make to this notice, by posting an update on our websites.

If any provision of these Terms and Conditions is held invalid, illegal, or unenforceable for any reason by any court of competent jurisdiction, such provision shall be severed, and the remainder of its provisions will continue in full force and effect.

Please contact us at dataprotection@40fi.net if you have any questions or concerns about the information contained in this privacy notice or about 40fi’s approach to data protection in general