How we handle your information

Contents

1. 1. Who we are
2. 2. If you visit this website
3. 3. If you get in touch
4. 4. Customers and suppliers
5. 5. Phone lines and numbers we supply
6. 6. Your business's own data
7. 7. Who we share information with
8. 8. Information outside the UK
9. 9. How long we keep it
10. 10. Keeping it secure
11. 11. Your rights
12. 12. Complaints
13. 13. Changes to this notice

1. Who we are

Barrico is the trading name of Barrico Communications Ltd, registered in England and Wales, company number 17394199. Registered office: Unit 8a Escrick Business Park, Escrick, York, YO19 6FD. We're registered with the Information Commissioner's Office (ICO), registration number ZC220782.

For the information described in sections 2 to 5, we are the controller: we decide how it's used and we're responsible for it. Section 6 covers a different situation - data held on our clients' own systems - where the client is responsible and we act on their behalf.

Stuart Vasili, Director, is responsible for data protection at Barrico. To ask a question or make a request, email info@barrico.biz, call 01904 202540, or write to us at the address above.

2. If you visit this website

This website doesn't set cookies, doesn't use analytics or tracking of any kind, and doesn't have any forms. Everything on it - including the fonts - comes from our own domain, so visiting it doesn't send your details to any other company.

The site is hosted for us by Amazon Web Services (AWS). To deliver a page to you, AWS's servers necessarily handle your IP address and the details your browser sends with the request, and may keep these briefly for security and to keep their network running. We haven't switched on visitor logging, so we don't receive or keep any record of who visits. Our lawful basis is our legitimate interest in running a website that works and is secure.

The email and phone links on the site simply open your own email or phone app. Nothing is sent until you choose to send it.

3. If you get in touch

When you email, phone or meet us, we'll have your name, your business, your contact details and whatever you tell us about what you need. We use this to reply, arrange a visit and put together a price.

If you send us a phone bill to compare, bear in mind that bills can include account numbers, addresses and lists of the calls made. The summary pages with the line rentals and charges are usually all we need - you're welcome to leave out or black out the rest. We use the bill only to work out whether we can save you money.

We don't record phone calls to our office number.

Our lawful basis is our legitimate interest in responding to people who ask about our services. If you're a sole trader or partnership asking for a quote, it's also to take steps you've asked for before entering a contract with us.

4. Customers and suppliers

If your business is our customer, or you work for one, we hold:

• names, job titles, work email addresses and phone numbers of the people we deal with;
• site addresses and any access arrangements for visits;
• account, contract, order and billing records, including payment details;
• support requests, notes of the work we've done, and our correspondence with you;
• a record of the equipment and services you have with us.

We use this to provide and support the services, manage your account, bill you, let you know about planned work or changes that affect you, deal with complaints, and meet our legal and tax obligations.

Our lawful bases are:

• Contract - where you personally are our customer, such as a sole trader or partnership.
• Legitimate interests - where we deal with you as an employee or representative of a business that's our customer, so that we can look after that business properly.
• Legal obligation - keeping financial and tax records, for example for HMRC.

We don't carry out credit checks.

If you work for one of our suppliers, we hold your work contact details and our dealings with you, on the basis of our legitimate interest in running our business.

5. Phone lines and numbers we supply

When we supply phone lines, numbers, broadband or a phone system, we also handle the details needed to set up and run the service: the account holder, the numbers, the installation address, information needed to move a number from another provider, and call records - which numbers were called, when, and for how long.

• We use call records only to bill you, find and fix faults, prevent fraud and misuse, and deal with queries or complaints about a bill - as the Privacy and Electronic Communications Regulations allow.
• We pass the details each service needs to the network operators and wholesale suppliers who provide it, and to your previous provider when a number is moved to us.
• The address registered for each line or number is passed to the network so that it can be given to the emergency services if a 999 or 112 call is made. Please tell us whenever it changes.
• We'll disclose information to the police or other authorities only where the law requires us to.

Our lawful bases are contract or legitimate interests (as in section 4), and legal obligation for emergency call information and lawful requests from authorities.

6. Your business's own data

Your data stays yours. When we look after a business's computers, email, files, backups or phone system, we can often see the data on them - documents, mailboxes, voicemail, call recordings, and information about that business's staff and customers. That data belongs to our client. The client is the controller and is responsible for it; we're their processor, which means we only handle it on their instructions.

What that means in practice

• It stays where it lives - in your Microsoft 365, on your computers and servers, and in your backups. We don't take copies onto our own systems.
• We only access it to do the job you've asked for, such as fixing a fault, restoring a file or checking a backup. We never use it for anything else.
• Access is controlled - named accounts, multi-factor authentication, and only the people working on your job.
• Temporary copies are deleted. If a restore or fault needs a short-term copy, it stays on an encrypted company device and is deleted as soon as the job is done.
• Backups on our own systems only by agreement. If we host a backup for you, your service agreement says where it is, how long it's kept and how it's deleted.

Call recording

Some phone systems we provide can record calls. Whether recording is switched on is our client's choice, and the recordings belong to them. A business that records calls is responsible for telling callers and for having a lawful reason to record. We only access recordings when the client asks us to, for example to fix a fault.

What we keep ourselves

Deliberately little: your support requests and our notes of the work done, a record of how your systems are set up, and the admin passwords we need to look after them, which are kept in an access-controlled password manager that logs every use.

When you leave

Within 30 days of your contract ending, we'll return or securely delete any of your data we hold, whichever you choose, unless the law requires us to keep it. Our own account and billing records are then kept as set out in section 9.

If your information is held by one of our clients

If you work for one of our clients, or are one of their customers, and want to see, correct or delete information held on their systems, please contact that organisation - it's their decision and their responsibility. If you contact us instead, we'll tell you that and help the organisation deal with your request.

Clients can ask us for our Data Processing Agreement, our full Client Data Policy and our list of sub-processors.

7. Who we share information with

We don't sell personal information, and we don't share it for anyone else's marketing. We share it only where we need to, with:

• Microsoft, which provides our email and file storage (Microsoft 365);
• Amazon Web Services, which hosts this website;
• the IT tools we use to manage support requests, remote support sessions and passwords;
• our accounting and invoicing software provider, our bank and payment providers;
• network operators and wholesale suppliers who provide the lines, numbers and broadband we supply;
• engineers or contractors who carry out work on our behalf;
• our professional advisers, such as our accountant, insurer or solicitor, where needed;
• the police, regulators or other authorities, where the law requires it.

Companies acting on our behalf may only use the information to provide their service to us. Ask us if you'd like the current list of names.

8. Information outside the UK

Where we have a choice, we keep information in the UK. Some of our providers, including Microsoft and AWS, are based in the United States or have support staff in other countries, so information may sometimes be accessed from outside the UK. When that happens it's protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the ICO's International Data Transfer Agreement or Addendum in the provider's terms. Ask us for details.

9. How long we keep it

10. Keeping it secure

We use multi-factor authentication on the accounts that can reach customer or client information, wherever the system supports it, encryption on our devices and wherever our platforms support it, and access limited to the people who need it. Staff and contractors are bound by confidentiality. If something goes wrong, we have a procedure to contain it, and we'll tell the people affected and the ICO where the law requires.

11. Your rights

You have the right to:

• get a copy of the personal information we hold about you;
• have it corrected if it's wrong or incomplete;
• have it deleted, where we no longer have a good reason to keep it;
• ask us to limit how we use it, for example while a correction is checked;
• object to us using it on the basis of legitimate interests - and to any direct marketing, which we'll always stop;
• receive it in a portable format, where we use it under a contract with you.

We don't make decisions about people by automated means alone. To use any of these rights, contact us using the details in section 1. It's free, and we'll reply within one month. If a request is complex we may need up to two months more, and we'll tell you if so. We may need to check who you are before we act.

12. Complaints

If you're unhappy with how we've handled your information, please tell us first, using the details in section 1. We'll acknowledge your complaint within 30 days and do our best to put things right.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Changes to this notice

We'll update this page when anything changes, and the date at the top shows when it was last revised.