Privacy policy

• send you the information you have requested, for example, about our software or training;
• respond to your query;
• register you for attendance at one of our events; and/or
• update your communication preferences if you have asked us to do so.

• We use cookies to remember your use of the services. This means you won’t need to fill out the registration information every time you wish to use the live chat
• Any information provided via a live chat service (e.g. the chat transcript) is emailed to us to enable us to follow up with and support you further

We use cookies on our website. Full details of how we use cookies can be found in our cookie policy. We also use Google Analytics and related cookies on our website. Full details of this use are also set out in our cookie policy. Other than as set out in our cookie policy, our website does not collect any information that identifies you personally.

Under data protection law we must have a legal basis to use your personal information. We have set these out below.

Information you give us: Where you fill in a form or use the live chat function on our website, we will only use the data for the purposes of responding to your request or enquiry. Where we wish to use your data for another purposes (e.g. marketing) we will either seek consent to do so or will be relying on legitimate interest as the legal basis.

Information we collect about you from your use of our website: Where we collect personal information through Google Analytics or the other cookies on our website, the legal basis for this use is that it is in our legitimate interests as a business to monitor how our website is used, the traffic we get through our website, and to help us to improve the user-experience of our website. We have considered our legitimate interests carefully and we do not consider that our legitimate interest in having a well-functioning website has a disproportionate effect on your rights under data protection law because we collect minimal information from you which is largely anonymised. We do not use the information we collect to make any decisions about you.

Information you give us: If your organisation becomes a member of Lhasa, we will collect information from you, such as your name, job title and business contact details. We may use this information to:

• contact you to manage the contract we have with your organisation;
• contact you to manage your organisation’s Lhasa membership;
• contact you every year to discuss the renewal of your organisation’s Lhasa membership agreement;
• contact you about Lhasa’s annual general meetings at which company representatives at Lhasa members are entitled to vote at;
• provide your organisation with access and updates to our software;
• provide your organisation with training on our software;
• register you for attendance at one of our events; and/or
• send invoices to you, contact you in relation to payment and administer the financial account relating to your organisation.

Under data protection law we must have a legal basis to use your personal information. We have set these out below.

Information you give us: We are generally collecting and using the personal information that you give us for the purposes of delivering our services to you (as set out above). As such we are relying on contract as the lawful basis of processing. This may include using your personal information for Lhasa software login authentication purposes. Where we may contact you with marketing messages, we will be relying on legitimate interest as the legal basis, given that you are a member.

Information you give us: Where you provide us with information to register for one of our webinars or events, we will use it for the following purposes:

• To register you for the event or webinar. This may include recording your details in our event registration system or webinar service
• To maintain a list of attendees at events for health and safety purposes
• To contact you before the event or webinar to provide relevant updates
• To contact you after the event or webinar to provide copies of presentations or information and to ask you for feedback
• To contact you, unless you have told us not to, about our products and services (see the marketing section below)

We may also use the information you provide to associate you to a particular licensee of our software, this will primarily be associated with your location and we may make use of public information to identify your location. We may also, where it is lawful for us to do so, contact you about future events that are local to you, unless you have asked us not to send you such marketing materials.

Under data protection law we must have a legal basis to use your personal information. We have set these out below.

Information you give us: for the purposes of setting up the event or webinar we rely on the fact that the information you have provided is required for you to attend the event or webinar. Where we process your data for the purposes of health and safety our lawful basis for processing is legal obligation. We rely on legitimate interest as our lawful basis for providing you with information in the lead up to the event or webinar and to follow up with you afterwards, including (unless you have said otherwise) for the purposes of marketing

We will only send you marketing messages when it is lawful for us to do so. In some circumstances we may rely on legitimate interest to send you marketing messages (e.g. if you are a contact at one of our member organisations or have attended one of our events). Where this is not the case, we will always seek your consent to market to you.

Where it is lawful for us to do so, we will use your personal information to send you marketing. This is typically via email and is about:

• other Lhasa software that may be of interest to you;
• Lhasa events, webinars, and projects that you may be interested in participating in;
• news about Lhasa;
• relevant publications; and
• opportunities to complete surveys that we will use for marketing purposes.

We use a number of third-party applications to manage our marketing activities and these applications allow us to control and manage what marketing materials are sent out, as well as managing you opting-out of our marketing. They also allow us to determine which marketing messages to send you depending on what messages you are interested in based on whether you open certain messages and not others, or if you click though for further information. We also use them to help us measure the effectiveness of our marketing messages.

There will be a level of automation used to determine what marketing messages are being sent, dependent on a range of variables relating to your product interest or interaction with marketing messages such as for events/webinars, but we do not use any profiling or auto-decision making techniques.

We may also send you non-marketing communications if you have asked us to, by consenting to receive such messages. For example, if you opt-in to receiving Lhasa job opportunities, we will send you communication specifically about our vacancies. As with our marketing communication, you can unsubscribe (opt-out) of receiving these messages at any time.

Information you give us: If you apply for a Lhasa job opportunity via our website, we will collect information from you including your name, contact details, CV, employment history, education and any other information you provide as part of the application process.

We may also collect information from third parties as part of our recruitment process, such as from referees and right to work checks.

We will process your information solely for the purpose of considering you for the job.

If your application is successful, your information will become part of your colleague HR file and as such will be kept and processed, in accordance with our Colleague Privacy Policy.

If you are unsuccessful, we will keep your information for a period necessary to protect our legitimate interests, after which the information will be deleted, unless you have consented otherwise (e.g., in order to be informed of future Lhasa job opportunities).

If you contact us about Consult Lhasa services (e.g. asking for more information), we will record your interest in our Consult Lhasa CRM for the purposes of dealing with your enquiry. If your enquiry is via email, your details (in the email) will be recorded in our email system.

If you use Consult Lhasa services, we will collect information from you for the purposes of providing the services. This may include information you have provided already through communication with Lhasa Limited. We will typically collect and process the following information:

• your name and contact details;
• details about your company and role;
• any information (e.g. reports) that you provide as part of using Consult Lhasa services.

We will always collect the minimal amount of information necessary to provide Consult Lhasa services to you, or respond to your query. As such, we rely on contract as our lawful basis for processing.

If your details are included in any reports that Consult Lhasa process. It is likely that to provide Consult Lhasa services we will be provided with reports by our clients. These reports may include names, contact details and other information, of the report author or contributor. We generally do not need this detail and will always ask our client to redact, if possible, any personal data within reports. However, where we are provided with non-redacted reports, we will not process any personal data contained within the report for any purpose. If it is practical for us to do so, we may redact the details ourselves.

Unless stated elsewhere in this document or at the point of collection we will keep your personal information for as long as it is lawful for us to do so. This may be for as long as you are a member organisation or for as long as you are subscribed to one of our email lists.

As a general rule we will not share your data with any third-parties unless required to do so by law. However, there are circumstances where this may not always be the case and we set out below the situations where your data may be shared with a third-party or processor. In all circumstances we will ensure it is lawful for us to do so and that, where appropriate, due diligence is carried out on the third-party to ensure their data protection compliance

Third-party processors

The third-party processors we use include:

• GoToWebinar to facilitate the hosting of our webinars
• Eventbrite to facilitate the processing of in-person event bookings
• Microsoft Forms and Survicate  to administer our surveys
• Third-party software to provide our online chat function on our website
• Sugar Market to manage and send out marketing messages
• SugarCRM for the purposes of managing our members, contacts and marketing contacts

Third-parties who may have access to your data

• If you have registered to attend one of our events and we are co-hosting the event with a third party organisation we will share your information with them as joint-controllers
• Organisations who provide support for our internal systems or develop our website. They will not intentionally be processing your data but may have access to it or come across it, whilst carrying out their duties
• We may use third-party software services (e.g. for surveys) where you may be required to provide personal data. This data will be processed via the third-party platform, but in all cases we will not use any service that is unable to demonstrate its data protection compliance

Generally, we store your personal information in the United Kingdom or in countries within the European Economic Area. However, your data may be processed outside the EU when we use some third-party processors and when our USA based group company, Lhasa Inc, employees access our CRM and marketing software. In such circumstances we only transfer your personal information outside the EEA where we have a legal basis for doing so and where we ensure that your personal information is protected to the same standard as it would be protected in the UK, this includes ensuring we have the right checks and balances in places to ensure our USA colleagues only process your data according to EU standards of data protection.

 You have a number of rights over your personal information, which are:

• the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy about the way your personal information is being used – please refer to the ICO’s website for further information about this (https://ico.org.uk/);
• the right to withdraw consent or object to processing. If you wish to stop receiving marketing emails you can do so, by clicking on the “unsubscribe” link at the bottom of the emails, or by contacting us at marketing@lhasalimited.org; 
• the right to ask us what personal information we have about you and to have a copy of your personal information from us, free of charge and within one month of your request. To make a request for any personal information we hold and process about you, we would prefer it if you could put it in writing in an email to info@lhasalimited.org; 
• the right to ask us to correct any errors in your personal information;
• the right to ask us to review and explain our legitimate interests to you;
• the right to ask us to delete your personal information where: (i) we don’t need your personal information anymore; (ii) you have asked us to review and explain our legitimate interests to you and we don’t have a valid legitimate interest to do what we are doing; (iii) our use of your personal information is illegal; (iv) we have to delete your personal information to comply with our legal obligations;
• the right to request a machine-readable format of the data you supplied to us and associated service logs (where we store them). Please contact us, using info@lhasalimited.org, if you wish to receive a CSV export of your data, and
• the right to ask us to restrict the use that we are making of your personal information where: (i) you don’t think the personal information we have about you is correct, so that we can check if it is correct; (ii) what we are doing with your personal information is illegal but you would rather we stop using your personal information rather than delete it; (iii) we don’t need your personal information anymore, but you need us to keep it so that you can exercise any legal rights; and (iv) you have asked us to review and explain our legitimate interests to you, so that we can check whether we actually have a valid legitimate interest to do what we are doing.

Links within our website to other websites, such as LinkedIn, are not covered by this privacy notice. You should review the privacy information on those other websites to find out how they may use your personal information.

We keep our privacy notice under regular review. Any changes we make to our privacy notice in the future will be posted on this page and if the changes will have an effect on you or the way we use your personal information we will bring them to your attention by email where appropriate (e.g. if we have your email address as a contact at one of our member organisations). Please check back frequently to see any updates or changes to our privacy notice.

If you have any questions about this privacy notice or about the ways we use your personal information, please contact us at info@lhasalimited.org.