Data Privacy Policy Notice

Paalam Consultancy Ltd is a UK-based technology and professional services consultancy. We provide services including technology consulting, software development, digital solutions, managed teams, knowledge process outsourcing (“KPO”), business process support and related professional services to organisations in the UK and internationally.

Depending on the circumstances, Paalam may process personal information either:

• as a data controller, where Paalam determines why and how personal information is processed; or
• as a data processor, where Paalam processes personal information on behalf of a client and in accordance with that client’s instructions.

This distinction is explained further below.

Paalam acts as a data controller for personal information that we collect and use for our own legitimate business activities.

This may include information relating to:

• prospective and existing clients;
• individuals who contact us through our website, email, telephone or other communication channels;
• business contacts and professional contacts;
• prospective clients or contacts identified through professional networks and publicly available business sources;
• suppliers, contractors and professional advisers; and
• other individuals with whom we have a business relationship.

Depending on the nature of our relationship with you, the information we collect may include:

• name;
• job title and organisation;
• business address and postcode;
• email address;
• telephone number;
• professional or business information;
• correspondence and records of communications;
• information submitted through our website;
• information necessary to prepare proposals, contracts or invoices; and
• other information you choose to provide to us.

Where Paalam acts as the data controller, we may use personal information to:

• respond to enquiries;
• communicate with prospective and existing clients;
• understand business requirements;
• prepare proposals and quotations;
• enter into and administer contracts;
• provide and manage our services;
• maintain client and business relationships;
• administer accounts, payments and invoicing;
• maintain appropriate business records;
• comply with legal, regulatory and contractual obligations;
• protect our business, systems and legal rights; and
• communicate about Paalam’s services where we are legally permitted to do so.

We will only process personal information where we have an appropriate lawful basis for doing so.

Depending on the circumstances, this may include processing that is necessary to perform or prepare to enter into a contract, comply with a legal obligation, pursue our legitimate business interests, or where you have provided consent where consent is required.

As part of our business development activities, we may obtain professional contact information from publicly available sources, professional networking platforms, business directories, referrals, events or other legitimate business sources.

This may include information such as an individual’s name, employer, professional role and business contact details.

Where we use such information, we will do so only for legitimate business purposes and in accordance with applicable data protection and electronic communications laws.

An important part of Paalam’s business involves providing services to other organisations.

During these engagements, Paalam personnel may need access to personal information controlled by our client.

For example, this may occur when Paalam:

• develops, maintains or supports software or technology systems for a client;
• provides application, infrastructure or technical support;
• provides managed technology or operational services;
• supplies managed teams or dedicated resources;
• provides KPO or business process services;
• performs data migration, integration, testing or support activities;
• accesses a client’s systems as part of an engagement; or
• performs another contracted service that requires access to personal information.

The information concerned may include personal information relating to the client’s customers, prospective customers, employees, suppliers, users or other individuals.

Our role as a data processor

Where Paalam processes this information solely on behalf of a client, the client remains responsible for determining the purposes and means of the processing and will ordinarily act as the data controller. Paalam acts as a data processor on behalf of that client.

In those circumstances, Paalam does not determine independently how the client’s personal information should be used.

We process that information:

• only for the purposes of providing the agreed services;
• in accordance with the client’s documented instructions;
• in accordance with the applicable agreement, including any Data Processing Agreement (“DPA”);
• subject to appropriate confidentiality obligations;
• using appropriate technical and organisational security measures; and
• in accordance with applicable data protection law.

The client’s privacy policy or privacy notice, rather than this Privacy Policy, will ordinarily explain to the relevant individuals how the client collects and uses their personal information.

Paalam will support the client in meeting its applicable data protection obligations to the extent required by law and our contractual arrangements.

Where Paalam provides managed teams, KPO services, dedicated resources or similar services, members of the Paalam team may work within or have access to a client’s systems, applications, processes or data.

As a result, those personnel may have access to personal information relating to the client’s customers, employees, users or other third parties.

Where that information is processed on behalf of the client:

• Paalam personnel will process it only as necessary to perform the contracted services;
• processing will be undertaken in accordance with the client’s documented instructions and applicable policies communicated to Paalam;
• personnel with access to the information will be subject to appropriate confidentiality obligations;
• access will be limited according to the requirements of the engagement and the principle of least privilege where appropriate; and
• Paalam will not use the information for its own independent marketing or unrelated business purposes.

Where required, the responsibilities of Paalam and the client will be further defined in the applicable services agreement, Data Processing Agreement, statement of work or other contractual documentation.

Where our work involves processing personal information on behalf of a client, Paalam recognises that the client’s own privacy framework governs how that client collects and uses the personal information for which it is responsible.

Paalam will therefore process such information in accordance with:

• the client’s documented instructions;
• applicable contractual requirements;
• relevant client information-security and privacy requirements communicated to Paalam; and
• applicable data protection law.

If there is a conflict between this Privacy Policy and specific lawful data-processing instructions agreed with a client in relation to personal information for which that client is the controller, the applicable contractual data-processing arrangements and lawful instructions will govern Paalam’s processing of that client data.

Where appropriate and subject to applicable confidentiality, contractual and data-protection requirements, personal information may be accessed by:

• authorised Paalam employees and personnel;
• members of Paalam’s finance and administration teams;
• professional advisers, including accountants and solicitors;
• technology and service providers acting on our behalf;
• approved subcontractors or sub-processors where permitted;
• regulators, authorities or law-enforcement bodies where disclosure is required by law; and
• other parties where disclosure is necessary and legally permitted.

Access to personal information is restricted to individuals and organisations that have a legitimate need to access it.

Where Paalam uses a sub-processor to process client personal information, this will be handled in accordance with our contractual obligations to the relevant client and applicable data protection requirements.

Paalam works with clients and teams internationally.

Where personal information is transferred outside the United Kingdom, we will take appropriate measures to ensure that the transfer complies with applicable data protection law.

Where Paalam processes personal information on behalf of a client, international transfers will be made in accordance with the client’s documented instructions, applicable contractual arrangements and legally required transfer safeguards.

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, where appropriate:

• access controls and authentication;
• restrictions based on business need;
• confidentiality obligations;
• security controls for systems and devices;
• secure development and operational practices;
• staff awareness and training;
• incident-management procedures; and
• appropriate controls over suppliers and service providers.

No system can guarantee absolute security, but we continually seek to maintain measures appropriate to the nature and sensitivity of the information we process.

Paalam maintains procedures for identifying, investigating and responding to suspected personal data breaches.

Where Paalam is acting as a data controller, we will notify affected individuals and the relevant regulator where we are legally required to do so.

Where Paalam is acting as a processor on behalf of a client, we will notify and assist the relevant client in accordance with applicable law and our contractual obligations so that the client can assess and fulfil its own notification responsibilities.

We do not seek to collect special category or other sensitive personal information unless it is necessary for a legitimate and lawful purpose.

Where Paalam needs to process such information, additional safeguards and applicable legal requirements will be considered before processing takes place.

Where sensitive information is processed on behalf of a client, Paalam will process it only in accordance with the client’s documented instructions and applicable contractual and legal requirements.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including where necessary to:

• provide our services;
• maintain appropriate business and financial records;
• comply with contractual requirements;
• meet legal, accounting, tax or regulatory requirements; or
• establish, exercise or defend legal claims.

Retention periods may vary according to the nature of the information and our relationship with the individual or organisation.

Where Paalam processes personal information on behalf of a client, retention and deletion will be handled in accordance with the client’s documented instructions, the applicable contract and legal requirements.

Depending on the circumstances and applicable law, you may have rights in relation to your personal information, including the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing;
• request portability of your information where applicable; and
• withdraw consent where processing is based on consent.

These rights are subject to applicable legal conditions and exemptions.

Where Paalam holds information on behalf of one of our clients

If your request relates to personal information that Paalam processes solely on behalf of one of our clients, the client is ordinarily responsible for handling your request as the data controller.

You should therefore normally direct your request to the organisation with which you have the relevant relationship.

If Paalam receives such a request directly, we may refer the request to the relevant client and provide reasonable assistance to that client in accordance with applicable law and our contractual obligations.

We do not sell personal information.

We will not provide personal information to unrelated third parties for their own marketing purposes without an appropriate lawful basis.

Personal information that Paalam processes on behalf of a client will not be used by Paalam for its own independent marketing purposes unless there is a separate lawful basis and appropriate authorisation for such processing.

We may update this Privacy Policy periodically to reflect changes in our services, business operations, technology, legal requirements or data-processing practices.

The latest version will be published on our website together with the date on which it was last updated.

If you have questions about this Privacy Policy, wish to exercise your data protection rights in relation to information for which Paalam is the controller, or wish to raise a concern about the way we process personal information, please contact:

Complaints Manager

Sivasankari Vinayagam
Paalam Consultancy Ltd
2 Home Farm Avenue
Macclesfield
SK10 3QW
United Kingdom

You may also contact us through the contact details published on the Paalam website.

If you are dissatisfied with our response, you have the right to raise a complaint with the UK Information Commissioner’s Office (“ICO”).

Information Commissioner’s Office: ico.org.uk