Privacy & Cookies

COMMON BASE is the controller of the personal data it processes for the purposes described in this policy. Our correspondence address and the email address of our Data Protection Officer (DPO) appear above. You can contact the DPO about privacy, this policy, or exercising your personal-data rights.

This policy covers this informational website and privacy-related or other correspondence with COMMON BASE. It does not replace any separate notice that may be provided for a future venture, event, application, employment process or service.

We apply the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended. Where our processing falls within the territorial scope of the EU General Data Protection Regulation (EU GDPR), that regulation also applies. Cookies and similar technologies are subject to the UK Privacy and Electronic Communications Regulations (PECR) and applicable European ePrivacy rules.

You can browse this website without creating an account or submitting a form. The website currently has no account-registration, subscription or enquiry forms. This does not mean that browsing is entirely free of personal-data processing.

• Correspondence: when you email or write to us, we receive the contact details you provide, the content of your message, attachments and related correspondence. A privacy request may also require information reasonably necessary to confirm your identity or authority to act for someone else.
• Technical information: delivering and securing a website involves processing request information such as IP addresses, browser and device information, requested URLs, timestamps and error information. Hosting and delivery providers may record this information in operational or security logs.
• External resources: this website loads the Geist typeface through Google Fonts. Your browser requests the font stylesheet and font files from Google, which receives technical request information, including your IP address and browser information. Further details appear in the Cookies Policy.

Please do not send sensitive personal information unless it is necessary for your request. We do not ask visitors to provide special-category data, such as health information, or criminal-offence data through this website. If such information is received, we will assess whether we can lawfully retain or use it and minimise or remove it where appropriate.

We use personal information only for a defined purpose and with an applicable lawful basis. For the activities covered by this policy:

• Website delivery, security and fault diagnosis: our legitimate interests in making the website available, protecting it from misuse and resolving technical problems. We consider the necessity of the processing and its effect on your rights and interests.
• Responding to correspondence: our legitimate interests in communicating with people who contact us and handling their enquiries. Where an enquiry relates to a contract with you, processing necessary to take steps at your request before entering that contract, or to perform it, may instead rely on the contractual lawful basis.
• Privacy requests and legal obligations: compliance with applicable data-protection and other legal obligations, including responding to rights requests and retaining records where legally required.
• Complaints and legal claims: our legitimate interests in investigating complaints and establishing, exercising or defending legal claims, subject to applicable law.
• Consent-based activities: where a future activity requires consent, such as non-essential tracking or particular electronic marketing, we will give you the relevant information and obtain any consent required before that activity begins. Consent can be withdrawn at any time, without affecting the lawfulness of processing before withdrawal.

We do not use this website to send marketing messages or subscribe visitors to a mailing list. We will not repurpose personal data in a way incompatible with the purpose for which it was collected without an appropriate legal basis and the information required by law.

Information may be accessible to authorised people working for COMMON BASE and, where necessary, service providers supporting website hosting, content delivery, security, technical support and email correspondence. Providers acting as our processors must process personal data under appropriate contractual terms and our instructions. Some providers act as independent controllers for their own processing; their own privacy notices apply to those activities.

Google receives technical information when your browser loads Google Fonts. We may also disclose information to professional advisers, courts, regulators or public authorities when necessary for advice, legal claims or a legal obligation. Disclosure is limited to what is relevant and lawful. We do not sell your personal information.

You may ask the DPO for further information about recipients relevant to your personal data. Links to external websites do not make those websites part of COMMON BASE; review their own privacy and cookie notices before using them.

• Google Privacy Policy

Website, font-delivery and email providers may process technical or correspondence data outside the United Kingdom or European Economic Area (EEA). The applicable protections depend on where the data is sent, the recipient and whether UK GDPR or EU GDPR applies.

Where COMMON BASE makes a restricted international transfer, we must ensure a lawful transfer mechanism is in place: an applicable adequacy decision or regulation, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Agreement or UK Addendum, together with the assessment and supplementary measures required by law. Any exceptional reliance on a statutory derogation must meet its conditions.

Contact the DPO for information about the safeguards applicable to your data, including how to obtain a copy or details of them, subject to lawful redactions. We do not treat your use of this website as consent to an otherwise unlawful transfer.

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal obligations, security needs and the establishment, exercise or defence of legal claims. We do not apply an indefinite retention period simply because information might be useful later.

For correspondence, the relevant criteria are the time needed to answer and resolve the enquiry, any continuing relationship and any applicable legal or claims-related retention requirement. For privacy requests and complaints, we consider the time needed to handle the matter and demonstrate that it was handled lawfully. For technical and security logs, the criteria are operational necessity, incident investigation and applicable provider retention arrangements.

When information is no longer needed, it should be securely deleted or anonymised. Where deletion from backups is not immediate, retained copies should remain protected and not be used for ordinary processing. The DPO can provide information about retention applicable to a particular record or request.

Depending on the law that applies, our lawful basis and the circumstances, you may have the following rights:

• Access: obtain confirmation of whether we process your personal data, a copy of it and information about the processing.
• Rectification: ask for inaccurate information to be corrected and incomplete information to be completed.
• Erasure: ask for personal data to be deleted where the legal conditions are met.
• Restriction: ask us to limit processing in certain circumstances.
• Portability: receive data you provided in a structured, commonly used, machine-readable format, and request its transfer where processing is automated and based on consent or a contract.
• Objection: object, on grounds relating to your particular situation, to processing based on legitimate interests. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for legal claims. You can object to direct marketing at any time, including related profiling, and that processing must stop.
• Withdrawal of consent: withdraw consent at any time where processing relies on it, without affecting earlier lawful processing.

These rights are not absolute and lawful exceptions may apply. This website does not use personal data for profiling or solely automated decisions producing legal or similarly significant effects. We do not require you to provide personal data merely to browse; if information needed to answer an enquiry or verify a rights request is not provided, we may be unable to complete that particular request.

Email our DPO or write to our correspondence address. Describe the right you wish to exercise and provide enough information to identify the relevant records. You do not need to use a particular form or quote a law. We may request proportionate identity information where we have reasonable doubts about identity; please do not send an identity document unless we ask for it.

We normally respond without undue delay and within one month of receiving a rights request. Where permitted by applicable law, the period may be extended by up to two further months for complexity or the number of requests; we will explain any extension within the initial month. Applicable rules may affect when the period begins or may permit a pause while necessary identification or clarification is obtained, and we will explain this where relevant.

Requests are normally free of charge. A reasonable fee or refusal is possible only where the relevant law permits it, for example for manifestly unfounded or excessive requests. If we cannot act on your request, we will explain why and tell you about your right to complain and seek a judicial remedy.

If you are concerned about how your data is handled, please contact our DPO so we can investigate. We will acknowledge your complaint within 30 days, take appropriate steps to investigate and respond without undue delay, keep you informed about progress and communicate the outcome without undue delay. The 30-day period is for acknowledgement, not a deadline for completing every investigation. Contacting us does not remove or limit your right to complain to a regulator or seek a judicial remedy.

In the United Kingdom, you can complain to the Information Commissioner’s Office (ICO). If EU GDPR applies, you can also complain to a competent supervisory authority in the EU/EEA, in particular in the country of your habitual residence, place of work or the alleged infringement.

• Make a complaint to the ICO
• Find an EU/EEA supervisory authority

We seek to use technical and organisational measures proportionate to the risks, including limiting access to personal information and protecting correspondence and website operations. No internet transmission or storage system can be guaranteed completely secure. Where a personal-data breach occurs, we will assess it and make notifications to regulators and affected people where required by law.

This website is not directed at children, and we do not knowingly solicit personal information from children. If you believe a child has provided personal data that should not be held, please contact our DPO.

We will update this policy when our activities, providers or legal obligations change. The date above identifies the latest revision. Where required, we will give additional notice of a material change and obtain fresh consent before starting processing that requires it.