At RQ Ratings Ltd ("RQ", "we", "us", "our") keeping your data safe is important to us and we take our obligations in respect of data privacy seriously and recognise that it is important for you to understand how we make use of personal data.
It also explains what personal data we process, why we hold the data, what legal basis we rely on, and what your rights are.
2. Who we are
For the purpose of the data protection laws, the "Data Controller" is RQ Ratings Ltd
RQ Ratings Ltd is a company registered in England and Wales with company number 13202073 and registered address at 71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ.
3. Personal data we may collect from you and how we collect it
Personal data you provide to us directly.
You may provide personal data to us in a number of ways, including when:
• visiting and browsing our Site.
• registering an account with us on the RQ Platform.
• using our diagnostic tool.
• uploading content to the RQ Platform.
• leaving a review on our Site and / or the RQ Platform.
• completing our "contact us" form on our Site.
• mentioning or interacting with us on social media (for example by following/mentioning/tagging us or by contacting us directly).
• completing one of our client satisfactions surveys.
• providing us with feedback about the RQ Platform or any other services we provide.
• reporting a problem with our Site, the RQ Platform or any services we provide; or
• entering into a contract with us.
What type of data might be included?
The personal data you give us may include but is not limited to:
• your name.
• e-mail address.
• date of birth.
• details of income.
• phone number (including mobile number).
• employment history.
• details of family members.
• job role.
• pension and investment details.
• thoughts about our services (including feedback, survey responses, complaints and reviews).
Personal data we collect or generate about you.
We may also collect personal data about you if you visit our offices.
The personal data we collect about you may include but is not limited to:
• technical information including: the internet protocol (IP) address used to connect your computer to the internet; your login information (if registering or accessing an account with us); browser type and version; time zone setting; browser plug-in types and versions; device types; operating system; time and date of consent and platform; and any phone number used to call our client service number; and
• information about your visit to our Site and / or the RQ Platform, including: the full Uniform Resource Locators (URL); clickstream to, through and from our Site and / or the RQ Platform (including date and time); products you viewed, searched for or purchased; page response times; download errors; length of visits to certain pages; page interaction information (such as scrolling, clicks, and mouse-overs); and methods used to browse our Site and / or the RQ Platform.
Personal data we receive from other sources.
We may receive personal data about you from other sources, for example from professional services firms already registered on the RQ Platform (they might provide us with your email address if they think your firm would be interested in registering with the RQ Platform or otherwise hearing about our services).
If you are a client of a professional firm, we may receive personal data about you when your details are uploaded by the professional firm to the RQ Platform for the purposes of collaborating with a financial planning firm. We may also receive personal data about you from the financial planning firm you choose to engage as they will be required to share certain details of the subsequent agreement that you enter into with us to enable us to calculate the relevant commission payable to the professional firm. In processing your data in this way we act as a Data Processor on behalf of the professional firm and/or financial planning firm (as relevant) and, in such circumstances, it is the professional firm and/or financial planning firm's obligation to establish a legal basis for sharing your data with us (and, where relevant, each other) prior to uploading your personal data to the RQ Platform.
4. Why and how do we use your personal data and what is our "lawful basis" for doing so?
Whenever we process your personal data as a data controller, we are required to identify and maintain a valid "lawful basis" (i.e., a legally compliant justification) for the processing. Typically, RQ will rely on the fact that our processing of your personal data is necessary:
- to perform our contract with you.
- to comply with our legal obligations; and/or
- for our legitimate business interests, namely, to analyse the use of our Site, the RQ Platform and our services to continually improve your experience and our business.
To help you to understand specifically what we do with your personal data and why we do it, we have described the various relevant lawful bases that we rely on in the table below.
Where we rely on our legitimate interests, we will always make sure that we assess these interests against your right to privacy before conducting such processing and, if your rights outweigh our legitimate interests, we will not process your personal data for that purpose.
To register your account on the RQ Platform and manage your account going forwards.
To grant you access to the RQ Platform and the services you request.
To process payments to and from you and to maintain accounts and records of such payments.
We have to process your personal data in these ways to perform our contractual obligations to you.
To measure how satisfied users of our Site and the RQ Platform are and provide client support services (including troubleshooting of the Site or the RQ Platform or when you ask us questions by email, on the phone or on social media).
We will rely on our legitimate interests as a business to process such data (for example, it is in our interests to measure client satisfaction and troubleshoot client issues).
To provide our diagnostic tool to clients of professional firms to (i) enable them to calculate future personal projected cash flows and (ii) to enable us to provide feedback on their financial position and outlook.
Our diagnostic tools require you to complete certain forms and press submit to upload the required data.
We rely on consent to process the personal data required by the diagnostic tool. In pressing submit to upload your data, you are consenting to us processing the personal data contained on such forms to enable us to provide you with the diagnostics service.
To prevent or detect crime, fraud or abuses of our services or our Site and / or the RQ Platform and to enable third parties to carry out related technical, logistical, research or other functions on our behalf related to these purposes.
In some circumstances we will use your personal data because it is necessary for us to comply with a legal obligation (for example, if we receive a legitimate request from a law enforcement agency).
In other cases (such as the detection of theft, fraud or ensuring security of our Site and / or the RQ Platform) we will rely on our legitimate interests in keeping our employees and our Site / the RQ Platform (and such users of our Site and / or the RQ Platform) secure and to prevent theft and fraud.
To send you newsletters, updates, information about new products or services that we think might interest you, via email, telephone or post.
To measure or understand the effectiveness of advertising we serve to you.
To conduct market research or similar surveys.
Unless we are contacting you in a business to business capacity, we will only use your personal data to send you electronic marketing messages if we have consent from you to do so (or if you are already registered on the RQ Platform and have not opted out of receiving marketing materials).
Where we send marketing to you in a professional capacity or otherwise conduct research or analyse our advertising, we will rely on our legitimate interests to send these types of communication (our legitimate interest in marketing and advertising our services) and conduct such activities.
You can opt out from marketing communications by using the unsubscribe links within our marketing messages, or by contacting us at any time at the contact details set out at below.
To use the reviews, comments and feedback that you leave on our Site and / or the RQ Platform or provide to us for our own advertising purposes.
We may use a review, comment or piece of feedback that you submit in our advertising campaigns, such as in press and digital advertising, on our social media pages, in our email marketing or on our Site and / or the RQ Platform.
We have a legitimate interest to promote our own products and services and to use the reviews, comments and feedback that you provide to us to do so.
To find out more about the visitors to our Site, those registered users on the RQ Platform and our client base as a whole (rather than about you as an individual) to ensure that the services that we offer are most likely to interest our Site visitors and registered users on the RQ Platform. Typically, the information collected is technical in nature and does not tell us about you as an individual (see above).
We have a legitimate interest to make sure that we are providing you with the information that we think is most relevant to you.
To notify you about changes to the RQ Platform, our services and terms and conditions.
We have to process your personal data in these ways to perform our contractual obligations to you. We might also rely on our legitimate interests as a business to send you these updates.
For administrative or business purposes, where you contact us for a particular reason other than those set out above, such as to report problems with our Site or the RQ Platform.
We have a legitimate interest to respond to your contact for the purposes of administering our business and providing you with the services you require.
6. What if you fail to provide personal data?
Please make sure you provide us with information when requested as if you don’t, we may not be able to perform the contract we have entered into with you (such as, to provide you with access to the RQ Platform or provide you with the services you have requested). In this case, we may have to suspend or cancel your account on the RQ Platform. We will notify you if this action is required at the time.
7. Change of purpose
8. How we share your personal data
Third party suppliers and service providers involved in our contractual relationship with you
Like most businesses, we work with third party suppliers and service providers as part of the day to day operations of our business. Some of these trusted suppliers will process your personal data on our behalf and provide services to us to enable us to manage the RQ Platform, payment processing, and so on.
We will always make sure that these trusted suppliers meet agreed standards for the protection of your personal data, and they will only ever be allowed to use your personal data in order to provide us with services and not for their own commercial purposes. We require all third parties to implement appropriate technical and organisational security measures to protect your personal data and to treat it subject to a duty of confidentiality and in accordance with the data protection laws.
Sharing your personal data with our investors
We may share your personal data with our investors as part of the administration of our business. For example, we may share personal data as part of our regular reporting activities on company performance.
Other scenarios in which we might share your personal data
We may also share your personal data:
• with regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised law enforcement bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters.
• in the event that we consider selling or buying any business or assets, to any prospective sellers or buyers of such business or assets.
• in the event of any insolvency situation (e.g., administration or liquidation).
• if we, or substantially all of our assets, are acquired by a third party, in which case your personal data will be one of the transferred assets; or
• to protect the rights, property or safety of our employees, workers, contractors, clients, or others. This includes exchanging your personal data with other companies and organisations (including without limitation the local police or other local law enforcement agencies) for the purposes of our employee, worker, contractor and client safety, crime prevention, fraud protection and credit risk reduction.
9. How do we protect your personal data?
We are committed to ensuring the security, confidentiality and integrity of the Personal Information you provide to us. We rigidly adhere to appropriate technical and organisational security measures.
Access to the Personal Information is based on the ''least permissions'' concept together with role based access control systems, ensuring only authorised access to the personal information To protect the privacy of any Personal Information you may have provided, we use data hosts who Implement best market practice security measures. Although we take steps to safeguard such Information, we cannot be held responsible for the acts of those who gain unauthorized access, and we make no warranty, express, Implied or otherwise, that we will prevent such access. If a password Is used to help protect your accounts and Personal Information, It Is your responsibility to keep your password confidential.
We use the Personal Information for legitimate business purposes only.
We will never sell, rent or trade Information about you to any other party. We will not collect Information unless It Is used to provide relevant information or in order to provide a better service to you.
10. How long do we retain the Information we collect?
We will retain your personal data for no longer than necessary in connection with our relationship with you. This retention period may depend on whether you are visiting our Site, registering an account and using the RQ Platform, making a purchase of any services we provide. There may also be circumstances where we need to retain your personal data for longer than our relationship with you in order to comply with applicable laws.
Personal data which is no longer to be retained will be securely and effectively destroyed or permanently erased from our IT systems and we will also require third parties to destroy or erase such personal data where applicable.
In some circumstances we may anonymise your personal data so that it can no longer be associated with you. In this case, we may retain such information for a longer period without further notice to you.
Where we are storing cookie data linked to personal Information, we will store this cookie for 2 years unless you delete It from your browser settings.
Due to the nature of the sales cycle, we do not know when a potential client will re-engage with us and having the background and history of the contracting party will assist us in providing a better service. Therefore, please note that unless you Instruct us otherwise, we will retain the Information we collect for as long as needed to provide our services and to comply with our legal obligations, resolve disputes and enforce our agreements. We have an Internal data retention policy to ensure that we do not retain your personal data perpetually.
We may rectify, replenish, or remove Incomplete or Inaccurate Information at any time and at our own discretion.
11. Your rights in relation to your personal data
It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes so that our records can be updated. We cannot be held responsible for any errors in your personal data if this is caused by a failure by you to notify us of the relevant change.
Data protection law grants you a number of specific rights in respect of your data in addition to the broad and general right to have your data protected. We have set out some information in respect of each of those specific rights, below:
• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data (commonly known as the "right to be forgotten"). This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party.
• Not to be subject to a decision solely based on automated processing. We do not anticipate making decisions about you based solely on automated decision making where that decision would have a significant impact on you. If we ever make a decision about you automatically by a computer or an algorithm without human intervention you can ask us to have that decision reviewed by a human.
If you want to exercise any of the rights set out above, please contact us at firstname.lastname@example.org
Subject to legal and other considerations, we will make every reasonable effort to honour your request promptly in accordance with the data protection laws or Inform you If we require further information in order to fulfil your request. When processing your request, we may ask you to verify your Identity for security purposes before processing and / or honouring your request. We reserve the right to charge a fee where permitted by law, for Instance If your request Is unfounded or excessive. In the event that your request would adversely affect the rights and freedoms of others (for example, would affect the duty of confidentiality we owe to others such as our employees) or If we are legally entitled to deal with your request In a different way than Initially requested, we will address your request to the maximum extent possible, all In accordance with the data protection laws and within 30 days of receiving the request from you.
You can exercise your rights at any time by contacting email@example.com
12. Where your personal data may be processed
We do not currently transfer any personal data outside of the UK or EEA. In the event that we choose to transfer personal data outside of the UK and EEA in the future we will comply with the data protection legislation when doing so including by putting in place adequate contractual safeguards with the recipient (e.g. the European Commission’s standard data protection clauses and UK International Data Transfer Addendum), to ensure the security of your personal data is maintained when it is processed by the third party.
13. Use by Minors
We do not offer services to children under the age of eighteen. If we become aware that a user under the age of eighteen has shared any Personal Data, we will discard such Information. If you have any reason to believe that a minor has shared any Personal Information with us, please contact us at firstname.lastname@example.org
14. Third-party websites
Our Site and / or the RQ Platform may, from time to time, contain links to third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for the ways in which personal data is processed on such websites. Please check the relevant policies before you submit any personal data to these websites.
We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your personal data. We will try to put things right.
However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to the Information Commissioner's Office ("ICO"). You can contact the ICO at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF; 0303 123 1113; or https://ico.org.uk/.