What personal data we collect and why we collect it

Prepress Projects Ltd (company number SC209251, registered in Scotland) is the data controller for the personal data that we collect and process for our own purposes, as described in this notice. This includes personal data relating to enquiries, recruitment and the operation and security of our website. You can contact us at Algo Business Centre, Glenearn Road, Perth?PH2 0NJ, UK or through our contact form.

When we process personal data solely on the instructions of one of our clients as part of work we carry out for them, our client will normally be the data controller, and Prepress Projects Ltd will act as a data processor. In these circumstances, the client’s privacy notice will provide further information about how and why your personal data are processed.

Personal data you supply directly to us

We collect personal data that you provide to us by filling out contact forms or job application forms on our website, or that you provide through direct email or phone contact with us. We use these data to respond to your request and provide our services to you, for example giving you a quotation, sending you edited files for checking, or inviting you to a job interview.

The legal basis for this processing is our legitimate interests in responding to enquiries, providing our services, and recruiting staff. Where you contact us with a view to entering into a contract with us, we may also process personal data where this is necessary to take steps at your request before entering into a contract.

Where we ask you to provide personal data, certain information may be necessary for us to respond to your enquiry, consider your job application or provide the relevant service. If you do not provide the information we need, we may be unable to do so.

Personal data supplied to us by the organisations we work for

If you are an author or editor of a document or journal we are processing on behalf of one of our clients, our client may pass us some limited personal information about you such as your name, email address and phone number. This is so that we can, for example, notify you of the status of your manuscript, send you proofs for checking, and ask you about anything that is unclear during editing. If you provide us with updated or additional personal information (e.g. a new email address), we may, with your permission, pass this on to our client. We will not pass your contact details to anyone else without your authorisation or unless required or permitted by law or necessary to provide the contracted service in accordance with our client’s instructions.

If you are a member of a client organisation’s project team, for example, a project manager, reviewer, approver, or another person involved in work we are carrying out on your organisation’s behalf, then your organisation, or a colleague, may provide us with personal information about you such as your name, job title, email address and phone number. This is so that we can correspond with you about the work in progress, for instance, to send documents to you for review or approval, to discuss any changes required, and to keep you informed of the project’s status. We will not pass your contact details to any third party without authorisation from your organisation unless required or permitted by law.

The personal data we receive from clients will normally be limited to information needed to carry out the relevant work, such as your name, job title, organisation, email address, telephone number and information relating to your involvement in the publication or project. The source of this information will normally be our client or another person involved in the client’s project.

Where Prepress Projects acts as a data processor, we process these data on the instructions of the client, who is responsible for determining the purpose and lawful basis for the processing. Where we process business contact information for our own purposes in managing our relationship with a client, the legal basis is our legitimate interests in managing that relationship and carrying out our contracted work.

Data automatically collected by our website

Tracking data

When you visit our website, our server automatically collects certain information for security reasons. This includes data such as your apparent IP address and approximate geographical location. This helps us to detect and block malicious users trying to attack our website.

The legal basis for this processing is our legitimate interests in maintaining the security of our website and systems.

Content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. We do not control what data these other websites gather or track; please refer to their own privacy policies for details.

Who we share your data with

We share security data collected from our website with our hosting and security service providers so that threats can be identified and blocked.

We may also use trusted service providers that process personal data on our behalf, such as providers of IT support, email, cloud storage, website hosting and other business systems. Where these organisations process personal data on our behalf, we require them to protect the data appropriately and to process them only for the purposes for which they have been engaged.

Data provided to us as part of our contracted work are processed according to our clients’ instructions and are treated as confidential to the client. We will only share them if instructed to do so by our client, and only to the recipients specified by our client.

How long we retain your data

Security data are deleted after 26 months.

Personal data provided through direct contact, such as enquiries or job applications, are retained for as long as they are necessary to fulfil the purpose for which they were provided and deleted when they are no longer needed. Where appropriate, we also take account of legal, contractual and regulatory requirements when determining how long information needs to be retained.

Data provided to us as part of our contracted work are retained for the time agreed in the relevant contract, or where the contract does not specify a retention period, only for as long as reasonably necessary for the purposes for which the data were processed, taking account of our client’s instructions and applicable contractual and legal requirements. We periodically review retained data and securely delete or anonymise personal data that are no longer required.

How we protect your data

We have a current Cyber Essentials Plus certification showing that we meet UK government standards for data security in five areas: correct firewall setup, secure configuration of our networks and systems, access restrictions, protection against malware, and keeping software up to date. We store your data on secure UK-based servers that are backed up frequently. Offsite backups are stored in a secure data centre (certified to ISO 27001) in the Netherlands.

All our staff are aware of the importance of confidentiality and data protection. We have an established staff with low turnover, and all staff sign a confidentiality agreement on starting with us. If a client requires a specific confidentiality agreement, our staff sign that too.

We also apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.

Automated decision-making

We do not use personal data to make solely automated decisions about individuals that produce legal or similarly significant effects, and we do not carry out profiling for these purposes.

What rights you have over your data

Under UK data protection law, you have the following rights in relation to personal data we hold about you where Prepress Projects Ltd is the data controller. Not all rights apply in every circumstance, and the rights available to you may depend on the lawful basis on which your personal data are processed:

The right to access: you can request a copy of the personal data we hold about you.
The right to rectification: you can ask us to correct inaccurate data or complete incomplete data.
The right to erasure: you can ask us to delete your personal data. We will, however, retain any data we are obliged to keep for administrative, legal, or security purposes, or that we need to fulfil our contracted work.
The right to restrict processing: you can ask us to limit the way we use your data while a dispute is being resolved.
The right to data portability: in certain circumstances, you can ask us to provide personal data you have supplied to us in a structured, commonly used and machine-readable format or to transfer them to another organisation.
The right to object: because our processing is based on legitimate interests, you have the right to object to that processing. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is required for the establishment, exercise or defence of legal claims.
Consent: where we rely on your consent to process personal data, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where we process your personal data solely as a processor on behalf of one of our clients, the client is responsible for responding to requests to exercise your data protection rights. We will assist the client in responding to such requests where required.

To exercise any of these rights, please use our contact form.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113. We would welcome the opportunity to address any concerns you have about our use of your personal data before you approach the ICO.