PICCASO Limited ("PICCASO") is committed to building your confidence and trust by complying with data protection legislation and best practices that protect your privacy and safeguards your personal information. 

This Privacy Notice explains how we collect, use, store, share and protect your personal information. 

We are registered with the UK Information Commissioner’s Office. 
Our data protection registration number is ZB487895MRS 

Privacy Culture Limited is committed to protecting and respecting your privacy, and we’ll only use your personal information to administer your account and to provide the products and services you requested from us. From time to time, we would like to contact you about our products and services, as well as other content that may be of interest to you. By creating a free account on piccaso.org you consent to us contacting you for this purpose and to store and process the personal information you have submitted during when creating your account. You can manage your preferences on piccaso.org and unsubscribe at anytime.

1. How do we collect your personal data? 

Directly from you when you: 
> Subscribe to our newsletters and email notifications on the PICCASO website. 
>Sign up to attend our events, conferences, seminars and participate in the programmes that we offer. 
> When you visit and use the PICCASO website and create a free account.

From other sources: 
> Partnerships with trusted third parties and stake holders such as GRC World Forums, including security and privacy specialist tech providers. 
> Individuals and organisations whom you have confirmed consent. 
> Website and system management tools that help deliver our platforms/services. 
> Publicly available information. 
> Government, tax or law enforcement agencies. 

2. What personal data does PICCASO collect? 
The information that we collect may include: 
a) Personal identifiers such as your name, date of birth, title, address, and contact details including postal address, post-code, email, telephone number, and organisation’s name. 
b) Occasionally, as part of the functions described in this policy, we may need to process special category of data. We endeavour to do so only when necessary and we will treat and process such data with great care and in accordance with the applicable data protection laws. 

3. Why do we collect your personal data? 
> To enable us to supply goods, services and information to our clients, subscribers and digital tool users. 
> To enable us to provide appropriate digital tools for our clients and network. 
> To comply with employment laws and other statutory requirements. 
> To keep you informed about our work.  
> To administer our website and business. 
> To deal with enquiries and complaints made by or about you relating to our website, services, and programmes. 

4. How do we use your personal data? 
We may use your personal information for the following reasons: 
> To respond to enquiries submitted or to provide products or services to our subscribers. 
> To enable you to use our services and to participate in any of our programmes and events. 
> To respond to complaints made by or about you relating to our website, services, and programmes. 

We may also process your personal information for our legitimate business interests; that is, in order to facilitate the management of our business. This includes the following purposes: 
> To enhance, modify, personalise or improve our services to the benefit of clients and prospective customers. 
> To provide postal and/or email communications which we think will be of interest to you. 
> To send surveys and feedback requests to improve our services to the benefit of clients and prospective customers. 
> To better understand how individuals, interact with our website.  
> To enhance the security of our information systems or identify and prevent fraud. 
> To conduct research and make statistical analysis and administration, including analysis of trends, carrying out actuarial work, tailoring products and services, risk assessment and analysis of costs in relation to our services. We will always ensure that such data is depersonalised or aggregated and can therefore not be personally identifiable to you. 

Whenever we process data for these purposes, we will ensure that we always keep your information rights in high regard and take account of these rights. 

5. What are your information rights and choices? 
The Data Protection laws and regulations grant you a number of rights in relation to your personal information. You are entitled to: 
> Request Privacy Culture Limited for copies of, and/or access to your personal information. 
> Request that your personal information be corrected where inaccurate or incomplete. 
> Request that your personal data be deleted. Please note that PICCASO may need to retain some, minimal information in order to respect your request to be excluded from processing. 
> Object to or limit the use of your personal information by PICCASO. 
> Request to withdraw your consent for the processing of your personal data. 
> Request to have your personal data provided to you in a machine-readable format. 
> Choose whether to have marketing communications from us by email, text or telephone.  

To exercise your rights please sent us your request to the address provided below. If you are not satisfied with our response, you may report to the Information Commissioner’s Office (ICO). Details on how to do so can be found on the ICO’s website at www.ico.co.uk. 

For more information about your information rights visit www.ico.org.uk 

6. How long does the company retain your personal data? 
The length of time that we hold your personal data varies depending on the type of information and its use. We will only keep your personal data for as long as it is necessary to provide the services and/or products that you have requested, for the execution of a contract or for such other essential purposes such as, complying with our legal obligations, resolving disputes, investigating disciplinary matters and enforcing our agreements. When your personal data is no longer necessary, it will be securely deleted or anonymised. 

If you have any questions about our Data Retention Policy, please contact us using the contact details provided below. 

7. Sharing your personal information 
Where necessary and in limited circumstances, we may share your personal information with third parties to the extent permitted by or required by law including to 
a) meet our legal obligations; 
b) provide reasonable voluntary cooperation with a relevant police or regulatory investigation or any ongoing or prospective legal proceedings; 
c) in order to establish, exercise or defend our legal rights, including providing information to others for the purposes of fraud prevention and reducing credit risk. 

In addition, we make use of expert third party service providers to help us to provide relevant services, such as expert IT providers helping us with our IT systems, or professional auditors. These third-party service providers may use your personal information in order to provide the agreed service to us, or to you on our behalf. We have contractual agreements in place with third party data providers and we ensure that they are fully compliant with data protection laws. 

Your personal information may be held by us in one or more customer relationship management (CRM) database(s), consolidating details of your dealings with us across various services, to ensure we have clear and accurate records about your use of our services/programmes, to better understand your requirements and how we might provide other services/programmes to you. 

We may share personal information within our advisory boards, panels and stakeholders, as needed for reasonable management, analysis, planning and decision making, including in relation to taking decisions regarding our service/programme offering. 

8. International transfers 
In the occasion where your personal data is being transferred to countries outside the EEA either by us or by our third party service providers acting on our behalf, PICCASO shall put in place all the necessary organisational and technical measures to ensure those transfers are adequately protected and guarantee the security and the lawful processing of your personal information in accordance with the law. 

9. Security 
PICCASO takes all reasonable and appropriate technical and organisational measures to protect the security of your personal information, in accordance with our legal obligations.  

10. Your marketing and contact preferences 
PICCASO is committed to respecting your preference to receive marketing and advertising information from us. We may contact you with information about our products, programmes, events, courses or other resources that may be of interest to you. 

You can change or update your marketing communication by clicking the ‘Unsubscribe’ link included in every email communication we send to you or by contacting us on the contact details provided in this Privacy Notice. 

Email & Text Marketing
> PICCASO will ask for your permission to contact you by email or text for marketing purposes. 

Telephone Marketing 
> We may call to update you on our services and programmes. If you have registered your number with the Telephone Preference Service (TPS) or Corporate Telephone Service Preference (CTPS), we will only make marketing calls if you have expressly granted us permission to do so.  

If you tell us that you no longer wish to receive our direct marketing communications we will take steps to respect your modified direct marketing preferences and will keep a record of your request so as to avoid contacting you again in the future with direct marketing content. 

11. Complaints and Queries 
At PICCASO we do our best to meet the highest standards when handling personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection, use or storage of personal information is unfair, misleading or inappropriate. We also welcome any suggestions for improving our procedures. Any correspondence should be sent to the address provided below. If you are not satisfied with our response, you may report to the Information Commissioner’s Office (ICO). Details on how to do so can be found on the ICO’s website at https://ico.co.uk. 

12. Cookies 
A cookie is a text file containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies do lots of different jobs, such as letting you navigate between pages efficiently, remembering your preferences, and providing you with content that is relevant to you. 

Our website uses cookies to estimate our audience size and usage pattern, to store information about your preferences, to customise our website according to your individual interests, to speed up your searches and recognise you when you return to our website. You can control the use of cookies at your individual browser level. You can modify your cookie preferences at any time by pressing the ‘Revoke Cookies’ button at the foot of any page. 

13. How to contact us 
Our principal place of business is at Bouverie House, 154-160 Fleet St, London EC4A 2DQ. 

You can contact us by emailing hello@piccaso.org or by calling on +44 (0) 20 7112 9360 . 

14. Changes to this Privacy Notice 
We keep our privacy notice under regular review in order to reflect the changes in law and/or our privacy practices. Do check our website from time to time. In the occasion of significant changes in the way we process your personal data, we will provide a prominent notice on our website or send you a notification. 

This Privacy Notice was last updated in March 2023.