This notice was last updated in June 2023. We may change this notice from time to time by publishing a new version on our website, so please check this page occasionally to make sure you are happy with any changes.

We are committed to respecting your privacy and information that could identify you as an individual (‘personal data’). This notice describes the personal data we may collect about you, how we use and secure it, and your rights in respect of such personal data.

WHO ARE WE?

We are Airbox Systems Limited, experts in collaborative and interactive mapping solutions. We are a company registered in England and Wales number 06534784, with our registered office at Unit 4 The Quadrangle, Downsview Road, Grove Business Centre, Wantage, OX12 9FA, UK.

SCOPE OF THIS NOTICE

This notice describes our processing of personal data we obtain about:

(a)          visitors to our website at uk.airboxsystems.com;

(b)          staff and representatives of our business customers and potential business customers;

(c)           staff and representatives of our business suppliers and potential business suppliers; and

(d)          individual customers of RunwayHD.

For the purposes of UK data protection law, we are the ‘controller’ of this personal data (meaning that we determine why and how it is processed).

This notice does not explain our processing of personal data as a processor on behalf of our business customers who use our services. Typically, for example, we will be the processor of any personal data which the business customers end users will submit to our services through the use of our services. Also, if we visit the sites of our business customers or otherwise access their systems and data to perform installation and other consultancy services, we may have incidental access to their personal data. In this case, they will be the controller and we will act as their processor. This processing is instead described in and governed by contracts between us and our business customers.

This notice does not describe our processing of personal data relating to people who apply for jobs with us.  Neither does this notice describe our processing of personal data relating to our employees.  Our processing for employment-related purposes is set out in a separate notice that we make available to our employees .

WHAT PERSONAL DATA DO WE COLLECT?

In this section we have set out the general categories of personal data that we process and, in the case of personal data that we did not obtain directly from you, information about the source and specific categories of that data.

We may process data enabling us to get in touch with you in connection with providing services to our customers and potential customers ("business contact data"). The business contact data may include your name, business email address, telephone number, postal address, job title, your classification / categorisation within our customer relationship management system and information contained in or relating to communications between us and you, or between us and your employer. The source of the business contact data is you, your colleagues, your employer, public sources (such as LinkedIn or corporate websites) or reputable lead generation list providers.

We may process your user account data ("account data"). The account data may include your account identifier, name, email address, business name, account creation and modification dates, website settings and marketing preferences. The primary source of the account data is you and/or your employer, although some elements of the account data may be generated by our website.

We may process information contained in or relating to any communication that you send to us or that we send to you ("communication data"). This may include where you contact us in relation to a support request for our services. The communication data may include any personal data contained in the content, name, address, company name, contact details and any metadata associated with the communication such as the date and time of sending. We obtain this data when you contact us by email, phone, post, social media or website contact forms. The source of the communication data is you and/or your employer, and our website will generate the metadata associated with communications made using the website contact forms and live chat web service.

We may process data about your use of our website and services ("usage data"). The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. The source of the usage data is our analytics tracking system. For more information on this please see our cookies policy which may be accessed on our website.

We may process data collected in connection with any marketing subscription or opt-out request (“marketing data”). The marketing data may include your email address and marketing preferences. The source of this data is you and/or your employer.

With respect to our individual customers of RunwayHD we may also process the following personal data:

We may process your personal data that are provided in the course of the use of our services and generated by our services in the course of such use ("service data"). The service data may include your name, email address, telephone number, product usage analytics data, statistics data and performance data . It can also include location data. Our applications bring various sources of situational awareness information together into a single place to provide a common operating picture for our users. Based on permissions which can be set in the host device, our applications track and display a user’s location in near real-time. The collection of location information is limited to that required for these functional purposes and is used only as part of this functionality as laid out in our user documentation. Real-time location information is shared with other permitted users of the applications, only within groups determined by the users or their organisations and as laid out in our user documentation. This stored location data is shared with no third parties unless specifically requested by the customer. The source of the service data is you and/or our services.

We may process information relating to transactions, including purchases of goods and/or services, that you enter into with us ("transaction data"). The transaction data may include your name, your contact details, your payment card details (or other payment details) and the transaction details. The source of the transaction data is you and/or our payment services provider.

Please do not supply any other person's personal data to us, unless we prompt you to do so.

WHY DO WE USE YOUR PERSONAL DATA?

In this section , we have set out the purposes for which we may process personal data and the legal bases of the processing.

Operations - We may process your personal data for the purposes of operating our website, the processing and fulfilment of orders, providing our products and services, managing your account, receiving your company’s services, generating invoices, bills and other payment-related documentation, and credit control. The legal basis for this processing is our legitimate interests, namely the proper administration of our website, services and business.

Relationships and communications - We may process business contact data, account data, and/or communication data for the purposes of managing our relationships, providing support, complaint handling and communicating with you (excluding communicating for the purposes of direct marketing) by email, post, telephone and/or in person, for example, to answer your enquiries and to provide you with service information relevant to our customers generally such as problems affecting access to or use of our services. The legal basis for this processing is our legitimate interests, namely communications with our website visitors, service users, potential customers, customers and customer personnel, the maintenance of our relationships, enabling the use of our services, and the proper administration of our website, services and business. If you contact us to report problems or ask questions about our products and services, we will record details of our interaction with you in our support ticket management system. It is also in our legitimate interests to use this information to respond to your request, improve our existing products and services, research and develop new products and services, troubleshoot and remedy issues with our products and services, monitor trends, monitor support response times and effectiveness, seek feedback about our products and services, monitor customer satisfaction, and provide staff training to ensure we provide the best possible service to our clients and potential clients. .

Direct marketing - We may process business contact data and/or marketing data for the purposes of creating, targeting and sending direct marketing communications by email, SMS, and/or post and making contact by telephone for marketing-related purposes. See more on this in the “Using personal data for marketing purposes” section below. The legal basis for this processing is our legitimate interests, namely promoting our business and communicating marketing messages and offers to our website visitors and service users.

Planning - We may process  usage data for the purposes of forecasting, product roadmap and lifecycle planning, trend analysis and financial reporting. The legal basis for this processing is our legitimate interests, namely monitoring, supporting, improving and securing our website, services and business generally.

Research and analysis - We may process usage data for the purposes of researching and analysing the use of our website and services, for example, finding out how many people visit various parts of the site, so that we can assess how successful our website is and how it could be improved or developed. We may also process the usage data for the purposes of researching and analysing other interactions with our business. The legal basis for this processing is our legitimate interests, namely monitoring, supporting, improving and securing our website, services and business generally.

Record keeping - We may process your personal data for the purposes of creating and maintaining our databases, back-up copies of our databases and our business records generally. The legal basis for this processing is our legitimate interests, namely ensuring that we have access to all the information we need to properly and efficiently run our business in accordance with this policy.

Open source submissions - If you contribute code to our open source projects, we may record your name and details of your submission in our code repositories, company records and in publicly available notices that are included with the code. The legal basis for this processing is legitimate interests, namely a proper administration of our services and business.

Security - We may process your personal data for the purposes of security ( including monitoring our company systems, data and equipment for the purposes of threat detection and prevention, investigating and remedying security incidents, and ensuring lawful use of such systems, data and equipment) and the prevention of fraud and other criminal activity such as export and trade sanction violations, bribery, corruption and modern slavery. The legal basis of this processing is our legitimate interests, namely the protection of our website, services and business, and the protection of others.

Insurance and risk management - We may process your personal data where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks and/or obtaining professional advice. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.

Legal claims - We may process your personal data where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.

Legal compliance and vital interests - We may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or in order to protect your vital interests or the vital interests of another natural person.

Website cookies

Our websites and portals may use cookies and other tracking technologies. Insofar as those cookies or tracking technologies are not strictly necessary for the provision of our website and services, we will ask you to consent to our use of them when you first visit our website.

Using personal data for marketing purposes

We send occasional emails containing information about our business, products and services to the following categories of people:

• individual customers who have previously bought our products and services;
• staff and representatives of our business customers or target business customers; and
• people who have subscribed to receive our newsletter or other marketing communications

You can ask us to stop sending you marketing communications at any time by contacting  info@airboxsystems.com or clicking on any unsubscribe options in the communications that you receive. We do not sell or rent personal data to third parties.

 

PROVIDING YOUR PERSONAL DATA TO OTHERS

We may share the personal data described in this notice with the following categories of recipients, where and to the extent necessary for the purposes described in this notice:

Insurers and professional advisers: such as lawyers, accountants and business and marketing consultants, but only if and to the extent necessary for them to carry out the work we engage them to assist us with, for example in relation to a legal claim made against us, managing risks or obtaining insurance coverage.

Organisations or individuals engaged by us in the course of providing our services: such as individual consultants or their personal service companies who provide software/website programming/development services or assist with providing support and maintenance services to our customers.

Prospective buyer: if we propose to sell or do sell any of our business or assets, we may make personal data available to a prospective buyer for the purposes of pre-sale due diligence or to a buyer as information assets transferred as part of the sale – for example a prospective buyer may request details of any outstanding legal claim against us, or a buyer may acquire ownership of our business contacts/customer databases.

Service providers: We use a number of service providers in connection with our website, services, communications and IT infrastructure, which involves those service providers processing some of the personal data described in this notice to the extent necessary to provide the relevant services.  We currently use the following providers:

Service provider name	Nature of services	Types of data processed
Google Analytics	Website usage metrics	Anonymised usage data
Umbraco Cloud	Website host	Processing of data sent through web contact form
Sage Pay (Only relevant in relation to processing personal data of individual customers of RunwayHD)	Credit Card translation processor	Processing payments for RunwayHD subscriptions.

 

We have contracts with all our service providers to ensure that they treat the personal data they receive in compliance with applicable data protection laws, including that they only process the personal data described in this notice to the extent necessary to provide the services.

In addition to the specific disclosures of personal data set out in this section, we may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA

In this section, we provide information about the circumstances in which your personal data may be transferred to a third country under UK data protection law.

We may transfer your personal data from the European Economic Area (EEA) to the UK and process that personal data in the UK for the purposes set out in this policy, and may permit our suppliers and subcontractors to do so, during any period with respect to which the UK benefits from an adequacy decision under EU data protection law; and we may transfer your personal data from the UK to the EEA and process that personal data in the EEA for the purposes set out in this policy, and may permit our suppliers and subcontractors to do so, during any period with respect to which EEA states benefit from adequacy regulations under UK data protection law.

We transfer some personal data to the service providers described in the ‘Providing your personal data to others’ section above that are based in countries outside the UK.

• The majority of these are to [the USA] and in all cases we will ensure that appropriate safeguards are in place to protect your personal data (namely the use of standard data protection clauses adopted or approved by the competent data protection authorities). Please contact us (see section OUR DETAILS below) if you would like to see a copy of these standard clauses.

For more information or to request copies of the standard contractual clauses, please contact info@airboxsystems.com.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

This section sets out our data retention policies and procedures, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.

Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

We will retain your personal data as follows:

• Business contact data: Any business contact data relating to our customers we keep for 6 years after the relevant customer contract has terminated. Any business contact data relating to enquiries from potential customers we keep as follows: submitted web contact forms are stored for one year and any such data in the form of emails we store as per Communication Data, below.
• Account data: We delete this 6 years after the relevant customer contract has terminated.
• Transaction data: We delete this 6 years following termination of the relevant subscription.
• Communication data: We store emails for 7 years after the date of the correspondence, but if the email relates to a customer contract, we store the information contained for 7 years after termination of the customer contract to which the email relates. Submitted web contact forms are stored for one year.
• Usage data: The statistical reports provided to us by Google Analytics are retained by us for 12 months. However, these contain only aggregated data that do not enable us to identify individual users.
• Marketing data: We will continue to use this data until we receive an opt-out request, after which time we will retain the email address and marketing preference information to ensure that we do not send marketing to the unsubscribed email address.
• Service data: We retain location data for up to 30 days unless requested otherwise and under custom arrangements on a per customer basis.

Notwithstanding the other provisions of this section, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

WHAT RIGHTS DO YOU HAVE?

In this section, we have summarised the rights that you have under data protection law. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

Your principal rights under data protection law are:

(a)          the right to access - you can ask for copies of your personal data;

(b)          the right to rectification - you can ask us to rectify inaccurate personal data and to complete incomplete personal data;

(c)           the right to erasure - you can ask us to erase your personal data;

(d)          the right to restrict processing - you can ask us to restrict the processing of your personal data;

(e)          the right to object to processing - you can object to the processing of your personal data;

(f)           the right to data portability - you can ask that we transfer your personal data to another organisation or to you;

(g)          the right to complain to a supervisory authority - you can complain about our processing of your personal data; and

(h)          the right to withdraw consent - to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.

Access: You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee.

Rectification: You have the right to have any inaccurate personal data about you corrected and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

Erasure: In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.

Restriction: In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful but you oppose erasure; we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.

Object: You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Object to processing for direct marketing purposes: You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.

Object to processing for scientific or historical research purposes or statistical purposes: You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Data portability: To the extent that the legal basis for our processing of your personal data is:

(a)          consent; or

(b)          that the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract,

and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.

Complain to a supervisory authority: If you consider that our processing of your personal data infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. In relation to complaints under EU data protection law, you may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement; in relation to complaints under UK data protection law, you should do so in the UK.

Withdraw consent: To the extent that the legal basis for our processing of your personal data is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

How to exercise these rights against us: You may exercise any of your rights in relation to your personal data by emailing your request to info@airboxsystems.com,  in addition to the other methods specified in this policy.

How to complain to a supervisory authority: To make a complaint to a supervisory authority, you may contact the supervisory authority of your choice using contact details made available by that supervisory authority.  Relevant contact details for the UK supervisory authority, the ICO, can be found here: https://ico.org.uk/concerns/.

Depending on the circumstances, we may need to verify your identity before complying with your request.

THIRD PARTY WEBSITES

We may provide links to, and details of, websites that are owned by other individuals or organisations. This notice only applies to us and we have no control over, and are not responsible for, the privacy practices of others. We encourage you to read the privacy policies and notices on other websites that you visit.

SECURITY OF PERSONAL DATA

We have ISO27001 accreditation, and have appropriate technical and organisational measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access, taking into account the nature of the personal data and the associated risks.

Where you have been given or you have chosen passwords or other access control mechanisms, you are responsible for keeping these items confidential. Where you choose a password, you should ensure that it is not susceptible to being guessed, whether by a person or a computer programme. 

PERSONAL DATA OF CHILDREN

Our website and services are targeted at persons over the age of 18. If we have reason to believe that we hold personal data of a person under that age in our databases, we will delete that personal data.

UPDATING INFORMATION

Please let us know if the personal information that we hold about you needs to be corrected or updated.

OUR DETAILS

This website is owned and operated by Airbox Systems Limited.

We are registered in England and Wales under registration number 06534784, and our registered office is at Unit 4 The Quadrangle, Downsview Road, Grove Business Centre, Wantage, OX12 9FA, UK.

Our principal place of business is at the same address.

You can contact us:

(a)          by post, to the postal address given above;

(b)          using our website contact form;

(c)           by telephone, on the contact number published on our website; or

(d)          by email, using the following address: info@airboxsystems.com.

DATA PROTECTION REGISTRATION

We are registered as a data controller with the UK Information Commissioner's Office. Our data protection registration number is ZA225584.