Privacy Policy

Welcome to the Ortho Consulting Group Ltd’s Privacy Policy. This Privacy Policy is divided into the following sections:

1        PURPOSE OF THIS PRIVACY POLICY

Ortho Consulting Group Ltd (‘we’, ‘our’ or ‘us’) respects your privacy and is committed to protecting your personal data. Personal data is defined as any information that can be used to identify a living person. It does not include data where the identity has been removed (anonymous data) where there is no reasonable possibility of re-associating that data with the identity of a person. This Privacy Policy sets out how we collect and use your personal data, and your legal rights relating to such data.

By using our website, app, related offers, products and services and connecting with us on social media, you consent to the collection and use of your personal data in accordance with this Privacy Policy. It is important that you read this Privacy Policy together with any other privacy notices that we may provide on specific occasions when we are collecting or processing your personal data. This Privacy Policy supplements such notices and is not intended to override them. 

NOTE: All technical terms i.e., processing etc., used in this Privacy Policy shall have the meaning set forth in the UK General Data Protection Regulation and the EU General Data Protection Regulation.

2        CONTACT INFORMATION
2.1        Controller

The controller of your personal data (the organisation that is legally responsible for deciding how and for what purposes your personal data is used for) is:

 

Company name:Ortho Consulting Group Ltd
Company number:07235657
Address:Building 81, Greenham Business Park, Newbury, RG19 6HW

2.2         Contact details

 

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, you can contact us using the details set out below:

 

Email address:Legal@orthocg.com
Address:Building 81, Greenham Business Park, Newbury, RG19 6HW
Telephone number:+44 (0)2030115574

 

3        YOUR LEGAL RIGHTS

You have the right to:

3.1.1       Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

3.1.2       Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

3.1.3       Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

3.1.4       Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

3.1.5       Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

·       If you want us to establish the data’s accuracy.

·       Where our use of the data is unlawful but you do not want us to erase it.

·       Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.

·       You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

3.1.6       Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

3.1.7       Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us using the details stated under section 2.2 above.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

You have the right to make a complaint about our processing of your personal data at any time to a supervisory authority in your country of residence i.e., the Information Commissioner’s Office (www.ico.org.uk) in relation to the United Kingdom. We would however appreciate the chance to deal with your concerns before you approach your supervisory authority, so please contact us in the first instance.

4        THE DATA WE COLLECT ABOUT YOU
4.1        Data we collect

We may collect, use, or transfer different kinds of data about you which we describe as follows:

  • Identity Data: first name, maiden name, last name, business name, username or similar identifier, gender, title, marital status, date of birth, job title, profession and online presence (e.g. LinkedIn profile).
  • Contact Data: delivery, address, billing address, email address and telephone number.
  • Financial Data: bank account and payment card details.
  • Transaction Data: details about payments to and from you, and other details of products and / or services you have purchased from us.
  • Technical Data: internet protocol (IP) address, a list of URLs (starting with a referring site, your activity on our site and the site you exit to), your login data, web browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
  • Profile Data: your username and passwords, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
  • Marketing and Communication Data: your preference in receiving marketing from us and our third parties and your communication preferences.
  • Usage Data: information about how you use our website, app, products and / or services.
  • Aggregated Data: data which is de-identified and combined with other data sets such as it cannot reveal your identified. For example, we may aggregate you Usage Data to calculate the percentage of users accessing a specific website feature.

We may also collect Special Category Data, also referred to as sensitive data. We occasionally collect special category health information that is shared with us by third parties in the medical sphere, specific to orthopaedic medical treatment. This data is analysed and used in order to monitor product use and performance and to comply with regulatory reporting requirements applicable to our clients. We do not collect special category data about religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership or information about your genetic and biometric data. Nor do we collect any information about criminal convictions and offences outside of our employee privacy notice. In some circumstances, we may use sensitive data for secondary purposes such as research, product development and analytics for commercial and non-commercial purposes. In this case, additional precautions such as pseudonymizaton, de-identification or anonymization will be carried out prior to use.

We do not knowingly solicit or collect personal information about children, not do we knowingly market our products and services to children. If we become aware of such data, we will try to delete the data as soon as possible.

4.2        Failure to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with the product and / or services). In this case, we may have to cancel the products and / or services you have with us but we will notify you if this is the case at the time.

5        HOW YOUR PERSONAL DATA IS COLLECTED

We use different methods to collect data from and about you including:

  • Direct interactions. You may give us your Identity Data, Contact Data, Financial Data and Transaction Data by filling in forms, or by corresponding with us in person, by post, phone, email, via our website, app or otherwise. This includes personal data you provide when you:
  • create an account on our website or on our app;
  • subscribe to our service or publications;
  • respond to our marketing or other communications;
  • request marketing to be sent to you;
  • interact with us via social media or online forums;
  • participate in our offers, programs or promotions;
  • discuss an actual or potential business relationship with us;
  • provide us with your business card or contact details at trade shows or other events;
  • give us feedback (including customer complaints, post market surveillance) or contact us.

NOTE: Indirectly we occasionally collect patient identifiable information in connection with post market clinical feedback and post market surveillance purposes relating to third party products.

  • Automated technologies or interactions. As you interact with our website, app and social media presence, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookie Policy (https://orthocg.com/cookie-policy/) for further details.
  • Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
  • Technical Data from the following parties: analytics providers such as Google, advertising networks, and search information providers.
  • Identity Data and Contact Data from publicly available sources such as Companies House, S&P CapIQ, Dun & Bradstreet and LinkedIn.
  • Identity Data and Contact Data from data aggregators such as RocketReach and HunterIO.
  • Contact Data, Financial Data and Transaction Data from providers of technical, payment and delivery services.
6        HOW AND WHY WE USE YOUR PERSONAL DATA

Set out in the table below is a description of all the ways we plan to use your personal data, and which of the legal basis we rely on to do so. We have also identified what our legitimate interests are where appropriate. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us using the contact details provided under section 2.2.

 

Purpose/ActivityType of DataLawful basis for processing (including basis of legitimate interest)
To respond to your inquiry.(a) Identity Data

(b) Contact Data

(c) Technical Data

(a) Your consent for us to use your personal data to process your request.

(b) Necessary for our legitimate interest to process your request.

To register you as a new customer / client(a) Identity Data

(b) Contact Data

(c) Financial Data

Performance of a contract.
A commercial agreement(a) Identity Data

(b) Contact Data

(c) Financial Data

(d) Transaction Data

Performance of a contract.
Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us(a) Identity Data

(b) Contract Data

(c) Financial Data

(a) To comply with our legal and regulatory obligations.

(b) Necessary for our legitimate interest or those of a third party, i.e. to minimise fraud that could be damaging for you and/or us.

To process and deliver order including:

(a) manage payment, fees and charges

(b) collect and recover money owed to us

(a) Identity Data

(b) Contact Data

(c) Financial Data

(d) Transaction Data

 

(a) Performance of a contract with you.

(b) Necessary for our legitimate interest for the associated business operations.

 

To manage our relationship with you which will include:

(a) notifying you about changes to our terms or privacy policy

(b) asking you to leave a review

(a) Identity Data

(b) Contact Data

(c) Profile Data

(d) Marketing and Communication Data

(a) Performance of a contract with you.

(b) Necessary to comply with a legal obligation to notify and inform.

(c) Necessary for our legitimate interest to keep our records updated and to study how our customers / clients use our products/services.

To enable you to partake in a prize draw, competition or complete a survey

 

(a) Identity Data

(b) Contact Data

(c) Profile Data

(d) Usage Data

(e) Marketing and Communications Data

(a) Performance of a contract with you.

(b) Necessary for our legitimate interests to study how our customers / clients use our products/services, to develop them and grow our business.

To administer and protect our business, our website and app (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

 

(a) Identity Data

(b) Contact Data

(c) Technical Data

 

(a) Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise.

(b) Necessary to comply with a legal obligation.

To use data analytics to improve our website, app, products/services, marketing, customer relationships and experiences

 

(a) Technical Data

(b) Usage Data

 

(a) Your consent to our Cookies tool.

(b) Necessary for our legitimate interests to define types of customers / clients for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy

 

To make suggestions and recommendations to you about products or services that may be of interest to you.

 

(a) Identity Data

(b) Contact Data

(c) Technical Data

(d) Usage Data

(e) Profile Data

(f) Marketing and Communications Data

Necessary for our legitimate interests to develop our products/services and grow our business

 

Download information from our website/app

 

(a) Identity Data

(b) Contact Data (an account registration to receive information)

Necessary for our legitimate interests to study how visitors use our website/app, and to develop and grow our website/app
Create and manage your app account with us(a)   Identity Data

(b)   Contact Data

(c)    Profile Data

(d)   Usage Data

(a) Your consent for us to use your personal data to process your request.

(b) Necessary for our legitimate interest to process your request.

To provide the services and functionality available in the app(a) Identity Data

(b) Contact Data

(c) Technical Data

(d) Profile Data

(e) Usage Data

(f) Marketing and Communications Data

(a) Performance of our contract with you

(b) Necessary for our legitimate interests to provide an efficient service to you.

(c) Necessary for our legitimate interests to study how our customers / clients use our products and / or services, to develop them, to grow our business and to inform our marketing strategy.

 

Data collected when you permit the collection of location dataNecessary for our legitimate interests to grow our business and inform our marketing strategy.

 

To deliver relevant website/app content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you

 

(a) Identity Data

(b) Contact Data

(c) Profile Data

(d) Usage Data

(e) Marketing and Communications Data

(f) Technical Data

(a) Your consent to our Cookies tool.

(b) Necessary for our legitimate interests to study how our customers / clients use our products and / or services, to develop them, to grow our business and to inform our marketing strategy.

 

See section 6.1 (Marketing) below for further information.

Marketing our products and / or services to existing and former customers(a) Identity Data

(b) Contact Data

(c) Profile Data

(d) Usage Data

(e) Marketing and Communications Data

(f) Technical Data

Necessary for our legitimate interest to promote our business to exiting and former customers / clients.

 

See section 6.1 (Marketing) below for further information.

External audits and quality checks(a) Identity Data

(b) Contact Data

(c) Financial Data

(d) Transaction Data

(e) Profile Data

(f) Usage Data

(a) Necessary to comply with our legal and regulatory obligations.

(b) Necessary for our legitimate interest to maintain our accreditations so we can demonstrate we operate at the highest standards.

To share your personal data with third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary.(a) Identity Data

(b) Contact Data

(c) Financial Data

(d) Transaction Data

(e) Profile Data

(f) Usage Data

(g) Aggregated Data

(a) Necessary to comply with our legal and regulatory obligations.

(b) Necessary for our legitimate interests to protect, realise or grow the value in our business and assets.

To deliver webinars and events(a) Identity Data

(b) Contact Data

(c) Technical Data

(d) Profile Data

(e) Marketing and Communication Data

(f) Usage Data

(g) Aggregated Data

(a) To fulfil contractual and pre-contractual obligations in connection with such events.

(b) Your consent obtained directly from you or the person who registers you for the event.

(c) Necessary for our legitimate interest to promote our products, service and business.

 

To be able to offer and carry out events, we may use external processors or

sub-processors. Depending on the processors it may be a service based inside or outside the European Economic Area. To comply with our duty of care and ensure the protection of your personal data, we conclude written agreements on commissioned processing and implement EU standard contractual clauses where required. The following processors may be engaged in the context of webinars: Livestorm.co

 

We would like to expressly point out that during the webinar and event, we may record participants and, if applicable, entry and selection times of your attendance. This information services the issuing of certificates of attendance. We process your personal data in accordance with Article 6 para, 1 lit b), f) GDPR. If the webinars and events are recorded by us, you will receive information in advance.  In addition, during our webinars and events organised/held by us, photo, audio and / or video recording may be taken. You have the option to unsubscribe from our event or webinar free of charge at any time and therefore make use of your right to object.

 

If we provide information on our website about events and provide the link for registration where we are only acting as a sponsor and are not the data controller. This Privacy Policy does not govern such processing of your personal data. The data protection information for the respective responsible unit applies.

To process an employment application.(a) Identity Data

(b) Contact Data

(a) Your consent to processing your inquiry and application.

(b) Processing is necessary to fulfil contractual obligations or to carry out pre-contractual measures based on your request.

(c) Necessary for our legitimate interest to process your inquiry and application.

After the application process, your data will be restricted for further processing and deleted or destroyed at the latest when the legal deadlines have been reached after you have received the rejection letter, or the application document will be returned to you and any copies deleted or destroyed, unless you have expressly consented to our continued use of your data.

Using maps provided by external providers (Google Maps Provider) to help you determine our location and to enable you to use other functions of such external providers.(a) Technical DataNecessary for our legitimate interest to promote our products, service and business.

 

We are not the responsible party in terms of data protection for any subsequent data collection and / or processing by such service providers. The respective privacy policy and further information on data protection of the respecting responsible parties apply and must be considered.

 

To enforce legal rights or defend or undertake legal proceedings(a) Identity Data

(b) Contact Data

(c) Technical Data

(d) Profile Data

(e) Marketing and Communication Data

(f) Usage Data

(g) Aggregated Data

Depending on the circumstances:

(a) to comply with our legal and regulatory obligations; or

(b) in other cases, for our legitimate interests or those of a third party, ie to protect our business, interests and right or those of others

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. The types of lawful basis that we will rely on to process your personal data are set out in section 6.1 below.

6.1        LAWFUL BASIS

6.1.1       Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best product and / or service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

6.1.2       Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

6.1.3       Comply with a legal and/or regulatory obligation means processing your personal data where it is necessary for compliance with a legal and/or regulatory obligation that we are subject to.

6.2        MARKETING

We may use your personal data to send you updates (by email, text message, telephone or post) about our products and / or services, including exclusive offers, promotions or new products and / or services. We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you marketing information. However, where consent is needed, we will ask for this separately and clearly.

Our marketing notifications comprise of:

  • We offer a newsletter to keep you up to date at first hand. By subscribing to the newsletter, you agree to receiving it. We will process your name, address, email address and any other information you provide in the registration form.
  • Existing customer marketing (Direct Marketing). If we have received your Identity Data or Contact Data in connection with the sale of a product and / or services, and you have not objected to this, we will process such data in order to conduct email and / or telephone calls and / or text messages marketing our goods and / or services. It is important that the Identity Data or Contact Data we hold about you is accurate and current. Please keep us informed of your personal information changes during your working relationship with us.
  • Social media presence. We maintain social media presence through external services in order to be able to communicate with users and optimise our online offering and marketing. For this purpose, plug-ins or direct links of such platforms (i.e, Twitter, Instagram, Facebook, LinkedIn and Apple app store) may be embedded on our website. By clicking on such plug-ins or direct links, your Technical Data may be transmitted to the corresponding social platform media. We are not responsible for any subsequent data collection and / or processing by such social media platforms. The respective privacy policy and further information on data protection of the respective responsible parties apply and must be considered.

You have the right to opt out of receiving marketing communications at any time by contacting us at mkt@orthocg.com or replying ‘STOP’ to any text message communication received from us.

If you revoke your consent, we reserve the right to process your personal data in a so-called blacklist/blocklist in order to be able to ensure that no further adhoc releases are sent to you in the future. It may take up to 30 days from the time of revocation until your data is added to the blacklist/blocklist. Our legitimate interest here is the avoidance of unwanted marketing notification. Unsubscribed and unqualified contacts or those who are not engaging with our content will be moved to an inactive email list so that they cannot be accidentally contacted. They will not be deleted to prevent them being duplicated or inadvertently re-added to an active campaign later on.

We may ask you to confirm or update your marketing preferences if you ask us to provide further products and / or services in the future, or if there are changes in the law, regulation, or the structure of our business. We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes. For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your legal rights’ above.

7        WHO WE SHARE YOUR PERSONAL DATA WITH

We routinely share personal data with:

  • third parties we use to help deliver our products and / or services to you, i.e. payment service providers, warehouses and delivery companies
  • other third parties we use to help us run our business, marketing agencies, website hosts and website analytics providers
  • our banks
  • other companies in our group (including our subsidiaries)

We or the third parties mentioned above may occasionally also need to share personal data with:

  • external auditors i.e., in relation to the audit of our accounts, in which case the recipient of the information will be bound by confidentiality obligations
  • professional advisors (such as lawyers, clinical health professionals, and other advisors), in which case the recipient of the information will be bound by confidentiality obligations
  • law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations
  • other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

If you would like more information about who we share our data with and why, please contact us using the details provided under section 2.2.

8        HOW LONG YOUR PERSONAL DATA WILL BE KEPT

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirement. Laws of the country of your citizenship will also determine the period of data retention. In some circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

If we have asked for your consent and you have given it, we will delete your personal data if you withdraw your consent and there is no other legal basis for the processing.

9        TRANSFERRING YOUR PERSONAL DATA OUT OF THE UK AND EEA

It is sometimes necessary for us to share your personal data with third parties based outside the UK. In those cases, we ensure that a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. A list of countries the UK currently has adequacy regulations in relation to is available here.
  • Where we use certain service providers, we may use specific contracts approved for use in the UK which will give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

10      KEEPING YOUR DATA SECURE

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

11      COOKIES

We use cookies on our website. A cookie is a small text file which is placed onto your device (eg computer, smartphone or other electronic device) when you use our website, app or social media channels. We may use the information we obtain from the cookie in the administration of our website and/or app, to improve the website’s visibility and marketing purposes. We also use that information to recognise your computer when you visit our website and app and personalise our website  and app for you. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

12      THIRD-PARTY LINKS

Our website (www.orthocg.com) may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

13      CHANGES TO OUR PRIVACY NOTICE

We keep our Privacy Policy under regular review. We may change this Privacy Policy from time to time (for example if the law changes). Any changes will be immediately posted on our website. We recommend that you check the privacy notice regularly to remain up to date.

14      ALTERNATIVE FORMATS

If you would like this policy in another format (for example audio, large print, braille) please contact us using the contact details set out in section 2.2.