Privacy Policy

1. Introduction

BillMyTask App is owned by Corient Business Solutions Limited. Corient Business Solutions Limited is registered company in England and Wales registered number 7880941 with office at The Techno Centre, Puma Way, Coventry, CV 1 2TT

Corient Business Solutions Limited which is a Data Controller and is registered with the Information Commissioner Office (ICO) under reference ZA095945

Corient Business Solutions Limited (Corient) is strongly committed to protecting personal data.  This privacy statement describes why and how we collect and use personal data and provides information about individuals’ rights.  It applies to personal data provided to us, both by individuals themselves or by others. We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.

We may change this Policy from time to time so please check this page occasionally to ensure that you’re happy with any changes. By using our website, you’re agreeing to be bound by this Policy.

Any questions regarding this Policy and our privacy practices should be sent by email to info@billymytask.com/info@corientbs.com or by writing to Corient Business Solutions Limited, The Techno Centre, Puma Way, Coventry, CV 1 2TT. Alternatively, you can telephone 02476 103333

2. What is Personal Data

Personal data is any information relating to an identified or identifiable living person.  When “you” or “your” are used in this statement, we are referring to the relevant individual who is the subject of the personal data. Corient processes personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.  

When collecting and using personal data, our policy is to be transparent about why and how we process personal data.  To find out more about our specific processing activities, please go to the relevant sections of this statement.

3. Our processing activities

a. Potential Clients and Business Contacts                   

i.  Data Collection

Corient processes personal data about contacts (existing and potential Corient clients and/or individuals associated with them) using a customer relationship management system (the “Corient CRM”).

The collection of personal data about contacts and the addition of that personal data to the Corient CRM is initiated by a Corient user and will include

• name,
• employer name,
• contact title,
• phone,
• email and
• other business contact details.   

In addition, the Corient CRM may collect data from Corient email (sender name, recipient name, date and time) and calendar (organiser name, participant name, date and time of event) systems concerning interactions between Corient users and contacts or third parties.

 ii. Personal Data Usage

Personal data relating to business contacts may be used for our legitimate interests including the following:

Managing and developing our businesses and services

• We may process personal data in order to run our business, including:
  • managing our relationship with clients;
  • developing our businesses and services (such as identifying client needs and improvements in service delivery and learning more about a client, relationship opportunity we have an interest in);
• Analysing and evaluating the strength of interactions between us and a contact.
• Performing analytics, including producing metrics for Corient leadership, such as on trends, relationship maps, sales intelligence and progress against account business goals;
• Administering and managing our website and systems and applications.

Providing information about us and our range of services

Unless we are asked not to, we use client business contact details to provide information that we think will be of interest about us and our services.  For example, our newsletter, blogs, other services that may be relevant.

Corient does not sell or otherwise release personal data contained in the Corient CRM to third parties for the purpose of allowing them to market their products and services.

iii. Data Retention Policy

Personal data will be retained on the Corient CRM for as long as we have, or need to keep a record of, a relationship with a business contact, which is for the duration of our relationship with a contact or their organisation.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights. 

iv. Data Sharing

The Corient CRM is inhouse developed and is hosted on secured cloud servers within United Kingdom.  The information in the Corient CRM may be accessed by Corient Group Companies for the purposes described above.

b. Our Clients- Individuals, Sole Proprietors, Partnership Firms, LLPs, Limited Companies

i. Collection of Data

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data with us where it is strictly needed for those purposes.

Where we need to process personal data to provide professional services, we ask our clients to provide the necessary information to the data subjects regarding its use.  Our clients may use relevant sections of this privacy statement or refer data subjects to this privacy statement if they consider it appropriate to do so.

The categories of personal data processed by us in relation to the services we provide to our clients are generally:

• Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
• Contact details (e.g. email address, contact number, postal address);
• Financial details (e.g. salary and other income and investments, benefits, tax status); and
• Job details (e.g. role, grade, experience and performance information).

For providing Payroll Services to our clients, we may collect the above data for employees, contractors and sub-contractors of the client

Generally, we collect personal data from our clients or from third parties when providing services to the relevant client.

ii. Use​ ​of​ ​personal​ data

Providing professional services

We provide a diverse range of professional services including Book Keeping, VAT, Payroll, Management Accounts, Accounts Preparation and Personal Tax and Corporate Tax. Some of these services require us to process personal data in order to provide required deliverables

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data). Some of the measures we taken to ensure our clients data is protected are mentioned below:

• The Network and Data Structure are ISO 27001 Certified
• Paperless Environment
• Automated Scans to identify harmful emails
• Firewalls and other applicable security standards to detect, investigate and eliminate data threats
• Policies and Procedures to monitor usage of data
• Restricted use of Mobile Phones on the operations floor
• 2 Level Authentication for accessing systems
• Biometric access to ensure authorise access to the operations floor
  • Restriction on Computers, etc for transfer of data

Further, we have procedures in place to monitor the quality of our services and manage risks in relation to our client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures.

iii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is 7 years.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iv. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use group companies to help us deliver our services as agreed with our client on an engagement-specific basis.

c. Individuals whose personal data we obtain in connection with providing services to our clients             

i. Collection of Data

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data with us where it is strictly needed for those purposes.

Where we need to process personal data to provide professional services, we ask our clients or our client’s clients to provide the necessary information to the data subjects regarding its use.  Our clients or their clients may use relevant sections of this privacy statement or refer data subjects to this privacy statement if they consider it appropriate to do so.

The categories of personal data processed by us in relation to the services we provide to our clients are generally:

• Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
• Contact details (e.g. email address, contact number, postal address);
• Financial details (e.g. salary and other income and investments, benefits, tax status); and
• Job details (e.g. role, grade, experience and performance information).

For providing Payroll Services to our clients, we may collect the above data for employees, contractors and sub-contractors of the client’s client

Generally, we collect personal data from our clients or from third parties when providing services to the relevant client.

ii. Use​ ​of​ ​personal​ data

Providing professional services

We provide a diverse range of professional services including Book Keeping, VAT, Payroll, Management Accounts, Accounts Preparation and Personal Tax and Corporate Tax. Some of these services require us to process personal data in order to provide required deliverables

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data). Some of the measures we taken to ensure our clients data is protected are mentioned below:

• The Network and Data Structure are ISO 27001 Certified
• Paperless Environment
• Automated Scans to identify harmful emails
• Firewalls and other applicable security standards to detect, investigate and eliminate data threats
• Policies and Procedures to monitor usage of data
• Restricted use of Mobile Phones on the operations floor
• 2 Level Authentication for accessing systems
• Biometric access to ensure authorise access to the operations floor
• Restricted Data Transfer Controls
• Accessing Clients data through Clients network only

Further, we have procedures in place to monitor the quality of our services and manage risks in relation to our client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures.

iii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is based on our client’s guidelines.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iv. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

d. Recruitment Applicants

This section of our privacy statement describes why and how we collect and use personal data in connection with our recruitment activities.

If your application is successful, we carry out pre-employment screening checks as part of our onboarding process.  Depending on the role you have applied for, these checks may include criminal records checks.

i. Collection of Data

We will collect personal data in connection with our recruitment activities as described below.

Most of the personal data we collect as part of our recruitment process is provided by you such as:

• Contact details (name, email, telephone number);
• Areas of interest;
• CV, experience, education, academic and professional qualifications;
• Information provided as part of interviews and assessments;
• Pre-employment screening information if your application is successful;
• Information about you and your immediate family’s financial relationships if your application is successful; and
• Bank account details if your application is successful.

We create personal data in connection with our recruitment activities such as:

• Interview and assessment results and feedback; and
• Offer details

We obtain personal data from third party sources such as:

• References from your named referees;
• Information from your referrer (where applicable);
• Results of Disclosure and Barring Service checks (depending on the role applied for);
• Verification of information provided during the recruitment process by contacting relevant third parties (for example, previous employers, education and qualification providers) or using publicly available sources (for example, to verify your experience, education and qualifications); and
• Information from social media sites that you are a member of about your engagement with our recruitment campaigns.

ii. Use​ ​of​ ​personal​ data

We process personal data for our legitimate interests to attract and secure the best talent to work with us as follows:

• To attract talent and market opportunities at Corient by using recruiters to help find talent for us.
• To identify and source talent by searching our existing talent pool and publicly available sources (such as social media and job websites of which you are a member).
• To process and manage applications for roles at Corient, evaluate you for open positions that match your interests and experience, manage your candidate profile, send you email notifications and other announcements, request additional information or otherwise contact you about your candidacy.
• To screen and select talent by evaluating your suitability for employment with Corient, including through interviews and assessments and conducting background checks.
• To hire and onboard talent by making an offer to successful applicants and carrying out pre-employment screening checks.
• Any other purposes stated when you provide the information to Corient.

iii. Data retention

We retain personal data processed in connection with our recruitment activities as follows:

• If your application is successful we will retain relevant personal data as part of your employee record
• If your application is unsuccessful, we will retain and use the information you provided to Corient as part of your application for a reasonable period of time to deal with any matter which may arise in connection with your application, for purposes of contacting you regarding other employment opportunities and for our legitimate business purposes (for example, to make sure we do not contact an individual about a role they have already applied for)

iv. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

e. Our Staff

We collect personal data concerning our own personnel (Directors, staff and contractors) as part of the administration, management and promotion of our business activities.

Please refer to our internal Privacy Statement available with Human Resources department for information on why and how personal data is collected and processed in relation to your role with Corient.

f. Suppliers

We collect and process personal data about our suppliers (including subcontractors and individuals associated with our suppliers and subcontractors) in order to manage the relationship, contract, to receive services from our suppliers and, where relevant, to provide professional services to our clients.  The personal data is generally business card data and will include name, employer name, phone, email and other business contact details and the communications with us.

 i. Use​ ​of​ ​personal​ data

Receiving services

We process personal data in relation to our suppliers and their staff as necessary to receive the services. 

Providing professional services to clients

Where a supplier is helping us to deliver professional services to our clients, we process personal data about the individuals involved in providing the services in order to administer and manage our relationship with the supplier and the relevant individuals and to provide such services to our clients

ii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  Personal data will be retained about our contacts at our suppliers for as long as it is necessary for the purposes set out above (e.g. for as long as we have, or need to keep a record of, a relationship with a contact, which is for the duration of our relationship with a contact or their organisation) and then deleted in line with our deletion and retention policies.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iii. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

g. Individuals who use our Applications

We provide registered users access to various applications managed by us. These applications include Document Scanning Apps, Invoice Processing Workflow, Document Management System, Payslip Portal, Time Sheet Processing Software, etc

i. Use​ ​of​ ​personal​ data

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data with us where it is strictly needed for those purposes.

• The categories of personal data stored on our application provided to our clients are generally:
• Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
• Contact details (e.g. email address, contact number, postal address);
• Financial details (e.g. salary and other income and investments, benefits, tax status); and
• Job details (e.g. role, grade, experience and performance information).

Security, quality and risk management activities

We have security measures in place to protect our and our clients’ information (including personal data). Some of the measures we taken to ensure our clients data is protected are mentioned below:

• The Network and Data Structure are ISO 27001 Certified
• All the data is stored within UK having following minimum standards:
  • SSAE 16 SOC 1 Type 2 and SOC 2 Type 2 Attestation
  • PCI Data Compliant
  • ISO 27001 Compliant
  • HIPAA and HITECH Compliant
  • Virtual Private Network through private IP address ranges
  • 256 bit AES Encryption
  • Deployment of Anti Malware
  • Multi Factor Authentication
  • Intrusion detection/Distributed Denial of Service (DDoS) Defense
  • Regular Penetration Testing
  • Network Isolation
  • Virtual Networking
• Automated Scans to identify harmful emails
• Firewalls and other applicable security standards to detect, investigate and eliminate data threats
• Policies and Procedures to monitor usage of data

Further, we have procedures in place to monitor the quality of our applications and manage risks in relation to our client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures.

ii. Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).  Personal data will be retained for as long as it is necessary for the purposes set out above (e.g. for as long as we have, or need to keep a record of, a relationship with a contact, which is for the duration of our relationship with a contact or their organisation) and then deleted in line with our deletion and retention policies.

Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

iii. When and how we share personal data and locations of processing

Further details about the processors (such as IT service providers) used by Corient and locations of processing are provided here.  We may use other organisations to help us deliver our services as agreed with our client on an engagement-specific basis.

h. Visitors to Our Website

Visitors to our websites are generally in control of the personal data shared with us.  We may capture limited personal data automatically via the use of cookies and analytics tools on our website.  Please see the section on Cookies below for more information.

We receive personal data, such as name, title, company address, email address, and telephone and fax numbers from website visitors; for example when an individual registers to receive updates from us.

Visitors are also able to send an email to us through the website. Their messages will contain the user’s screen name and email address, as well as any additional information the user may wish to include in the message.   

Use of personal data

When you provide personal data to us, we may use it for any of the purposes described in this privacy statement or as stated at the point of collection (or as obvious from the context of collection), including:

• where you submit your contact details, unless we are asked not to, we may contact you with information about Corient’s business, services and events, and other information which may be of interest to you. Should visitors subsequently choose to unsubscribe from mailing lists or any registrations, we will provide instructions on the appropriate webpage, in our communication to the individual, or the individual may contact us by email to info@billymytask.com/info@corientbs.com;
• to administer and manage our website, including to confirm and authenticate your identity and prevent unauthorised access to restricted areas of the site or premium content;
• to communicate with you in order to distribute requested materials or ask for further information;
• to personalise and enrich your browsing experience by displaying content that is more likely to be relevant and of interest to you;
• to sort and analyse user data (such as determining how many users from the same organisation have subscribed to or are using our websites);
• to determine the company, organisation, institution, or agency that you work for or with which you are otherwise associated;
• to develop our businesses and services, including aggregating data for website analytics and improvements;
• aggregating data to conduct benchmarking and data analysis including, for example, regarding usage of our websites;
• to conduct quality and risk management reviews;
• to understand how people use the features and functions of our websites in order to improve the user experience;
• to monitor and enforce compliance with our terms, including acceptable use policies; and
• any other purposes for which you provided the information to Corient (such as to subscribe you to the updates you request).

Our websites do not collect or compile personally identifying information for sale.

Cookies

We use small text files called ‘cookies’ which are placed on your hard drives to assist in personalising and enriching your browsing experience by displaying content that is more likely to be relevant and of interest to you.   The use of cookies is now standard operating procedure for most websites. However if you are uncomfortable with the use of cookies, most browsers now permit users to opt-out of receiving them. You need to accept cookies in order register on our website.  You may find other functionality in the website impaired if you disable cookies. After termination of the visit to our site, you can always delete the cookie from your system if you wish.

Types of cookie:

• ‘Session’ cookies remain in your browser during your browser session only, ie until you leave the website.
• ‘Persistent’ cookies remain in your browser after the session (unless deleted by you).
• ‘Performance’ cookies collect information about your use of the website, such as webpages visited and any error messages; they do not collect personally identifiable information, and the information collected is aggregated such that it is anonymous. Performance cookies are used to improve how a website works.
• ‘Functionality’ cookies allow the website to remember any choices you make about the website (such as changes to text size, customised pages) or enable services such as commenting on a blog.

The following table explains the way in which we use cookies on this website

Managing cookies on your device

We use cookies to personalize content and to provide you with an improved user experience. By using this website or application you consent to the deployment of cookies. You can control and manage cookies using your browser (see below). Please note that removing or blocking cookies can impact your user experience and some functionality may no longer be available.

Using your browser to control cookies

Most browsers allow you to view, manage, delete and block cookies for a website. Be aware that if you delete all cookies then any preferences you have set will be lost, including the ability to opt-out from cookies as this function itself requires placement of an opt out cookie on your device

Managing Analytics cookies

You can opt-out of having your anonymised browsing history within our websites or applications recorded by analytics cookies. We use the following service providers and you can learn more about their privacy policies and how to opt-out of their analytics cookies by clicking on following links:

Google Analytics: http://www.google.com/analytics/learn/privacy.html

Third party links

Our website may link to third party sites not controlled by Corient and which do not operate under Corient’s privacy practices. When you link to third party sites, Corient’s privacy practices no longer apply. We encourage you to review each third party site’s privacy policy before disclosing any personally identifiable information.

Data retention

Personal data collected via our websites will be retained by us for as long as it is necessary (e.g. for as long as we have a relationship with the relevant individual).

i. People Who Visit Our Office           

We have security measures in place at our serviced office which is managed and maintained by CUE Ltd  including CCTV and building access controls.

CCTV

There are signs in the communal areas within the premises showing that CCTV is in operation. The images captured are securely stored and only accessed on a need to know basis (e.g. to look into an incident).  CCTV images are used for the legitimate purposes of promoting security and safety of our personnel and members of the public, preventing and detecting crime and establishing, exercising and defending legal claims.  CCTV images may be disclosed to law enforcement bodies as requested and permitted by data protection law.

CCTV recordings are typically automatically overwritten after a short period of time (between 21 and 60 days after being recorded) unless an issue is identified that requires investigation (such as a theft).

Visitor records

We require visitors to our offices to sign in at reception and keep a record of visitors for a short period of time.  Our visitor records are securely stored and only accessible on a need to know basis (e.g. to look into an incident).

4. Data Security

We take the security of all the data we hold very seriously.  We adhere to internationally recognised security standards and our information security management system relating to client confidential data is independently certified as complying with the requirements of ISO/IEC 27001: 2013.  We have a framework of policies, procedures and training in place covering data protection, confidentiality and security and regularly review the appropriateness of the measures we have in place to keep the data we hold secure.

Security precautions in place to protect the loss, misuse or alteration of your information

• All the data is stored within UK having following minimum standards:
  • SSAE 16 SOC 1 Type 2 and SOC 2 Type 2 Attestation
  • PCI Data Compliant
  • ISO 27001 Compliant
  • HIPAA and HITECH Compliant
  • Virtual Private Network through private IP address ranges
  • 256 bit AES Encryption
  • Deployment of Anti Malware
  • Multi Factor Authentication
  • Intrusion detection/Distributed Denial of Service (DDoS) Defense
  • Regular Penetration Testing
  • Network Isolation
  • Virtual Networking
• Automated Scans to identify harmful emails
• Firewalls and other applicable security standards to detect, investigate and eliminate data threats
• Policies and Procedures to monitor usage of data

5. Third-party service providers working on our behalf

We may pass your information to our third-party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing products and / or services to you on our behalf, for example to process payroll, provide bookkeeping services or deliver other specialist services.  However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own purposes.

We have put in place measures, based upon model contract clauses supplied by the European commission to ensure your personal data is treated by those third parties in a way consistent with and which respects the data protection legislation. The servers powering and facilitating that cloud infrastructure are located in secure data centres in United Kingdom, and personal data may be stored in any one of them. Further details of these providers are mentioned below:

As part of the services offered to you, we may send your data outside of the European Economic Area (EEA).  Where this is the case, we will take reasonable steps to ensure that your data is protected in the same way as if it was being used in the EEA.  For example, where third party suppliers store data in the US, we will ensure that their services fall within the Privacy Shield. https://www.privacyshield.gov

We may use third parties located in other countries to help us run our business.  As a result, personal data may be processed outside the countries where we and our clients are located. This includes to countries outside the European Union and to countries that do not have laws that provide specific protection for personal data.  We have taken steps to ensure all personal data is provided with adequate protection and that all transfers of personal data outside the EU are done lawfully.

6. Data Inspection

We strive to be as open as we can be in terms of giving people access to their personal data. A Subject Access Request under the GDPR is your right to request a copy of the information that we hold about you.  Such requests must be in writing to the contact details provided in this policy. If we do hold your personal data we will respond in writing within one calendar month of your request (where that request was submitted in accordance with this policy).

• The information we supply will:
  • confirm that your data is being processed;
  • verify the lawfulness and the purpose of the processing;
  • confirm the categories of personal data being processed;
  • confirm the type of recipient to whom the personal data have been or will be disclosed, and
  • let you have a copy of the data in an intelligible form.
• Please note that you may need to provide identification in order to prove who you are to access your data.
• If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
• In the instance that we do not hold information about you we will also confirm this in writing at the earliest opportunity.

7. Changes to this privacy statement

We keep our privacy notice under regular review and you should check back regularly to ensure you are aware of changes to it. We may display this notice to you from time to time to help ensure you are aware of its contents.

8. Individuals’ rights and how to exercise them

Individuals have certain rights over their personal data and controllers are responsible for fulfilling these rights.

Individuals’ rights may include the right of access to personal data, to rectification of personal data, to erasure of personal data / right to be forgotten, to restrict processing of personal data, to object to processing of personal data, to data portability, the right to withdraw consent at any time (where processing is based on consent) and the right to lodge a complaint with a supervisory authority.

Please see further information about these rights, when they are available and how to exercise them below.

Your right of access to personal data

You have the right to obtain confirmation as to whether we process personal data about you, receive a copy of your personal data  held by us as a controller and obtain certain other information about how and why we process your personal data (similar to the information provided in this privacy statement).  This right may be exercised by emailing us at info@billymytask.com/info@corientbs.com. We aim to respond to any requests for information promptly, and in any event within the legally required time limits.

Your right to rectification / amendment of personal data

You have the right to request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete personal data completed.

To update personal data submitted to us, you may email us at info@billymytask.com/info@corientbs.com or, where appropriate, contact us via the relevant website registration page or directly amend the personal details held on relevant websites or applications with which you registered.

When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make updates as appropriate based on your updated information.

Your right to erasure / right to be forgotten

You have the right to obtain deletion of your personal data in the following cases:

• the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
• our legal grounds for processing is consent, you withdraw consent and we have no other lawful basis for the processing;
• our legal grounds for processing is that the processing is necessary for legitimate interests pursued by us or a third party, you object to our processing and we do not have overriding legitimate grounds;
• you object to our processing for direct marketing purposes;
• your personal data have been unlawfully processed; or
• your personal data must be erased to comply with a legal obligation to which we are subject.
• To request deletion of your personal data, please email us at info@billymytask.com/info@corientbs.com.

Your right to restrict processing

You have the right to restrict our processing of your personal data in the following cases:

• for a period enabling us to verify the accuracy of your personal data where you have contested the accuracy of the personal data;
• your personal data have been unlawfully processed and you request restriction of processing instead of deletion;
• your personal data are no longer necessary in relation to the purposes for which they were collected and processed but the personal data are required by you to establish, exercise or defend legal claims; or
• for a period enabling us to verify whether the legitimate grounds relied on by us override your interests where you have objected to processing based on it being necessary for the pursuit of a legitimate interest identified by us.

To restrict our processing of your personal data, please email us at info@billymytask.com/info@corientbs.com.

Your right to object to processing

Where we process personal data based on consent, individuals have a right to withdraw consent at any time.  We do not generally process personal data based on consent (as we can usually rely on another legal basis). Where we rely on your consent for our processing of your personal data, to withdraw your consent please email us at info@billymytask.com/info@corientbs.com or, to stop receiving an email from a Corient Marketing list, please click on the unsubscribe link in the relevant email.  Please see the relevant “Use of personal data” sections of this privacy statement for further details about our processing of personal data based on consent.

9. Complaints

Please send an email with the details of your complaint to info@billymytask.com/info@corientbs.com.  We will look into and respond to any complaints we receive.

You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred within the EU.  The Information Commissioner’s Office (“ICO”) is the UK data protection regulator/supervisory authority. For further information on your rights and how to complain to the ICO, please refer to the ICO website.