Vision PLC (“Vision”, “we”, “us”, “our”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, share, store and protect personal data in accordance with the UK GDPR, the Data Protection Act 2018 and applicable data privacy laws.

Vision PLC is a provider of Managed Print Services, Business Process Automation and Unified Communications (UCaaS).

Registered office: Caxton House, Watermark Way, Foxholes Business Park, Hertford, SG13 7TZ

Email: enquiries@visionplc.co.uk

Web: www.visionplc.co.uk

Vision PLC is the data controller for the purposes of the UK GDPR. If you have questions about this policy or your personal data, please contact our Compliance department at privacy@visionplc.co.uk.

This policy will be reviewed annually or when significant changes occur in legislation or company operations.

2.1 Data You Provide Directly

• Name, email address, phone number, job title and business details

• Enquiry information submitted through forms, emails or calls

• Contractual and billing details

• Recruitment information, including CVs and work history

2.2 Data We Collect Automatically

When you visit our website or use our digital platforms, we may collect:

• IP address, device information and browser type

• Usage data, including pages visited, interactions and session data

• Cookie data

2.3 Data We Obtain From Third Parties

• Business databases and publicly available directories

• Recruitment platforms

• Social media, only when you interact with Vision content

2.4 Employees and Contractors

We may collect additional personal data required for employment, payroll, health and safety, and compliance. Supplementary privacy notices may apply.

2.5 Special Category and Criminal Data

Where required, we process special category and criminal data under Articles 6 and 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018. We may collect data about current and prospective employees and contractors who are, or will be, employed in services for sensitive customers such as schools and hospitals. When processing this data, we maintain an Appropriate Policy Document documenting our procedures for compliance and our policies on retention and erasure.

We use personal data:

• To provide and maintain our products and services

• To manage customer relationships and contracts

• To process transactions and account information

• To offer complimentary services relevant to services currently supplied by Vision, with consent where required

• To improve our website, products and services

• To send marketing communications, with consent where required

• To fulfil our legal and regulatory obligations

• To recruit and onboard new employees and contractors

We will never sell your personal data to third parties.

• Contract – processing necessary to enter into or perform a contract.

• Consent – when you actively opt in to receive marketing or provide optional data.

• Legitimate Interests – for business growth, analytics and improving services, always balanced against your rights. Where we rely on legitimate interests, you have the right to object at any time.

• Legal Obligation – compliance with law, tax rules and employment obligations.

Your data is stored electronically on our software and systems. We ensure that data is encrypted at rest and in transit. Data is stored in the UK or EEA; however, it may be stored overseas in regions that may not have an adequacy decision with the UK. In those circumstances, we implement appropriate safeguards, as described in section 8, to protect your personal data and your rights.

We use cookies to ensure our website functions properly and to understand how visitors use it.

Types of cookies we may use include:

• Strictly necessary cookies – required for basic website operations.

• Non-essential, analytics and performance cookies – used to measure usage and improve content.

Non-essential cookies are only used where you have given consent in accordance with the Privacy and Electronic Communications Regulations. You can manage your cookie preferences at any time using our cookie banner or your browser settings. Please see our Cookie Policy for more information.

7.1 Service Providers and Processors

We may share personal data with cloud hosting and IT infrastructure providers, payment processors, CRM and marketing tools, professional advisers, recruitment partners and supply-chain partners. All service providers are contractually required to protect your personal data.

7.2 Legal and Compliance

We may disclose personal data where required by law, court order or regulatory request, or where necessary to protect the rights and safety of Vision or others.

Vision’s services are not directed at children under the age of 18. We will not knowingly collect or process personal data relating to minors.

If we transfer personal data outside the UK or EEA, we ensure appropriate safeguards such as UK International Data Transfer Agreements, the UK International Data Transfer Addendum, the UK Addendum to EU Standard Contractual Clauses, or adequacy decisions.

We apply appropriate technical and organisational measures and maintain certification in Cyber Essentials, Cyber Essentials Plus and ISO 27001:2022, together with the NHS Data Security and Protection Toolkit.

• Encryption in transit and at rest

• Access controls and authentication

• Staff training on cyber awareness and data protection

• Regular audits and monitoring

• Secure cloud platforms

• Secure encrypted backups

• Incident and breach response procedures

We retain personal data only for as long as necessary for the purposes described, including:

• Customer records: typically seven years after the contract ends

• Marketing data: two years from the last interaction

• Employee data: in accordance with statutory retention periods, but no more than six years after employment ends

• Website analytics: typically two years, or less if configured

When data is no longer required in line with limitation periods and business record-keeping requirements, it is securely deleted or anonymised.

You have the following rights under the UK GDPR:

• Access – to request copies of your data

• Be informed – to understand how and why your data is used

• Rectification – to correct inaccurate data

• Erasure – to request deletion

• Restriction – to limit how we process your data

• Portability – to transfer your data to another provider

• Object – to processing based on legitimate interests or direct marketing

• Withdraw consent – where consent was previously given

• Automated decision-making – not to be subject to decisions based solely on automated processing

To exercise your rights, email sar@visionplc.co.uk. We will respond to valid requests without undue delay and within one calendar month of receipt.

You may raise a complaint by emailing dpcomplaints@visionplc.co.uk, writing to the registered office shown above, or contacting us by telephone or in person.

If you are not satisfied with our response, you have the right to contact the Information Commissioner’s Office online at ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113.

We may update this policy from time to time. The latest version will always be available on our website with the effective date shown above.

For questions or rights requests, email privacy@visionplc.co.uk or sar@visionplc.co.uk.