Privacy policy

This policy explains what personal information Halocollects, why we collect it, how long we keep it and what rights you have over it. We’ve tried to write it in plain English rather than legal boilerplate.

Halo is based in Jersey, and we handle personal data under the Data Protection (Jersey) Law 2018. For that Law we are the data controller, meaning we decide what information is collected and what happens to it.

Who we are

You can reach us about anything in this policy at:

• Controller: [Full registered entity name, e.g. Halo Limited] (registered in Jersey, no. [Jersey company registration number, if incorporated])
• Address: [Registered/trading address, Jersey]
• Email: info@halo.je
• Phone: 07797 789894
• Registered with the Jersey Office of the Information Commissioner: 103936

We are a small business and have not appointed a Data Protection Officer, as we are not required to. Enquiries about your data come straight to us at the address above.

What we collect, and why

We collect very little, and only what we need in order to answer you and do the work.

When you contact us

If you fill in an enquiry form, email us or call us, we collect the details you choose to give, typically your name, email address, phone number, the location or type of property, and whatever you tell us about what you’re looking for.

We use this to reply, to arrange a visit or demonstration, to prepare a quote and, if you go ahead, to design, install and support your system.

Our lawful basis is Schedule 2, Part 1, paragraph 2 of the Jersey Law: processing necessary to take steps at your request with a view to entering into a contract, and then to perform that contract. Where we later need to keep records for tax or accounting, we rely on Schedule 2, Part 2, paragraph 7 (other legal obligations).

When you visit this website

Our hosting provider records standard technical information in server logs, such as your IP address, browser type and the pages requested. This is necessary to serve the site securely and to detect abuse, and we rely on legitimate interests(Schedule 2, Part 1, paragraph 5) for it: our interest in keeping the site running and secure, which we don’t consider prejudicial to your rights.

We would also like to use Google Analytics to understand how people find and move around the site. We only do this if you have agreed. Our lawful basis is your consent (Schedule 2, Part 1, paragraph 1), and no analytics cookies or scripts load at all until you accept them. You can change your mind at any time, as easily as you gave it, on our cookie policy page.

Full detail of every cookie is in the cookie policy.

What we don’t do

• We do not sell, rent or trade your personal data. Ever.
• We do not collect special category data (health, ethnicity, beliefs, biometrics and similar) through this website.
• We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
• This site is not aimed at children and we do not knowingly collect their data. In Jersey, a child can consent to online services from age 13.

Marketing

We will always reply to an enquiry you send us. That’s not marketing, it’s the answer you asked for.

We will only send you unrelated marketingif you have separately and actively opted in. Jersey has no “soft opt-in” rule, so we don’t assume consent from the fact you contacted us.

You have an absolute right to object to direct marketingat any time (Article 36). There’s no balancing exercise and no exceptions: tell us and we stop immediately. Email info@halo.je or use the unsubscribe link on anything we send.

Who we share it with

We share personal data only with suppliers who help us run the business, and only as far as they need it. They act on our instructions and cannot use your data for their own purposes.

We may also disclose information where we are legally required to, for example to a regulator, or to establish or defend a legal claim.

Sending data outside Jersey

Some of our suppliers are based in, or can be accessed from, the United States. Under Article 66 of the Jersey Law we may only transfer personal data to a third country where an adequate level of protection is ensured.

For transfers to Google we rely on the EU–US Data Privacy Framework, which the European Commission has found to provide adequate protection and which Jersey recognises through Article 66(2)(a). Google is certified under it. In addition, we have Standard Contractual Clauses in place with Google as a second safeguard under Article 67, so protection remains in place even if the Framework were to be set aside.

Our email delivery provider, Resend, is based in the United States. For that transfer we rely on the Standard Contractual Clauses incorporated in their data processing agreement, as a safeguard under Article 67.

Where a supplier offers it, we choose European data storage to keep transfers to a minimum.

How long we keep it

If you ask us to delete your data sooner, we will, unless we’re legally required to keep it, in which case we’ll tell you what and why.

Keeping it secure

We use encrypted connections (HTTPS) across the site, access controls on the systems holding your data, and reputable providers who maintain recognised security standards. Only people who need your information in order to do the work can see it.

If a breach happens that is likely to put your rights at risk, we will report it to the Jersey Office of the Information Commissioner within 72 hours where feasible, and tell you directly and in plain language if the risk to you is high.

Your rights

Under Part 6 of the Data Protection (Jersey) Law 2018 you have the right to:

• Be informedabout how we use your data. That’s what this policy is for
• Access a copy of the personal data we hold about you
• Rectify anything inaccurate or incomplete
• Eraseyour data where there’s no good reason for us to keep it
• Restrict how we process it while a question is resolved
• Portability: receive your data in a common, machine-readable format, or have it sent to someone else
• Object to processing based on our legitimate interests. For direct marketing, an absolute right to object
• Not be subject to solely automated decisions with legal or similarly significant effects
• Withdraw consentat any time, as easily as you gave it, where we rely on it. This doesn’t affect anything done beforehand

Making a request

Email info@halo.jeor write to us at the address above. We may ask for proof of identity so we don’t hand your data to the wrong person.

We will respond without undue delay and within 4 weeks. If a request is genuinely complex we can extend by up to 8 further weeks, but we’ll tell you, and why, within the original 4 weeks. There is no charge.

Complaints

If you’re unhappy with how we’ve handled your data, please tell us first at info@halo.je. We’d genuinely rather put it right.

You also have the right to complain to the Jersey regulator at any time, and to seek a remedy through the courts:

• Jersey Office of the Information Commissioner
• 2nd Floor, 5 Castle Street, St Helier, Jersey JE2 3BT
• +44 (0)1534 716530
• enquiries@jerseyoic.org
• jerseyoic.org

Changes to this policy

If we change how we use personal data we’ll update this page and the date at the top. Where a change is significant we’ll do more than that, and if it affects something you consented to, we’ll ask you again rather than assume.