Privacy Policy
Effective: November 5, 2024
Thank you for your interest in this Privacy Policy, and welcome to www.fullyramped.io (our "website"). At Fully Ramped, we want you to feel comfortable on our website and not have to worry about the security of your data. In this Privacy Policy, you will find all the information about which Personal Data we collect and process and for what purpose. Equally, we will also inform you of your data protection rights and how you can assert them.
General Principles
What is Personal Data?
Personal Data is "any information relating to an identified or identifiable natural person. This includes, for example, name or address data, telephone number, mobile number, or online identifiers such as your device ID and your IP address.
What is Special Category Data?
Special category data is Personal Data that needs more protection because it is sensitive. This includes Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, and biometric data. As well as data concerning health, a person's sex life; and a person's sexual orientation. In order to lawfully process Special Category Data, it is necessary to consent to the processing.
What is processing?
"Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means. The term is broad and covers virtually any handling of data.
Who is the data controller?
A "data controller" is a person or organisation who alone or jointly determines the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. In this sense, Fully Ramped Consulting Ltd, 2913 Pilatus Run, Victoria, British Columbia, Canada, V9B 0R4 ("Fully Ramped", "we", "us", "our") is the data controller. If you have any questions about this policy, or about data protection at Fully Ramped in general, please email us using info@fullyramped.io with "Data Protection" in the subject line.
What law applies?
Our use of your Personal Data is subject to Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), the UK's Data Protection Act ("DPA"), the EU's General Data Protection Regulation ("GDPR"), and of course we process your Personal Data accordingly.
What are the Legal Bases for processing Personal Data?
We have to have at least one of the following legal bases to process your Personal Data: a) you have given your consent; b) the data is necessary for the fulfilment of a contract / pre-contractual measures; c) the data is necessary for the fulfilment of a legal obligation; or d) the data is necessary to protect our legitimate interests, provided that your interests are not overridden.
Who is the competent data protection authority?
You also have the right to complain about our processing of Personal Information to a supervisory authority responsible for data protection. The competent data protection authority in Canada is: The Office of the Privacy Commissioner of Canada, 30 Victoria Street, K1A 1H3, Gatineau, Quebec, Canada (www.priv.gc.ca)
How long will you keep my data?
We process and store your Personal Data only for the period of time required to achieve the respective processing purpose or for as long as a legal retention period exists (in particular commercial and tax law in accordance with Canada's Commercial and Fiscal Rules and Regulations for up to 8 years. Once the purpose has been achieved or the retention period has expired, the corresponding data is routinely deleted.
What Personal Data Do We Process?
Technical Data
When you access our website, some access data is recorded automatically and stored in a log file on our website's server. This means if you browse and simply have a look at our website, we process:
- the IP address of your computer
- the date and time of your access
- the name and URL of the accessed file
- the browser used
- the amount of bytes transferred
- the status of the page request
- the session ID
- the referrer URL
The legal basis for processing is our legitimate interest.
Hosting of our website
We use the hosting services of Squarespace for the purpose of hosting and displaying our website. Squarespace does so on the basis of processing on our behalf, and that also means that all data collected on our website is processed on Squarespace's servers. The basis for processing is our legitimate interest and the initiation and/or fulfilment of a contract.
Fonts
We use Google Fonts by Google on our website to display external fonts. To enable the display of certain fonts, a connection to a Google server is established when our website is accessed. The connection to Google is established when you visit our website, which enables Google to determine which website sent the request to display fonts and to which IP address the display of the font is to be transmitted. This represents a legitimate interest.
Cookies
We use so-called cookies on our website. Cookies are pieces of information that are transmitted from our web server or third-party web servers to your web browser and stored there for later retrieval. The legal basis for the use of cookies depends on the specific cookie used, our legitimate interest, and/or your consent.
Cookie consent
In accordance with Canada's Anti-Spam Law ("CASL"), the UK's Privacy and Electronic Communications Regulations ("PECR"), the EU's Privacy and Electronic Communications Directive ("PECD"), we need to obtain consent for the use of technically non-essential cookies. When you enter our website for the first time, the following data is transferred to us via our cookie consent tool:
- Your consent(s) or revocation of your consent(s)
- Your IP address
- Information about your browser
- Information about your device
- Time of your visit to our website
The basis for processing is our legal obligation.
Lead data via RB2B (U.S. based visitors only)
We use RB2B a service of GetEmails, LLC d/b/a R! B2B to decipher anonymous U.S. based visitors on our website to associate these activities with other personal information they or others have about said U.S. based visitors, including by association their email, telephone number, or home address. We use RB2B to send communications to these individuals directly. Affected visitors may exercise their right to opt-out by sending an email to info@fullyramped.io with "opt-out RB2B" in the subject line.
Personal Data that you give us
You can contact us in various ways, and data is always collected in the process. This is information about you that you give to us by filling in forms on our website (or other forms that we ask you to complete), or when you use our services, or corresponding with us by telephone, post, email, or otherwise. It may include, for example, your name, address, email address, and telephone number; information about your business relationship with us; and information about your requirements, background, and interests. The legal basis for processing is consent and the fulfilment of a contract.
Candidates
We may process the following data for candidates:
- Name, Address, Email and other contact details
- Date of birth
- Job history (including information relating to placements through us)
- Educational history, qualifications & skills
- Visa and other right to work or identity information
- Passport, Bank details
- National insurance and tax (payroll) information
- Next of kin and family details
- Contact details of referees
- Personal Data relating to hobbies, interests and pastimes
- Information contained in references and pre-employment checks from third parties
- Your marketing preferences
Clients
- Names
- Job titles
- Telephone numbers
- Email addresses
- Identification number
Other Uses of Your Personal Data
We may also collect, store, and use your Personal Data for the following purposes:
- to operate, manage, develop, and promote our business and, in particular, our relationship with you and related transactions
- to protect our business from fraud, money laundering, breach of confidence, theft of proprietary materials, and other financial or business crimes
- to comply with our legal and regulatory obligations, bring and defend legal claims and assert legal rights
- if the purpose is directly connected with an assigned purpose previously made known to you
Data Sharing
Internal
If necessary, we transfer your Personal Data within Fully Ramped. Of course, we comply with the associated legal framework and ensure that your data is processed properly. Access to your Personal Data is only granted to authorised employees who need access to the data due to their job.
External bodies
Personal Data is transferred to our service providers in the following instances:
- in the context of fulfilling our contract with you
- to use marketing services and to advertise our services online
- to communicate with you
- to provide our website
- to state authorities and institutions as far as this is required or necessary
International transfers
We may transfer your Personal Data to other companies as necessary for the purposes described in this Privacy Policy. In order to provide adequate protection for your Personal Data when it is transferred, we have contractual arrangements regarding such transfers. We take all reasonable technical and organisational measures to protect the Personal Data we transfer.
Security of Your Data
We will use physical, organizational, and technological measures to safeguard Personal Data to only those employees or third parties who need to know this information for the purposes set out in this Privacy Policy. Employees and third parties are required to sign a confidentiality agreement binding them to maintaining the confidentiality of all Personal Data to which they have access.
Personal information contained in computers and electronic databases are password protected in accordance with Information Security Standards. Access to any computers also is password protected. Our Internet router or server has firewall protection sufficient to protect personal and confidential business information against virus attacks and "sniffer" software arising from Internet activity.
Your Rights and Privileges
Privacy rights under PIPEDA
- Right to be informed
- Right to access
- Right to rectification
- Right to erasure
- Right to object/opt-out
- Right to Consent
- Right to Redressal
Rights under DPA and GDPR
- The right to access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to object to processing
- The right to data portability
- The right to complain to a supervisory authority
Access Request
In the event you want to make a Data Subject Access Request, please contact us. We will respond to requests regarding access and correction as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days, we will tell you why and when we will be able to respond to your request.
USA Specific Provisions
The following applies to users located in the United States. While we understand and appreciate that privacy and consumer data protection laws differ as they are subject to each state's legislature and that no data protection framework similar to the PIPEDA, DPA or GDPR exists on a federal level, we are committed to follow and apply the for your state relevant privacy rules and regulations.
"Shine the Light" (California)
"Shine the Light" law (Civil Code Section 1798.83) requires us to respond to requests from California asking about the business's practices related to disclosing Personal Data to third parties for the third parties' direct marketing purposes. You may make a request about our collection and disclosure of your Personal Data using the contact details provided.
COPPA (Children Online Privacy Protection Act)
When it comes to the collection of Personal Data from children under the age of 13 years old, the Children's Online Privacy Protection Act (COPPA) puts parents in control. We do not specifically market to children under the age of 13 years old.
CAN SPAM Act
The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations. If at any time you would like to unsubscribe from receiving future emails, you can email us, and we will promptly remove you from ALL correspondence.
Telephone Consumer Protection Act (TCPA)
If we process your Personal Data for the purpose of sending you SMS marketing communications, you may manage your receipt of marketing and non-transactional communications from us by replying or texting 'STOP' if you receive our SMS communications.
Do-Not-Track Features
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, our website does not currently respond to DNT browser signals.
What we do not do
- We do not request Personal Data from minors and children
- We do not use automated decision-making, including profiling
- We do not sell your Personal Data
Help and Complaints
If you have any questions about this policy or the information we hold about you, please email us using info@fullyramped.io with "Data Protection" in the subject line.
An individual can challenge compliance with this policy by providing written details of the challenge to us using info@fullyramped.io with "challenge compliance" in the subject line.
Changes
The first version of this policy was issued on Tuesday, November 5th, 2024, and is the current version. Any prior versions are invalid, and if we make changes to this policy, we will revise the effective date.