Privacy Policy

Introduction

At TreeStory, we care about your privacy.  That’s why we only collect personal data if we have a good reason to do so.  That’s also why we want to communicate transparently what we do with your personal data.

This Privacy Policy explains the types of information we may collect from you or that you may provide when using our Services.  This Privacy Policy also describes TreeStory’s practices for collecting, using, maintaining and processing information.

Data Controller

For the purposes of European Economic Area data protection law (the “Data Protection Law”), the data controller of the data processed through the Services we offer is the Customer.  In other words, our clients and employees retain control over the data that they give us.

For data retained through the website or data processed not through the Services (i.e. contact details of potential customers or CVs/resumes sent to us from potential employees), we are the data controller.

Who are we?

TreeStory is a forestry consultancy specialising in regenerative forestry services and landscape-scale nature restoration.

Our registered company name is TreeStory Limited, our registered company number is SC603696, and our registered address is: 38 Dean Park Mews, Edinburgh, EH4 1ED.  Our VAT number is 302746034.

EcoCarbon Limited is a wholly owned subsidiary of TreeStory Limited.  Its registered company number is SC691846.

For ease of reference, we will further refer to ourselves using “we”, “us”, “our” or “TreeStory”.  “You”, “your” or “yours” means the organization or individual using the Service.

You can reach us at admin@treestory.org.uk.

Which Personal Data Do We Collect and Why?

If you just visit our website, we do not collect personal data.  We will only collect personal data in the following instances:

• If you ask us a question using email or phone
• If you request information about or a quote for our Services
• If you sign up to use our Services
• If you subscribe to our newsletter
• If you apply for a job with us
• If you apply to be one of our approved contractors
• If you respond to a consultation on one of our projects

Below you can find what type of personal data we collect, what we use it for and how long we will keep it.

1. Your first and last name, your address and your company details (if applicable)

We cannot be sure to address you correctly if we don’t know who you are.  If you enter into a contract with us, we will need to make sure we know who we are dealing with.  We keep this information in our contact database for as long as you do not object to use keeping it.  You can always let us know if you no longer want us to keep this information at admin@treestory.org.uk.

Please note that for as long as we have an ongoing contract, we cannot remove this information from our databases as we will need it to execute the contract.  Even after our contract has ended, we may be under a legal obligation to hold on to some of this information for a bit longer.  For example, under accounting legislation we must keep copies of our invoices which may mention your name or address.

2. Phone number and email address

This is so that we can easily contact you.  In principle, we will never contact you unless it is:

• to answer a question you have asked us
• in reference to our contract with you
• you have applied for a job with us
• you have asked us to keep you informed about future products / services
• you have signed up to be one of our approved contractors
• to update you as a respondent in one of our consultations

We may also use your email address to send you our newsletter.  We do not want to spam you and we understand if you would rather not receive newsletters.  If that is the case, you can always let us know or you can unsubscribe from our mailing list using the link you can find at the bottom of each newsletter.

We may on occasion, use your contact details in WhatsApp groups related to our services for you.  We will only ever do this with your prior permission.

As in the case for your name and address, we will keep your email address and phone number in our contact database for as long as you do not object to us keeping it.  If you no longer want us to keep this information, you can always let us know at admin@treestory.org.uk.

Please note that for as long as we have an ongoing contract, we cannot remove this information from our databases as we will need it to execute the contract.  Even after our contract has ended, we may be under a legal obligation to hold on to some of this information for a bit longer. 

3. Information provided during job applications

If you apply for a job with us, you will provide us with your personal data in you cover letter and your CV (such as your grades, which schools you went to, previous jobs etc.).

We will save the cover letter and CV or every job applicant in our candidate database and may contact you in future regarding job openings that may be of interest to you.  Of course, we will delete all this information from our candidate database if you don’t want us to hold onto it.  Just let us know at admin@treestory.org.uk.

4. Payment information

If you sign up for any of our services, we will collect payment information from you in order to raise invoices.  This information will be stored securely in our Xero invoicing software.  We will keep this information for as long as we have a contract in place.  As noted above, we may be under a legal obligation to hold onto this information for a bit longer.  For example, under accounting legislation we must keep copies of our invoices which may mention your bank details.

5. Data collected for anti-money laundering compliance

We risk assess all our clients and transactions for potential money laundering.  If you are identified as a higher risk client or transaction, you will be asked to provide additional information including date of birth and photographic identification (such as a passport or drivers licence).  This data will be securely stored on Amiqus (our secure data processor).

We are required to retain records of checks undertaken for anti-money laundering purposes for at least 5 years.  After this period, you may contact us on admin@treestory.org.uk to remove the information we have stored.

How Do We Collect Your Data?

1. From You

We collect personal information from you directly, particularly through our client onboarding procedures.  We may also collect personal information from you indirectly, including though the use of our website.

2. Communications & Interactions with TreeStory

In the course of our work with you, we may collect other information and historic personal information.  For example:

• Previous names
• Previous addresses
• Previous bank details
• Names and addresses of subcontractors

3. Third Parties

We do not source data on you from third parties.

4. Cookies

Our website only uses essential cookies to help with functionality.  We do not use tracking cookies.  We do not collect any personal information from you if you just visit our website.

How Do We Protect Your Personal Data?

We take measures to ensure that your personal data is kept private!

We work hard to protect your personal data against unauthorized access or disclosure.  To do so, we take organizational measures to ensure that access to your data is restricted to those employees or agents who need to have access to it to help us process it.  External agents will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

Do We Share Your Data With Others?

We use the services of the following external data processors:

We may also share your information with relevant parties at your request as part of our services and our contract with you.

If we are under a legal obligation to share data with authorities or if we have to share data to comply with an enforceable government request, we will share the data the authorities ask for, which may include yours.

Can We Change This Privacy Policy?

We may change this Privacy Policy from time to time.  We will post the updated Privacy Policy on our website and, if the changes are significant, we will provide a more prominent notice such as an email notification to all current customers.

Your Rights

You may request us to send you a summary of the personal data processed about you.  If you feel that your personal data has been processed incorrectly or incompletely, or is you feel that such processing was unnecessary, they you can also ask us to edit, supplement or erase your personal data from our databases.  Under the applicable privacy legislation, you also have the right to the following:

• Right to be forgotten – in certain circumstances, you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organization.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you have the right to object to being subject to the legal effects of automated processing or profiling.
• Right to judicial review – in the event that we refuse your request under rights of access, we will provide you with a reason as to why.  You have the right to complain.

If you feel we have failed to respond correctly to a request for information, you have the right to lodge a complain about us to the UK Information Commissioner’s Office (https://ico.org.uk/) or with the relevant authority in your country of work or residence.

If you have any further privacy concerns or if you want to exercise your rights, you can contact us at admin@treestory.org.uk.