Applicable Logo

Applicable is committed to information security and to demonstrate this have achieved certification in or are registered to the following standards:

Applicable achieved initial registration to this standard in 2014 in recognition of the commitment to our global standards concerning security best practice. We have undergone many continual assessments on our activities around the world and two recertifications, the latest being in March 2020. We ensure our scope covers everything we do and everywhere we do it. ISO/IEC 27001:2013 is an internationally recognized best practice framework for an information security management system which is essential for our own practices, our partners, and our customers. Our latest certificate can be found here.

ISO/IEC 27001:2013 – Certificate of Registration (PDF)

Cyber Essentials Plus – Certificate of Assurance (PDF)

Following the EU Central Court of Justice ruling of 16th July 2020 which invalidated the Privacy Shield program as an adequate transfer mechanism for moving personal data from the EU to the US Applicable have implemented the same mechanism of utilisation of Standard Contractual Clauses which it operates for its other operational locations.

Applicable is a member of CiSP which is a joint industry and government initiative set up to exchange cyber threat information in real time, in a secure, confidential and dynamic environment, increasing situational awareness and reducing the impact on UK business.

General Data Protection Regulation (GDPR)

The EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) effective 25 May 2018 (this includes the UK regardless of the referendum decision to leave the EU). The GDPR impacts every organisation which controls or processes personally identifiable information (Pii). It introduces new responsibilities, including the need to demonstrate compliance, more stringent enforcement and substantially increased penalties than the Data Protection Act 1998 (DPA) which the GDPR superseded.

Applicable has always been and remain committed to the highest standards of information security and privacy taking matters of security and privacy seriously. We place a priority on protecting and managing all Pii in accordance with data protection legislation in all the geographies in which we operate and also that required by our contractual obligations with Customers and Data Controllers. We have integrated the GDPR requirements and necessary approaches in to Applicable’s existing information security framework as policy. The existing security controls adopted at Applicable are further expanded based upon ISO/IEC 27701:2-19 Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines. This approach ensures that specific privacy risk assessments and management controls are included in the overall technical and organisation measures and controls to deliver privacy by design and default, and to satisfy providing a rigorous approach to GDPR. Contractual arrangements with customers, contractors and suppliers reflect privacy legislation. Privacy policies and notices are published on the Applicable website with comprehensive supporting policies, procedures, and processes in place to ensure Applicable comply with the GDPR.

The Data Protection Office (DPO) contact for Applicable Ltd. is Iain McIvor, Head of Information Security and Privacy. A dedicated email address for contact for data protection matters has been set up dpo@applicable.com.

ICO Certificate of Registration

Applicable strives to process and disclose personal information in a manner consistent with the laws of the countries in which we do business. This Privacy Policy, replaces the old policy in relation to Safe Harbor and EU-US Privacy Shield and is effective from 16th July 2020, sets forth the privacy principles that Applicable follows with respect to transfers of personal information between the European Economic Area or EEA, Australia and the United States. In accordance with our commitment to protect personal privacy, Applicable adheres to the principles of the GDPR and Standard Contractual Clauses.

Definitions

“Personal Information” or “Information” means information that is (1) accessed, processed or transferred outside the EU as part of the delivery and support of Applicable’s services (this relates to the Applicable office and home based staff in the United States of America and Australia and datacentre locations in the UK, USA, Singapore and Australia); (2) is recorded in any form; (3) is about, or pertains to a specific individual; and (4) can be linked to that individual.

EU-US Privacy

Applicable were a party and participant in the U.S. Department of Commerce’s EU-U.S. Privacy Shield until the EU Central Court ruling of the 16th July 2020. following this reliance is upon the use of standard / model clauses.

Personal Data Collected

Applicable has installed policies and procedures to ensure that it adheres to the European Union General Data Protection Regulation as part of its broader information security management system. This includes provision to involve an independent third party to resolve privacy disputes when necessary.

Disclosure to Law Enforcement

Applicable may only disclose Personal Data when required to do so where required by law, or at our sole discretion, where we deem it necessary to protect the safety of any individual, the general public, or to prevent violation of the rights of Applicable or any third party.

Applicable

Applicable is a United Kingdom registered company, with other group affiliate entities in Australia, Singapore and the United States of America. Applicable was acquired by Arkadin in August 2016. Applicable in delivering its services may access / process data and information in any or all of these locations. Applicable applies consistently its Privacy and Information Security Policies in all locations, including this Privacy Policy. More information about Applicable can be accessed at www.applicable.com

Change of Ownership

In the event of change in ownership, or a direct merger or acquisition with another entity, we reserve the right to transfer all of Applicable information, including Personal Data, to a separate entity. Applicable would use commercially reasonable efforts to notify of any change of ownership; merger or acquisition by a third party. Modifications required would be addressed at that time.

Principles

Notice

When supplied with information by its clients or gathering information internally agree and conform the purpose for which that personal information was collected; how it may be accessed or processed; and agree the Applicable locations where this may be stored or accessed from.

  • Applicable does not use cookies as a means to collect personally identifiable information;
  • Applicable are not supplied or do not intentionally collect information from under 13s.
  • Applicable does not take or process online payments
  • Applicable does not sell or rent any personally identifiable information to third parties.
  • Applicable retains information only in line with data protection and legal retention guidelines and defined within the Applicable Retention Policy.

Choice

Applicable offer and honour all the data subject right principles under the GDPR.

Data Security

Applicable shall take reasonable steps to protect the Information from loss, misuse and unauthorized access, disclosure, alteration and destruction. Applicable has put in place appropriate physical, electronic and managerial procedures to safeguard and secure the Information from loss, misuse, unauthorized access or disclosure, alteration or destruction verified under its ISO27001:2013 registration. Applicable cannot guarantee the security of Information on or transmitted via the unsecured Internet.

Data Integrity

Applicable shall only process Personal Information in a way that is compatible with and relevant for the purpose for which it was collected or authorized. To the extent necessary for those purposes, Applicable shall take reasonable steps to ensure that Personal Information is accurate, complete, current and reliable for its intended use.

Access

In line with data subject rights under the GDPR and upon request, Applicable will grant individuals reasonable access to personal information that it holds about them. In addition, Applicable will take reasonable steps to correct, amend, or delete information that is demonstrated to be inaccurate or incomplete.

Elsewhere on the Applicable Website Privacy Notices are published.

Enforcement

Applicable uses a self-assessment approach to maintain compliance with this privacy policy and periodically verifies that the policy is accurate, comprehensive for the information intended to be covered, prominently displayed, completely implemented and accessible and in conformity with these Principles. We encourage interested persons to raise any concerns using the contact information provided and we will investigate and attempt to resolve any complaints and disputes regarding use and disclosure of Personal Information in accordance with the Principles.

Dispute Resolution

Any questions or concerns regarding the use or disclosure of personal information should be directed to Applicable at the address given below. Applicable will investigate and attempt to resolve complaints and disputes regarding use and disclosure or personal information in accordance with the principles contained in this Policy.

Any data subject has the right to raise their concerns to about our use of your information, we would prefer you to raise it with us in the first instance to give us the opportunity to put it right, in the UK you as escalation you can contact the Information Commissioner’s Office via their website at www.ico.org.uk/concerns or write to them at:

Information Commissioner’s Office
Water Lane
Wilmslow
Cheshire
SK9 5AF

Amendments

This privacy policy may be amended from time to time. We will post any revised policy on this website.

Information Subject to Other Policies

The Company is committed to following the Principles for all Personal Information within the scope of the Privacy Shield Agreement. However, certain Information is subject to policies of the Company that may differ in some respects from the general policies set forth in this privacy policy.

Contact Information

Questions, comments, or complaints regarding the Company’s Privacy Shield Policy or data collection and processing practices can be mailed or emailed to:

Applicable Ltd
3130 Great Western Court
Stoke Gifford
Bristol
BS34 8HP
United Kingdom
dpo@applicable.com

Together we do great things