This Privacy Protection Policy outlines the principles and guidelines that Creatio Limited; Creatio Consulting Limited ("Creatio") are committed to complying to, in handling personal data in compliance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).
The policy applies to all employees, contractors, partners, and third parties who process personal data on behalf of Creatio Limited; Creatio Consulting Limited ("Creatio")
Looking after the personal information you share with us is very important to us, and we want you to be:
If we make changes to this policy, we will publish the latest version on our company website and our client facing helpdesk service (called Transform) and in the footer of each version of the creatiogreen solution we provide to clients.
Creatio offers a software solution – primarily to various education companies - which we call creatiogreen (each client calls their version of the software solution by a specific/different name) – we are considered the data "processors" and the client is the data 'controllers'.
The creatiogreen software solution is delivered under a contractual agreement with each client and the client is responsible and leads on the configuration of the software to meet their business operations and needs and therefore decides the data they collect and which we then hold on their behalf. The data collected by each client is done so in accordance with their data needs and they process it in accordance with their own specific data processing policies and arrangements.
Therefore, if you have any queries about the data collected on a version of the creatiogreen software then please contact the client direct or contact Creatio (contact details are at the end of this policy) and we will provide you with their contact details where relevant. We are not responsible for their data usage, privacy, or security practices, which may be different to the arrangements outlined in this policy.
The law states organisations must have one or more of these reasons for collecting personal data and these are:
The following tables provides an indication of the typical data sets we hold for clients, staff and contractors and which are likely to contain personal data.
| Main data sets we collect | Our reason for collecting this information (legal basis) | Client's possible use of the data – note this is a high-level summary of typical reasons we see/are aware of and you should contact each client for specific details on the way they may use the data they collect via the creatiogreen software |
|---|---|---|
| User details entered as part of setting up or maintaining a User Account. As a minimum this contains first name, last name, and email address per User. Some clients may configure their version of the creatiogreen software to hold photos, CVs, certificate details and other personal details per User type such as home address. |
Fulfilling a contract requirement with our clients and a legitimate interest in delivering the creatiogreen software in accordance with the client's configuration requirements and needs. Creatio does not use the data collected by our clients other than as part of the service we provide under the contract agreement with each client. |
As with most software solutions a User must be registered before they can use and access the system. Each client can configure the fields and therefore the data they collect per User type and for assigning the relevant access rights in accordance with their business arrangements. Also, each client can add a clear 'consent' related statement/field which Users should accept and agree to upon creating a User account – again the inclusion or not of this field and it's wording is the decided by each client. |
| Customer/organisation details – including contacts, staff, and other business premises (e.g., sites). Some clients may configure their version of the creatiogreen software to hold photos, CVs, certificate details and other personal details per record type. |
Fulfilling a contract requirement with our clients and a legitimate interest in delivering the creatiogreen software in accordance with the client's configuration requirements and needs. Creatio does not use the data collected by our clients other than as part of the service we provide under the contract agreement with each client. |
The creatiogreen software can be configured to capture details for our clients in relation to their customers and their associated organisations and companies – including their key contacts, staff details and other venues. All these record types have the potential to contain personal details. Each client can configure the fields and therefore data they collect per record type and adding a clear 'consent' statement/field which Users should accept and agree to upon creating a User account – again the inclusion or not of this field and it's wording is the decided by each client. You would need to contact the relevant client to obtain the reason they collect the information they do and what they may do with the data once collected and how it's used with third party systems, they have asked us to interface/exchange data with under their agreement with us. |
| Learner details – including name, age, gender and possibly home and contact details and national learner number identifier details. Also details of the qualifications they have achieved/been registered against and details of the grades/outcomes of their education activities. | Fulfilling a contract requirement with our clients and a legitimate interest in delivering the creatiogreen software in accordance with the client's configuration requirements and needs. | The creatiogreen software supports various education bodies and depending on the modules they use within the software it can capture details of learners registered with our clients in relation to the qualifications and products they offer. Each client can configure the fields associated to learners and adding a clear 'consent' statement/field in relation to the learner records – again the inclusion or not of this field and it's wording is the decided by each client. You would need to contact the relevant client to obtain the reason they collect the information they do and what they may do with the data once collected and how it's used with third party systems, they have asked us to interface/exchange data with under their agreement with us. |
| Some clients may configure their version of the creatiogreen software to hold photos and other personal details. | Creatio does not use the data collected by our clients other than as part of the service we provide under the contract agreement with each client. | of this field and it's wording is the decided by each client. You would need to contact the relevant client to obtain the reason they collect the information they do and what they may do with the data once collected and how it's used with third party systems, they have asked us to interface/exchange data with under their agreement with us. |
| Information that may be provided when completing a business process outlined by our clients and which is supported by the creatiogreen software – such as giving information or details when completing a client's online form or log in the software solution. This may also include additional files you may upload when addressing requirements outlined by the client in the Form(s). Or comments Users may make in the Form(s) or pass in relation to information exchanged with the client organisation. This may include information or comments provided in relation to other staff, colleagues, Users or learners at your organisation – such as comments in relation to grading information or performance. |
Fulfilling a contract requirement with our clients and a legitimate interest in delivering the creatiogreen software in accordance with the client's configuration requirements and needs. Creatio does not use the data collected by our clients other than as part of the service we provide under the contract agreement with each client. |
The creatiogreen software is a very flexible and configurable software solution which can be configured differently by different clients to support their operations and business processes. With clients specifying the scope of the system and the content and configuration of each form, log and product and other record templates in the system. In relation to information entered in the creatiogreen software via forms or onscreen fields there are various reports in the system that will extract this data for the client – for Users they have authorised with such access rights. Equally clients can configure forms to automatically update a customer's profile at the end of a transaction (e.g., automated processing). You would need to contact the relevant client to obtain the reason they collect the information they do and what they may do with the data once collected and how it's used with third party systems, they have asked us to interface/exchange data with under their agreement with us. As well as understanding any automated decision processes they make with the data held in the system. |
In relation to Creatio and the data we collect and hold for our business purposes it is important to note we are not interested in collecting every personal information and we do not make any automated decisions with the data we hold. Our main reason for collecting personal information is to provide and improve the service, products, and experiences that our staff and customers expect from us.
We hold personal details in relation to our staff for our legitimate business interests and activities and to comply with various legislation.
We collect personal information that you share with us when you contact us or interact with us through our website, email, phone, in person at meetings, stands and events, or other similar interactions. For example, you will provide information to us when you contact us and/or our staff, invite us to tender for a contract, place an order, complete a survey, competition, or questionnaire, update your preferences and account information, connect with us through our websites.
Through these interactions you may share with us: your name, address, e-mail address, contact number and company payment information. In some circumstances, we will need that information to be able to provide you with a product or service that you have asked us to deliver. For example, we need payment information when your organisation buys the creatiogreen software or consultancy service, and your address to meet you and your staff/colleagues to deliver the service. Or we need your details and/or those of your colleagues/staff to manage our relationship with you or your business or to develop new ways to meet our customers' needs and to grow our business and yours.
If you share details of other people with us (for example, your staff/colleagues), then you will need to check with that person that they are happy for you to share their personal information with us, and for us to use it in accordance with this privacy policy.
As well as the personal information you share with us about yourself via the creatiogreen software or our websites, we will collect and handle personal information related to you. For example, some named (e.g., User details) and anonymous, aggregate statistics from all visitors to our sites whether you actively provide us with that information or merely browse our websites or use our apps. The information we collect may include (how much of this information we collect depends on the type and settings of the device you use to access the creatiogreen software or our websites):
We collect and review data in relation to:
We collect User's first name, surname, and contact details via our client helpdesk to:
We have CCTV installed at our offices and have signs to inform guests of these arrangements.
We may interact with you on social media. You may use social media to contact us about our creatiogreen software and services. We review publicly available social media and online sites to get a better understanding of what people are saying about us, and our products, technology, and services and to assist people who contact us through social media. The information we collect from social media and online sites sometimes includes personal information that has been put online and is publicly available. We make sure any information we use is done so in accordance with the arrangements in this policy and either properly credited to its source or is made anonymous. These online and social media sites typically have their own privacy policies explaining how they use and share personal information.
We hold details of non-client personal if they have provided us with their details to discuss possible future work together or have indicated they wish to be kept up to date with developments at Creatio and the services we offer.
We like to keep Users, clients and prospects and sector stakeholders updated on our latest product announcements, opportunities or upcoming events and would do this in various ways, including e-mail, post, SMS, social media platforms or by phone, but only if they are happy for us to do so. We therefore promise to:
In relation to the data, we hold for Creatio for our own business purposes and activities, you can contact us direct if you wish to remove your consent and no longer want us to hold your personal contact data (our contact details are at the end of this policy).
We've added an AI-powered chatbot to help you work faster inside our application. You can use it to:
The chatbot runs on Microsoft's Azure OpenAI Service, hosted in secure UK/EEA data centres. When you use the chatbot, your question and any necessary context are sent securely to Azure OpenAI. The AI model processes your request and sends the answer back to you.
Using the chatbot is optional. You can still complete all tasks in the application without it.
The creatiogreen system and company website(s) use cookies to collect and store certain information. These typically involve pieces of information or code that a website transfers to or accesses from your computer hard drive or mobile device to store and sometimes track information about you. Cookies allow us to create a unique device ID to enable you to be remembered when using that computer or device to interact with websites and online services and can be used to distinguish Users and manage a range of features and content, including storing searches and presenting personalised content to improve your experience.
It is important to note that most cookies we use expire when you close your browser or log out of the system. Others are used to remember you when you return to our system and will last for longer. We use these cookies on the basis that they are necessary for the performance of a contract with our clients, or because using them is in our legitimate interests (where we have considered that these are not overridden by your rights), and, in some cases, where required by law, where you have consented to their use.
We use the following types of cookies:
Most web browsers automatically accept cookies, but if you prefer, you can change your browser to prevent that as outlined below. The effect of disabling cookies depends on which cookies you disable but, in general, our creatiogreen system will not operate properly if all cookies are switched off.
If you want to disable cookies, you need to change your website browser settings to reject cookies. How you can do this will depend on the browser you use. Further details on how to disable cookies for the most popular browsers are set out below:
For Google Chrome:
For Safari:
For Mozilla Firefox:
For Opera 6.0 and further:
We may share your personal information with companies that support our clients if the clients require us to interface or exchange data with them in accordance with the scope of the contractual agreement with Creatio to meet their business needs or data portability arrangements. You should therefore contact the client direct to understand the data they have requested to be shared and what they may do with this data (also note it is our client's responsibility to make it clear in their consent text and/or privacy policies how data you provide is used across different systems they use for their business purposes). Examples of other organisations/systems with whom such data may be shared:
Please note, the above type of organisations and systems have their own privacy policies explaining how they use and share your personal information. You should review those privacy policies to understand how your personal information is being used.
In relation to data Creatio holds for its own business purposes we do not share this with external parties with the exception of:
All the data captured on:
For Users of the creatiogreen software and system we only keep your personal information for as long as we need to honour our contract obligations with client and use it for the reasons given in this privacy policy, and for as long as we are required to keep it by law. At the end of the agreement, we remove all personal details when we close the client's version of creatiogreen. However, there may be times where we hold the data for slightly longer if we need this information to establish, bring or defend legal claims (note in such circumstances we anticipate not using personal data but simply the details around the total number of Users, customers, transactions, and types of transactions undertaken in creatiogreen software and system)
For Creatio staff members we hold personal details for our business purposes for 5 years after a staff member has left our organisation.
For Users of our website(s) we only keep the details you provided to respond to your online enquiry and if this does not lead to a new contract, we delete the details within 5 years or earlier if they contact us to remove the personal data we hold.
In addition to the right to be informed (in a transparent manner that your data is being collected and used - and which we have outlined in this policy), under the new GDPR legislation you have certain other rights:
In relation to data, we process on behalf of a client in the creatiogreen software and system you will need to contact the client to understand the data they collect and how they use and process it (as each client can configure the software to meet their own specific needs as outlined earlier in this policy) and how it is shared with other organisations or systems. They are also able to provide you a copy of the personal data they hold on you (e.g., should you request details of your account information and any other relevant records they may hold on you).
In relation to personal data, we may hold on you, you can contact us and we will inform you of the personnel data we hold and how we have processed/used this data. If you are a User of our helpdesk service, you can see and modify the personal data we would hold. If you submit a request via our website(s) you decide on the amount of information you provide us, but again we can provide you with details of this if required.
In relation to data a client may process in the creatiogreen software and system you will need to contact the client to correct inaccurate or incomplete personal information concerning you in our software and in other systems they use, and which may have your data.
In relation to personal data, we may hold on you, you can contact us to amend our records if you believe it is incorrect. If you are a User of our helpdesk service, you can see and modify the personal data we would hold.
In relation to data a client may process in the creatiogreen software and system you will need to contact the client to request your data is deleted or forgotten. If the request should be actioned, they can do this themselves in various parts of the system, but if the data is locked as part of an audit trail feature, they can contact Creatio and request us to remove your personal data direct in our databases. The client is also responsible for informing other organisations which they have shared the information with (e.g., through an interface or data feed from our system) and for ensuring the request is acted upon in the other systems where relevant.
In relation to personal data, we may hold on you, you can contact us to delete personal information we may hold on you and we will act upon this request where the request is relevant. This may not be possible in all circumstances as outlined in the legislation such as we need to hold it to comply with a legal obligation or to establish or defend legal claims.
In relation to data a client may process in the creatiogreen software and system you will need to contact the client if you want to restrict how they use your data. They have the ability in the system to edit your profile or configure the solution to alter the way information is collected and used. They will need to consider your request and decide upon the how to action or reject it in accordance with their business needs and purposes and in line with their data privacy arrangements. The client is also responsible for informing other organisations which they have shared the information with (e.g., through an interface or data feed from our system) and for ensuring the request is acted upon in the other systems where relevant.
In relation to personal data, we may hold on you, you can contact us to restrict how we use the personal data we may hold on you and we will act upon this request where the request is relevant.
In relation to data a client may process in the creatiogreen software and system you will need to contact the client if you want to object to how they use your data both within their company and with other organisations they share the data with or to change the consent you originally provided.
In relation to personal data, we may hold on you, you can contact us to if you want us to no longer use the data for marketing purposes and we will act upon this request (e.g., you opt out of receiving future updates).
In relation to data a client may process in the creatiogreen software and system you will need to contact the client if you want to understand if they undertake any automated decision making or profiling based on the data you provide them.
In relation to personal data, we may hold on you, we do not undertake any automatic decision making or profiling.
The security of your personal information is important to us and we implement a range of measures to protect your data as best as we can. However, as you are aware no method of transmission over the Internet, or method of electronic storage, is 100% secure and Users may not robustly protect their User passwords or use unsecure networks. Therefore, we cannot guarantee its absolute security. If you have any questions about security, then please contact us (details at the end of this policy).
Some of the controls we have in place include:
You have the right to lodge a complaint with a data protection regulator - the Information Commissioner's Office (ICO), the data protection regulator in the UK (www.ico.org.uk).
However, we encourage you to contact us first before making any complaint and we will seek to resolve any issues or concerns you may have. Our contact details are below.
We will review the policy annually and revise it as and when necessary, in response to feedback, changes in our practices or changes to relevant legislation.
If we make changes to this notice, we will publish the latest version on our company websites and our client facing helpdesk service (called Transform) and in the footer of each version of the creatiogreen solution we provide to clients.
Should you wish to speak to us about the arrangements outlined in this policy then please email us at info@creatio.org.uk and a relevant member of our team will get back to you.
Document Information:
Title: Creatio Privacy Protection Policy
Version & Status: 11.0 Final
Date of Issue: 2nd August 2024
Author: Rose Ahmed
Confidentiality: Protected document/Internal access only
Copyright in this document remains vested in Creatio Ltd. All rights reserved. The information within this document is not intended for any public circulation nor to be referenced in full or part in any public communication without the prior consent and approval of Creatio. The contents, features, services outlined and referenced within are confidential and must not be disclosed to other competing - or potentially completing companies - and should not be reversed engineered. To do either would be a breach of Copyright and/or IPR and would result in the matter being referred to our legal representatives to take forward accordingly.