OxProx provides a publicly accessible, global database of proxy voting records, in addition to value-added services in support of investment stewardship. OxProx believes in transparency, accessibility, and accountability. 

This Privacy Policy tells you what to expect when we collect personal information from you. It also explains how we will store, handle and keep your personal information safe. 

Please read the following carefully to understand our practices regarding your personal information and how we will treat it.

This Privacy Policy, together with our Terms and Conditions and any additional terms of use, applies to your use of our websites, platform, applications, products, and services, (regardless of where you visit us from) and explains how and why we use the information we collect about you. It also sets out how your personal information will be processed, stored and used when you visit our website.

We keep our Privacy Policy under regular review to make sure it is up to date and accurate.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during our relationship with you.

Important Information About Who We Are:

OxProx Limited (“OxProx”, “we”, “us”, or “our”) will be the controller of your personal information unless otherwise specified. 

We are registered with the Information Commissioner’s Office (ICO). Our ICO registration is ZB306485.

You can Contact us at: 

By post: C/O Jos Rush, 3a Market Place, Woodstock, United Kingdom, OX20 1SY

Email address: hello [at] oxprox [dot] org

General Information:

All your personal Information will be held and used in accordance with the relevant data protection laws. 

Your personal information may be stored in or accessed from multiple countries. Whenever we transfer personal information to other jurisdictions, we will ensure that the information is transferred in accordance with this Privacy Policy and as permitted by applicable data protection laws.

For individuals based in the UK, all personal information will be held and used in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 and any other legislation relating to the protection of personal information.

For individuals based in the European Economic Area (EEA), all personal information will be held and used in accordance with the General Data Protection Regulation (“EU GDPR”) and any other legislation relating to the protection of personal information. 

For individuals based in Canada, all personal information will be held and used in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and any other legislation relating to the protection of personal information.

If you are located outside of  the United Kingdom, the EEA, or Canada, you may have certain rights and protections under applicable laws regarding the processing of your personal information. No matter which country you are accessing our services from we will use appropriate safeguards to protect your personal information in accordance with this Privacy Policy and the applicable data protection laws. 

Changes to our Privacy Policy

Any changes we make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. 

Please check back frequently to see any updates or changes to our Privacy Policy.

Third-party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or policies. 

When you leave our website, we encourage you to read the Privacy Policy of every website you visit.

Collection of your Personal Information

We use different methods to collect information from and about you.

We collect personal information to provide you with our services. We also collect personal information when you visit our website or contact us by email or social media. We may also collect publicly available information

We also collect personal information when you are a supplier or retailer, or we have a commercial contract with you. 

Personal Information That We Collect and Process. 

When you provide personal information to us, we will treat that information in accordance with this Privacy Policy.

Personal information or personal data, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Most of the personal information we process is provided to us directly by you for the purpose of providing you with our services. We do collect some information, including some of your personal information, when you sign up for and when using our services, our website, our platform or application.

We may also collect and process your personal information through your use of our website, including any information you may provide through our website, platform or application or when you correspond with us by phone, email, live chat, social media or otherwise.

Personal information we may collect, use, store, and transfer about you, which we have grouped together, are as follows:

• Identity Data includes first name, last name, username or similar identifier, title.
• Contact Data email address and telephone numbers.
• Financial Data includes bank account and / or payment card details.
• Profile Data, which includes your account login details for website and/or our online account, including your username and password(s), your interests, preferences, feedback and survey responses;
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website. 
• Usage Data includes information about how you use our website, products, and services. 
• Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• other publicly available personal information, including any which you have shared via a public platform (such as a Twitter feed or public Facebook page ).

This list is not exhaustive, and, in specific instances, we may need to collect additional data for the purposes set out in this Privacy Policy.  

All your personal information will be processed in accordance with this Privacy Policy, and in compliance with all applicable confidentiality guidelines.

In some circumstances, we may anonymise your personal information (so that it can no longer be associated with you). This can be for research or statistical purposes; in which case we may use the anonymised information indefinitely without further notice to you. Anonymised information may also be used to develop insights and statistics as to the use of our services, and to identify trends within the sector more broadly.

Our website is not intended for children and our website does not knowingly collect data relating to children.

Payment Card Information: 

We may process your personal information to process any payments made for the provision of services. The information may include information for identification and verification, such as your name, credit, debit or other card number, card expiration date, and CVV code.

Any payment transactions carried out by us, or our chosen third-party provider of payment processing services will be kept secure and encrypted where possible.

Information Received from Third Parties 

This is information we receive about you from publicly accessible sources, for example social media, or from other third parties. For example, we may receive information from third parties who provide services to us or you. 

We will only use this information and the combined information where we have a lawful basis.

We may combine information received from other sources with information you give to us and information we collect about you. We will notify you when we receive information about you from them and the purposes for which we intend to use that information.

Any information obtained from third parties will be kept in accordance this Privacy Policy, and with any additional restrictions imposed by the third party that shared your personal information.

How We Use the Information We Collect

The data protection legislation sets out a number of different reasons for which a company may collect and process your personal information.

We will only use your personal information when the law allows us to do so. The lawful basis that we most commonly use to collect and process your personal information are:

• Where you have consented before the processing.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation

 For example, we use your personal information for, but not limited to the following purposes:

• For the purposes of providing our services,
• For the purposes of managing our relationship with you,
• To respond to your queries and/or requests you send us to use/receive any of our services 
• To inform you about products or services which we believe may be of interest, including marketing proposals or offers. 

In certain circumstances, we need your personal information to pursue our legitimate interests in a way which might be reasonably expected as part of our running our business. For example, to enable us to provide a global database of proxy voting records. 

Additionally, we may use personal information to enforce our agreements, including investigation of any potential violations of our terms.

We may use personal information where we need to comply with a legal or regulatory obligation to detect, prevent or otherwise address criminal activity. 

Whenever you have given us your consent to use your personal information, you have the right to change your mind at any time and withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Information We Share

We may share your information with trusted selected third parties. 

Where we share personal information with third parties, we only provide those parties with the information they need to know to perform their specific services. 

We may share your information with selected third parties including: 

• to our distributors, suppliers and sub-contractors.
• Mailchimp, our marketing services provider and newsletter distributor. 

Where personal information is shared with a managed service provider or other third-party supplier, we work closely with them to ensure that your personal information is secure and protected at all times. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions. 

Our contracts with third parties make it clear that they must hold personal information securely, abide by the principles and provisions of data protection rules, and only use information as we instruct them to. In all instances where we disclose your information to third parties, we will ensure that your information is appropriately protected. If we stop using their services, any of your personal information held by them will either be deleted or rendered anonymous.

Marketing 

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. 

If you have given your consent to receive marketing emails you can withdraw this at any time, or if we are relying on our legitimate interests to send you marketing you can object. In either case, just let us know. If you have received a direct marketing email from us and no longer wish to do so, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails.   

Cookies 

When you visit our website, we may collect certain information by automated means, such as using cookies.

A cookie is a piece of data stored locally on your computer containing information about your activities on the Internet. Each website can send its own cookie to your web browser if your browser’s preferences allow it. Many websites do this whenever a user visits their website in order to track online traffic flows. 

We may use the following types of cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website or make use of services.

Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

If you use your browser settings to block all cookies (including necessary cookies) you may not be able to access all or parts of our website.

Third parties may also use cookies, over which we have no control. To deactivate the use of third-party advertising cookies, you may visit the consumer page to manage the use of these types of cookies.

If you use your browser settings to block all cookies (including necessary cookies) you may not be able to access all or parts of our website.

Third parties may also use cookies, over which we have no control. To deactivate the use of third-party advertising cookies, you may visit the consumer page to manage the use of these types of cookies.

Where Your Personal Information May Be Processed

Your personal information may be stored in or accessed from multiple countries, including but not limited to the UK, EEA and Canada. 

If we do undertake transfers, we have procedures in place to ensure your personal information receives the protections as stipulated by the relevant data protection laws. For example, our contracts with third parties stipulate the standards they must follow at all times.

For all transfers of your personal information to other jurisdictions, we will ensure that the information is transferred in accordance with this Privacy Policy  and as permitted by applicable data protection laws. 

How Long We Will Retain Your Personal Information

We will only retain your personal information for as long as is necessary for the purpose or purposes for which we have collected it.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

Data Security 

We work hard to keep your information safe. We use a combination of technical, administrative, and physical controls to maintain the security of your personal information and protect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use.  

All information you provide to us is stored on secure servers. Some of the controls we have in place to protect your personal data include technological controls such as firewalls, user verification, strong data encryption. We utilise industry best practice standards to support the maintenance of a robust information security management system. 

We have put in place procedures to deal with any suspected personal information data breach and will notify you and any applicable regulator when we are legally required to do so.

Your Rights 

You are also able to exercise your rights which include: 

Your Right to be Informed   

We aim to be transparent within our Privacy Policy and provide you with information about how we use your personal information.

Your Right to Object

In some circumstances you can stop the processing of your personal information for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal information. 

Where your details are used for marketing, you can opt out at any time. You are able to unsubscribe from marketing on each contact or you can contact us to object to any processing.

Your Right to Rectification 

You have the right to request the correction of your personal information when it is incorrect, out of date or incomplete. If you notify us that the personal information, we hold is complete or inaccurate we will correct or complete the information as soon as possible. 

Your Right to Erasure or the Right to be Forgotten

You have the right to request that your personal information be deleted; including if we no longer need it for the purpose we collected it, you withdraw your consent or you object to its processing.

Following your request, we will erase your personal information without undue delay unless the continued retention is necessary and permitted by law. If we make the personal information public, we shall take reasonable steps to inform other data controllers processing about your erasure request.

Your Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information. This can be done in circumstances where we need to verify the accuracy of the information, if you do not wish to have the information erased or you have objected to the processing of the information, and we are considering this request. Once the processing is restricted, we will only continue to process your personal information if you consent, or we have another legal basis for doing so.

Your Right to Access

You have the right to access the personal information we hold about you. Any access request will usually be free of charge and responded to within one month. We will endeavour to provide information in the format requested, but we may charge you a reasonable fee for additional copies. 

Your Right to Data Portability

You have the right to receive a copy of your personal information which you gave to us. The copy will be provided in a commonly used and machine-readable format.  You can also have it transmitted directly from us to another data controller, where technically possible.

The right not to be subject to automated decision making and profiling.

You have the right to not be subject to solely automatic decisions (i.e., decisions that are made about you by computer without any human input) in relation to any processes that have a legal or similarly significant effect on you. 

You will be notified if we make a solely automated decision which produces a legal effect or significantly affects you.

When you request to exercise your rights

You will not have to pay a fee to exercise any of the rights listed above. However, we may charge a reasonable fee if your request is clearly unfounded or excessive, including where requests are repetitive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information or to exercise any of your other rights. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

How can we help? 

If you have any questions about our use of your personal information, you can contact us at [email address chosen] or by post using our postal address.

For further information on data protection please visit the Information Commissioner Office (ICO) website.

The Information Commissioner Office regulates data protection. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal information, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113 or visit the website.