Last updated: 25/08/2026
- About this Privacy Notice
Genius Software Solutions Limited understands that privacy is important and is committed to protecting personal information.
This Privacy Notice explains:
- Who we are.
- What personal information we collect.
- Why and how we use personal information.
- The lawful bases on which we rely.
- When we may share personal information.
- How long we retain it.
- How we protect it.
- The rights available to individuals.
- How to contact us or make a complaint.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the Data (Use and Access) Act 2025 and other applicable privacy legislation.
The Data (Use and Access) Act 2025 amends, but does not replace, the UK GDPR, Data Protection Act 2018 and PECR.
- Information About Us
Genius Software Solutions Limited is a company registered in Scotland.
- Company number: SC381801
- Registered address: 1439 Cumbernauld Road, Glasgow, G33 1AN
- VAT number: 976 2532 91
- ICO registration number: Z2349369
- Data Protection Officer: Elaine Gallacher
- Telephone: 0141 280 0275
- Email: [email protected]
These details are consistent with the information currently published on our website.
- Our Role
Depending on the circumstances, Genius Software Solutions Limited may act as either a data controller or a data processor.
We act as a data controller where we determine why and how personal information is processed. This may include information relating to:
- Website visitors.
- Business contacts and prospective customers.
- Clients and suppliers.
- Employees, contractors and job applicants.
- Individuals who contact us directly.
We may act as a data processor when we process personal information through our products and services on behalf of a client. In these circumstances:
- Our client normally determines why and how the information is processed.
- We process the information in accordance with the client’s documented instructions and our contractual obligations.
- Requests concerning that information may need to be addressed to the relevant client as data controller.
If you are unsure whether Genius or one of our clients is responsible for your personal information, please contact us using the details in section 16.
- What Is Personal Information?
Personal information is information relating to an identified or identifiable living individual.
It includes information that directly identifies an individual, such as a name or email address, and information that may identify someone indirectly when combined with other information, such as:
- Identification numbers.
- Online identifiers.
- Device or usage information.
- Location information.
- Employment or commercial information.
- Contact histories.
Some personal information is subject to additional legal protection. This includes special category information and information relating to criminal allegations or offences.
- Personal Information We May Collect
The personal information we collect depends on your relationship with us and how you interact with our website, products and services.
We may collect:
Contact and identification information
- Name.
- Business name.
- Job title.
- Postal address.
- Email address.
- Telephone number.
Commercial and contractual information
- Enquiries and correspondence.
- Contract and account details.
- Products or services of interest.
- Customer relationship information.
- Support requests and service communications.
Financial information
- Billing and payment information.
- Transaction and invoicing records.
- Relevant financial contact details.
Payment card information, where processed, is handled in accordance with applicable PCI DSS requirements and our contractual arrangements.
Website and technical information
Subject to the cookies and technologies used on this website, we may collect:
- IP address.
- Browser and device information.
- Website usage and navigation information.
- Security and diagnostic information.
- Cookie or similar technology identifiers.
Further information should be provided in our Cookie Notice or cookie management tool.
Employment and recruitment information
Where relevant, we may collect information relating to applicants, employees and contractors. This may include:
- Contact and identification information.
- Application and employment history.
- Qualifications and skills.
- Payroll and contractual information.
- Information required to meet employment, tax, health and safety or equality obligations.
Relevant employee and recruitment information may also be covered by separate employee or candidate privacy notices.
Information processed on behalf of clients
Our platforms and services may process personal information provided or controlled by our clients, including customer contact details, account or case information, communication histories and interaction recordings.
When Genius processes this information solely on behalf of a client, the client’s privacy notice should explain the relevant purposes, lawful bases and individual rights.
We do not intentionally collect personal information that is unnecessary for the relevant business purpose.
- How We Collect Personal Information
We may collect personal information:
- Directly from you when you contact us, submit an enquiry, enter into a contract or use our website.
- Through our business relationship with your organisation.
- From our clients where we provide contracted services on their behalf.
- From suppliers and service providers.
- From publicly available business sources.
- Through website cookies and similar technologies, subject to applicable requirements and your choices.
- Through our systems, security tools and business communications.
Where legally required, we will provide relevant privacy information at or around the time personal information is collected.
- How We Use Personal Information
We may process personal information for the following purposes:
- Responding to enquiries and communicating with you.
- Providing, supporting and improving our products and services.
- Managing client, supplier and commercial relationships.
- Entering into and performing contracts.
- Providing technical and customer support.
- Managing accounts, billing and payments.
- Maintaining the security, availability and integrity of our systems and services.
- Detecting, preventing and investigating misuse, fraud or security incidents.
- Meeting legal, regulatory, audit and compliance obligations.
- Establishing, exercising or defending legal claims.
- Managing recruitment, employment and contractor relationships.
- Sending service information and, where permitted, relevant marketing communications.
- Analysing and improving the operation and performance of our website, subject to applicable cookie and privacy requirements.
- Processing information on behalf of clients in accordance with contractual arrangements and documented instructions.
We will not use personal information for a materially incompatible purpose unless permitted by law and, where required, we provide additional privacy information.
- Our Lawful Bases
We only process personal information where an appropriate lawful basis applies.
Depending on the circumstances, we may rely on:
Contract
Processing may be necessary to enter into or perform a contract with you or your organisation.
Legal obligation
Processing may be necessary to comply with legal or regulatory obligations.
Legitimate interests
Processing may be necessary for our legitimate business interests or those of another organisation, provided those interests are not overridden by your rights and freedoms.
Our legitimate interests may include:
- Operating and improving our business.
- Providing and supporting our services.
- Maintaining information and system security.
- Managing client and supplier relationships.
- Communicating with relevant business contacts.
- Preventing fraud and misuse.
- Establishing or defending legal rights.
We assess relevant legitimate interests and the potential impact on individuals before relying on this basis.
Consent
Where required, we may ask for your consent. You may withdraw consent at any time, although this will not affect processing that took place before withdrawal.
Vital interests or public interest
These lawful bases may apply in limited circumstances where processing is necessary to protect someone’s vital interests or perform a relevant task in the public interest.
Where we process special category or criminal offence information, we will also identify an additional condition permitted by law and apply appropriate safeguards.
- Marketing and Electronic Communications
Where permitted by law, we may use business contact information to provide information about our products, services, events or relevant company updates.
Where consent is required, we will obtain it before sending marketing communications.
You can opt out of marketing communications at any time by:
- Using the unsubscribe option included in the communication.
- Emailing [email protected].
- Contacting us using the details in section 16.
Opting out of marketing will not prevent us from sending essential service, security, account or contractual communications.
Our use of electronic marketing and similar technologies will be managed in accordance with PECR and applicable data protection requirements.
- Cookies and Similar Technologies
Our website may use cookies and similar technologies to:
- Provide essential website functionality.
- Maintain security.
- Remember user choices.
- Understand website performance and usage.
- Support other optional website features.
Non-essential cookies will only be used in accordance with applicable consent requirements.
You should review our Cookie Notice and cookie management tool for details of:
- The cookies and technologies used.
- Their purpose.
- Their duration.
- The organisations that provide them.
- How you can provide, refuse or withdraw consent.
Publication check: Ensure that the website has an up-to-date Cookie Notice and consent tool that accurately reflects the technologies actually operating on the site. Do not publish this drafting note.
- Sharing Personal Information
We may share personal information with trusted organisations where this is necessary and lawful.
Recipients may include:
- IT, hosting and cloud service providers.
- Communications and support service providers.
- Payment and financial service providers.
- Professional advisers, auditors and insurers.
- Security, monitoring and fraud-prevention providers.
- Marketing or website service providers, where applicable.
- Regulators, law enforcement agencies, courts or public authorities where required or permitted by law.
- Other parties involved in a business restructuring, investment, merger, acquisition or sale, subject to appropriate confidentiality and legal safeguards.
Where another organisation processes personal information on our behalf, we require appropriate contractual, confidentiality, privacy and security controls.
We require processors to process personal information only in accordance with documented instructions unless applicable law requires otherwise.
We do not sell personal information.
Publication check: Confirm that “we do not sell personal information” accurately reflects current practice and identify any named third-party processors that should be disclosed. Remove this note before publication.
- International Transfers
Personal information may be stored in, accessed from or transferred to countries outside the United Kingdom where this is necessary for our operations or service provision.
Where UK personal information is transferred internationally, we will ensure that an appropriate legal transfer mechanism is used. This may include:
- UK adequacy regulations.
- The UK International Data Transfer Agreement.
- The UK Addendum to approved standard contractual clauses.
- Another safeguard or exception permitted by applicable law.
Where required, we will assess the circumstances and risks associated with the transfer and implement supplementary safeguards.
Where Genius acts as a processor, international transfers will also be governed by relevant client instructions and contractual arrangements.
You may contact us for further information about the safeguards relevant to your personal information.
Publication check: Confirm the countries from which data can be accessed and ensure this section aligns with supplier contracts and your international transfer register. Remove this note before publication.
- How Long We Retain Personal Information
We retain personal information only for as long as necessary for the purpose for which it was collected.
Retention periods take account of:
- The nature and purpose of the processing.
- Legal, regulatory and tax requirements.
- Contractual commitments.
- Audit and security requirements.
- The need to establish, exercise or defend legal claims.
- The sensitivity and volume of the information.
- Relevant complaints, disputes, investigations or legal holds.
Where Genius acts as a processor, retention periods may be determined by the relevant client’s documented instructions or contractual requirements.
When personal information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our retention and disposal requirements.
- How We Protect Personal Information
We implement technical and organisational measures designed to protect personal information against:
- Unauthorised or unlawful processing.
- Accidental loss, destruction or damage.
- Unauthorised access, use, alteration or disclosure.
Measures may include:
- Access controls.
- Authentication controls.
- Encryption.
- Security monitoring and logging.
- Network and device security.
- Backup and recovery arrangements.
- Physical security measures.
- Supplier assurance.
- Information security and privacy training.
- Incident management and breach-response arrangements.
Access to personal information is limited to authorised individuals with a legitimate business need.
No method of transmission or storage can be guaranteed to be completely secure, but we review our controls and work to maintain measures appropriate to the risks involved.
- Artificial Intelligence and Automated Decision-Making
Where Artificial Intelligence or automated technologies are used in connection with personal information, we apply appropriate privacy, security, governance and risk-management controls.
We do not currently use personal information collected through this website to make solely automated decisions that produce legal or similarly significant effects on individuals.
If this changes, we will update this Privacy Notice and provide affected individuals with information about:
- The automated processing involved.
- The significance and likely consequences.
- The safeguards and rights available.
- How to request human intervention or challenge a decision.
Where relevant, meaningful human oversight will be maintained and automated systems will be monitored to ensure they continue to operate as intended.
The DUAA permits a broader range of lawful bases for certain significant automated decisions, subject to appropriate safeguards, while special category information remains more protected. The ICO identifies safeguards including informing individuals, providing routes for human intervention or challenge, and checking that systems operate as intended.
- Your Data Protection Rights
Depending on the circumstances and subject to applicable legal conditions and exemptions, you may have the right to:
- Be informed about how your personal information is used.
- Request access to your personal information.
- Request correction of inaccurate or incomplete information.
- Request erasure of personal information.
- Request restriction of processing.
- Receive certain information in a portable format.
- Object to processing based on legitimate interests.
- Object to direct marketing.
- Withdraw consent where processing relies on consent.
- Exercise rights relating to automated decision-making and profiling.
- Make a complaint about how your personal information is processed.
These rights do not apply in every circumstance. We may need to obtain information to confirm your identity and understand your request before acting upon it.
We will not usually charge a fee. A reasonable fee may be charged, or a request may be refused, where permitted by law, including where a request is manifestly unfounded or excessive.
To exercise a right, contact us using:
- Email: [email protected]
- Telephone: 0141 280 0275
- Post: Genius Software Solutions Limited, 1439 Cumbernauld Road, Glasgow, G33 1AN
If your request relates to information that Genius processes solely on behalf of a client, we may refer the request to the relevant client as data controller.
- Data Protection Complaints
If you have concerns about how we have processed your personal information, please contact us so that we can investigate.
We maintain arrangements for receiving, recording, investigating and responding to data protection complaints.
We will:
- Provide an accessible way for you to make a complaint.
- Acknowledge receipt within 30 days.
- Take appropriate steps to investigate and respond without undue delay.
- Make appropriate enquiries into the subject matter.
- Keep you informed of progress where appropriate.
- Inform you of the outcome without undue delay.
These requirements reflect the data protection complaints arrangements introduced by the DUAA.
You may contact us using the details in section 16.
You also have the right to complain to the Information Commissioner’s Office. Information about raising a concern is available from the Information Commissioner’s Office.
We encourage you to contact us first so that we have an opportunity to investigate, but this does not affect your right to contact the ICO.
- Personal Data Breaches
We maintain incident management arrangements to identify, assess, respond to and learn from actual or suspected personal data breaches.
Where required by law, we will notify the Information Commissioner’s Office and affected individuals within the applicable legal timeframes.
Where we act as a processor, we will notify the relevant client in accordance with applicable legal and contractual requirements.
- Links to Other Websites
Our website may contain links to websites operated by other organisations.
We are not responsible for the privacy practices or content of external websites. We recommend reviewing the privacy information provided by the relevant organisation before submitting personal information.
- Changes to This Privacy Notice
We may update this Privacy Notice to reflect changes in:
- Law or regulatory guidance.
- Our organisation or services.
- The ways in which we process personal information.
- Our technologies, suppliers or security arrangements.
The current version and date will be displayed at the top of this page.
Where a change materially affects how we process personal information, we will take reasonable steps to bring the change to the attention of affected individuals where required.
- Contact Us
For questions about this Privacy Notice or how we process personal information, to exercise your rights, or to make a data protection complaint, please contact:
Data Protection Officer
Genius Software Solutions Limited
1439 Cumbernauld Road
Glasgow
G33 1AN
- Email: [email protected]
- Telephone: 0141 280 0275
- ICO registration number: Z2349369