CRE Group GDPR and Privacy Policy

1. Who We Are

CRE Communications Limited, trading as CRE Group, is the controller of your personal data. We are registered in England and Wales under company number 13527412, at Unit 17, Lloyds Court, Manor Royal, Crawley, RH10 9QX. We are registered with the Information Commissioner's Office under number ZC078436.

We handle personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. Who This Policy Covers

This policy applies to anyone whose personal data we hold or process, including:

• Customers and users of our products and services
• Visitors to our website and people who use our live chat or WhatsApp assistant
• People who fill in a form on our website, download a free tool or sign up to our newsletter
• People referred to us by an existing customer
• Job applicants
• Business contacts and prospective customers - including people at businesses we believe may benefit from our services, whether or not you have contacted us directly

If we hold data about you that did not come from you directly, Section 5 explains where it came from and how to exercise your rights over it.

3. What We Collect

• Identification and contact data: your name, business or personal email address, telephone and mobile number, business address, employer or organisation name and social media handles.
• Professional information: your job title, role, branch or work location and department.
• Enquiry details: what you tell us when you contact us - the nature of your enquiry, the number of phone system users at your business, the CRM you use, your current contract and anything you write in a message.
• Communications data: records of emails, phone calls, live chat and WhatsApp conversations with us.
• Transactional data: details of the services you take from us, contracts, billing and referral credits.
• Technical and usage data: your IP address, browser and device type, pages visited and how you arrived at our website.
• Campaign and advertising data: the page you first landed on, the website that referred you, campaign tags (UTM parameters) and advertising click identifiers from Google, Meta and LinkedIn.
• Premises data: CCTV images if you visit our offices.

4. How We Collect Data From You

• Website forms: when you contact us, book a telecoms or services review, request a CRE Connect demo, refer a business, download a free tool such as our CRM Integration Checklist, apply for a job or sign up to our newsletter.
• Live chat and WhatsApp: when you message our assistant on our website or on WhatsApp (see Section 10).
• Your use of our website: some technical, usage and campaign data is collected automatically when you browse our website. Analytics and advertising cookies are only set if you agree to them (see Section 9 and Section 17).
• Direct contact: when you call or email us, meet us at an event, report an issue, give feedback or use our products and services.

Where we hold data about you that we did not collect directly, see Section 5.

5. Information We Obtain From Other Sources

Some of the personal data we hold does not come from you.

Business contact data. Where we market our services to businesses, we obtain business contact information from:

• Companies House, the public register of UK companies - company details and the names of directors
• Publicly accessible business websites - named staff, job titles and published contact details
• Public business directories and property portals - branch names, addresses and telephone numbers
• Commercially available business contact databases - business contact details obtained from reputable suppliers
• Public technical records, such as telephone number allocation data published by Ofcom and publicly published domain records

We combine and cross-check these sources to keep the information accurate, and we record where each item came from. If we hold information about you that we obtained this way, our full notice explaining your rights is here: Privacy Notice for Business Contacts.

Referrals. If an existing customer refers your business to us, they give us your name, business and contact details. We use them to contact you once about our services. If you tell us you are not interested, we will not contact you again and we add you to our do-not-contact list.

Industry partners. If you are a member of an organisation we partner with, such as the Guild of Property Professionals, Kerfuffle or Propertymark, and you ask them to put you in touch, they may pass us your contact details.

6. Why We Use Your Data

• Responding to enquiries: to reply to your enquiry, arrange a review or demo, and send you a free tool you have requested.
• Service fulfilment: to carry out our obligations under contracts between you and us, including the provision of communication services.
• Customer support: to help with your services, billing and support requests, and to manage our relationship with you.
• Referral programme: to contact businesses you refer and to apply referral credits to your account.
• Marketing: to send you information about our products and services, including marketing to business contacts and prospective customers as described in Section 8. You can opt out at any time.
• Advertising and measurement: to understand which campaigns bring us enquiries and customers, and to show relevant adverts (see Section 9).
• Recruitment: to assess and communicate with you about job applications and keep records of our recruitment process.
• Website improvement: to understand how our website is used and fix technical issues.
• Legal compliance and business administration: to comply with legal obligations, enforce our rights, defend against claims and manage business transitions.

7. Legal Basis for Processing Your Data

• Contract: to provide the services you take from us and to take steps you ask for before entering a contract, such as preparing a proposal.
• Legitimate interests: to respond to enquiries, manage our customer relationships, run our referral programme, keep our website secure, measure how our marketing performs and market our telecoms, broadband and IT services to businesses we reasonably believe may benefit from them. Where we rely on legitimate interests, we carry out and document an assessment that balances our interests against your rights and interests. You can ask for a summary of that assessment at any time (see Section 21).
• Consent: for analytics and advertising cookies, for our newsletter where you sign up as an individual, and for marketing emails to sole traders and partnerships. You can withdraw consent at any time.
• Legal obligation: to comply with regulatory, tax and accounting requirements or to respond to lawful requests from authorities.

8. Marketing to Businesses

We market our telecoms, broadband and IT services to businesses we believe may benefit from them, using contact details obtained as described in Section 5. Our lawful basis for this marketing is legitimate interests, as set out in Section 7.

We only send marketing emails to sole traders and partnerships if they have agreed to receive them, or if they are existing customers and we are telling them about similar services.

Before making marketing calls, we screen our lists against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS), and we maintain our own do-not-contact list. Every marketing email we send includes a clear way to opt out.

If you tell us you do not want to be contacted, we add you to our do-not-contact list and stop marketing to you. See Section 12 for your right to object to marketing.

9. Website Analytics, Advertising and Measurement

Analytics. With your consent, we use Google Analytics 4 to understand how visitors use our website, such as which pages are viewed and how people move between them.

Campaign tracking. When you arrive on our website, we note the page you landed on, the website that referred you, any campaign tags in the link and any advertising click identifier from Google, Meta or LinkedIn. We store these in your browser and, if you then submit a form, we attach them to your enquiry so we know which campaign brought you to us.

Advertising. With your consent, we use the Meta Pixel and the LinkedIn Insight Tag to measure our adverts and show relevant adverts to people who have visited our website.

Conversion data shared with advertising platforms. When an enquiry becomes a qualified lead, a booked meeting or a customer, we send a record of that event to Meta and LinkedIn so they can tell us which adverts worked. These records include the advertising click identifier and, where needed to match the event, your email address or phone number in hashed (scrambled) form, plus the event type, date and, for new customers, the contract value. We send this data through Zoho and Zapier. The advertising platforms use it to measure and improve our adverts, and may use it under their own privacy policies. Our lawful basis is legitimate interests. You can object at any time by emailing privacy@cregroup.co.uk, and we will stop sending your data.

10. Live Chat and WhatsApp Assistant

Our website live chat and our WhatsApp channel are answered first by an AI assistant, provided for us by Nesti. The assistant tells you it is an AI. It can answer questions about our services, ask a few questions to understand your business, such as how many users you have, which CRM you use and when your current contract ends, and book a demo or review with a member of our team using Zoho Bookings.

We keep a transcript of each conversation and add your details and the conversation to our CRM so our team can follow up. If you message us on WhatsApp, WhatsApp, which is owned by Meta, also processes your messages and phone number under its own privacy policy.

You can ask to speak to a person at any time in the chat, or contact us directly using the details in Section 21.

11. Automated Decision-Making

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our chat assistant uses your answers to decide whether to offer a demo straight away. For example, if your current contract has more than two years left, it may suggest we speak nearer the time. You can always ask for a person to review this, and a member of our team will pick it up.

12. Your Rights

• Right of access: request copies of the personal data we hold about you.
• Right to rectification: correct any inaccurate or incomplete data.
• Right to erasure: ask us to delete your data in certain circumstances.
• Right to restrict processing: limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used format.
• Right to object: object to processing based on our legitimate interests, including the sharing of conversion data with advertising platforms.
• Right to withdraw consent: withdraw consent at any time where we rely on it, including for cookies.
• Rights over automated decisions: ask for a person to review any decision made by our chat assistant.

To exercise these rights, contact us using the details in Section 21. We will respond within one month.

Your right to object to direct marketing. You can tell us to stop marketing to you at any time, and we will stop. This right is absolute - you do not have to give a reason, and we cannot refuse or ask you to justify it. Email privacy@cregroup.co.uk or call 01903 952733. One message is enough.

13. Data Retention

We keep personal data for no longer than we need it.

At the end of these periods we delete the data or anonymise it so it can no longer identify anyone.

14. Data Security

We use appropriate technical and organisational measures to protect your personal data from unauthorised access, loss or accidental deletion. These include encryption, access controls that limit data to the people who need it, and security certification under the UK government's Cyber Essentials scheme.

15. Who We Share Your Data With

We do not sell or rent your personal data. We share it only with:

• Service providers who process data on our behalf under contract, listed below.
• Advertising platforms that receive conversion data as described in Section 9.
• Network operators and suppliers where needed to provide your communication services.
• Professional advisers, such as lawyers and accountants.
• Regulators, law enforcement and courts where the law requires it.
• A buyer or successor, if all or part of our business is sold or reorganised.

16. International Transfers

Some of our service providers process data outside the United Kingdom. Where we transfer personal data outside the UK, we rely on a legally recognised transfer mechanism - UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses - and we satisfy ourselves that your data will receive an equivalent level of protection.

17. Cookies and Similar Technologies

Our website uses cookies and similar technologies, such as browser storage. Some are strictly necessary for the website to work and are always on. Analytics and advertising cookies are only used if you agree to them, and you can change your choice at any time using the Cookie Settings link at the bottom of every page. The cookies we use are listed below.

18. Complaints

If you are unhappy with how we have handled your personal data, tell us at privacy@cregroup.co.uk. We will acknowledge your complaint within 30 days and work to resolve it without undue delay.

You also have the right to complain to the Information Commissioner's Office at any time - ico.org.uk, or 0303 123 1113. You do not have to raise it with us first.

19. Changes to This Policy

We may update this policy to reflect changes in our services, our website or the law. We will post any update on this page and change the date at the top. If a change materially affects how we use your data, we will tell you directly where we can.

20. CRE Group CTI Chrome Extension

CRE Group CTI is a Chrome extension that connects your 8x8 phone system to Alto CRM. This section explains what data the extension handles.

What it collects and stores:

• Your name, entered by you and stored locally on your device
• Your Alto API credentials (Client ID, Client Secret and Agency Reference), entered by you and stored locally on your device
• Your display preferences (pop timing and auto-start setting), stored locally on your device

How data is used:

• Your name is included in call notes written to your Alto CRM account
• Your Alto credentials are used only to authenticate with the Alto API to search for contacts and create call notes
• Phone numbers from incoming and outgoing calls are used temporarily to search Alto for matching contacts. They are not stored.

Where data is sent:

• Alto CRM API (api.alto.zoopla.co.uk)- to search contacts and log call notes
• 8x8 (cloud8.8x8.com) - call events are received from the 8x8 phone system
• No data is sent anywhere else. No analytics, no tracking and no third parties.

All settings are stored locally on your device using Chrome's built-in storage. Nothing is stored on external servers by this extension. We do not sell, transfer or share any extension data with third parties, and we do not use it for advertising, analytics or creditworthiness purposes.

21. Contact Us

If you have any questions about this policy or how we handle your personal data, contact us at:

CRE Communications Limited, trading as CRE Group
Unit 17, Lloyds Court, Manor Royal, Crawley, RH10 9QX

Privacy enquiries: privacy@cregroup.co.uk
General enquiries: sales@cregroup.co.uk
Phone: 01903 952733
ICO registration number: ZC078436