Scope

The privacy notice explains how C3 collects, uses, discloses, retains, and secures your personal data as part of its business practices. The policy clearly articulates the legal justifications for the processing of your personal data and also lists your data subject rights under the Cayman Islands’ Data Protection Act, (Revised)

Overview

C3 respects your privacy, and you are entitled to have your personal data processed in accordance with the DPA. Below are the privacy principles C3 applies when processing your personal data:

Lawfulness: C3 will only collect your personal data in a fair, lawful and transparent manner.
Data minimization: C3 will limit the collection of your personal data to what is directly relevant and necessary.
Purpose limitation: C3 will only collect your personal data for specified, explicit and legitimate purposes.
Accuracy: C3 will keep your personal data accurate and up to date while there continues to be a customer relationship, and in certain circumstances, after that relationship has ended.
Data security and protection: C3 has implemented technical and organizational measures to ensure an appropriate level of data security and protection considering the sensitivity of the personal data it processes. Such measures provide for the prevention of any unauthorized or unlawful processing of your personal data and against accidental loss or destruction of, or damage to that data.
Access and rectification: C3 will process your personal data in line with your legal rights under the DPA.
Retention limitation: C3 will retain your personal data in a manner consistent with applicable data protection legislation and regulation (including the DPA) and no longer than is necessary for the purposes for which it has been collected in accordance with its retention policy.
Protection for international transfers: C3 will ensure that if your personal data is transferred outside the Cayman Islands, it is adequately protected.

What personal data does C3 collect?

C3 collects various personal data about you which may include the following (this list is not exhaustive):

name and address
date of birth
telephone number
email address
identification details (for example, your driver’s license or passport)
details of phone usage including numbers called and duration of calls
general Internet traffic data related to your IP address
details of your downloads using peer to peer file sharing software
financial information such as credit card numbers or certain banking information
your communications with us, including emails and phone calls (and any recordings made for training or security purposes)
details of the products and services you use and how you use them
information voluntarily provided to C3 by a data subject on a social media platform such as Facebook, Twitter or a chat application such as WhatsApp.

How does C3 use the personal data it collects?

C3 may use your personal data to (this list is not exhaustive):

respond to your inquiries
manage our relationship with you
send invoices and collect payment for goods or services rendered
undertake or assist with credit and fraud prevention checks (including requesting information about you or responding to requests about you from other providers)
conduct promotional activities
conduct surveys
market goods and services
engage with you on social media platforms
handle your complaints
prevent fraud or other criminal activity
manage bandwidth usage
maintain, develop and test our network (including managing the traffic on our network), products and services, to provide you with a better service
train our employees to provide you with products and services
comply with any regulatory reporting obligations
prevent the use and transmission of viruses and other impediments to the provision of service to you
record health and safety details if there is an incident at one of C3 establishments or a C3 event

When does C3 disclose your personal data?

C3 may disclose your personal data in the following circumstances (this list is not exhaustive):

on social media where you may have already made the personal data public
if C3 uses a third-party service provider for marketing, marketing research, payment management or client relationship management
to other market providers for the purpose of credit and fraud prevention checks
to debt collection agencies or other third parties for the purposes of debt collection
if you request that or consent to your personal data being disclosed to a third party
to a third party that C3 partners with for special events so that the third party might contact attendees for marketing purposes
if there is a legal request or regulatory, civil, or criminal investigation or dispute
if it is required to seek legal advice from C3 legal counsel or to other advisors including auditors and insurers
any other circumstance where it may be required by law or regulation

International transfer of personal data

All of your personal data is stored in the Cayman Islands. C3 cannot control the security of the data you willingly send outside of the Cayman Islands on its networks. By using our websites and/or registering for, using and/or making online payment for C3 services, you consent to the transfer of personal data to anywhere where C3 or its service providers and payment processing companies maintain facilities and the use and disclosure of information about you as described in this Privacy Policy. If and to the extent that personal data is transferred outside of the Cayman Islands, we will ensure that appropriate measures are in place to protect the privacy and integrity of such personal information and in particular will comply with our obligations under relevant data protection laws and regulations governing such transfers.

The legal basis for processing your personal data

The DPL sets out some different reasons for which a company may process personal data, and C3 does so under the following legal conditions:

Consent

In specific situations, C3 may collect and process your personal data with your consent. For example, if you tick a box to receive email newsletters or information on promotions and events.

Contractual obligations

In certain circumstances, C3 may need to process certain personal data to comply with contractual obligations. For example, C3 will process your personal information to ensure that you abide by your contract, such as to ensure you are only using our networks legally or not deliberately overloading the network or server resources.

Legal compliance

If the law requires, C3 may need to process your personal data. For example, C3 may be required to disclose your personal information if there is a legal request or law enforcement or regulatory investigation.

Legitimate interest

In specific situations, C3 may process your personal data to pursue its legitimate interests in a way that might reasonably be expected as part of running its businesses and which does not materially impact your rights, freedom or interests. For example, C3 monitors bandwidth usage according to IP to ensure customers are not negatively affected by others who might inappropriately use too much bandwidth.

How long does C3 retain your personal data?

C3 retains your personal data for as long as a customer relationship exists and the personal data is necessary to manage that relationship. When there is no longer a customer relationship, C3 will retain certain types of personal data for varying periods depending on legal requirements and business needs. Personal data that is no longer needed will be securely destroyed. C3 will always hold your personal data for the least amount of time it considers necessary in accordance with its retention policy.

How does C3 secure your personal data?

C3 employs appropriate technical and organizational measures to protect against unauthorized processing, accidental loss or destruction of, or damage to, your personal data in accordance with its Information Technology and physical security policies.

Please keep in mind that it is not possible to achieve a perfect state of data security. Although we maintain reasonable administrative, physical, and electronic security measures designed to protect your personal data from unauthorized access, we cannot ensure absolute security of any information you transmit to us or guarantee that this information will not be accessed, disclosed, altered, or destroyed. We will make any legally required disclosures of any breach of the security, confidentiality, or integrity of your unencrypted electronically stored personal data.

Change of control

We may share all or some of your personal data with any of our subsidiaries, joint ventures, or other companies under common control to be used in a manner consistent with this Privacy Policy. In the event, we go through or undergo due diligence in anticipation of a business transition such as a merger, acquisition by another company, or sale of all or a portion of our assets, your personal data may be among the assets transferred. You acknowledge that such transfers may occur and are permitted by this Privacy Policy and that any entity that acquires such personal data by transfer may continue to process your personal data as set forth in this Privacy Policy.

Contact with you

If we have your permission, we may send you materials we think may interest you, such as new services and updates. You can decide not to receive these emails at any time by contacting us at info@c3.ky, or by following the unsubscribe instructions in the relevant communication.

Loyalty Card Program

C3 may, from time to time, enter into loyalty card programs with its affiliates, including Clean Gas Ltd and the Hurley’s Group of companies (including Hurley’s Food Store) (together “the Group”) in order to reward customers of these companies for their loyalty. By their nature, loyalty card programs involve the collection of personal data, including, but not limited to, name, date of birth, contact and shopping habits. The data will be used by the Group for purposes including marketing, targeted advertising, tracking customer purchases and building consumer profiles. Personal data may be shared between member companies of the Group for the same purposes. By requesting a loyalty card from any Group member company, the customer specifically acknowledges that such company will collect and process the personal data specified in the loyalty card program form as well as data regarding purchases and may share such data with the Group. If you do not wish to have your data collected, processed or shared, in this way, please do not enter any loyalty card program with any member of the Group.

What rights do you have in respect to your personal data?

You have a right to be informed of how your personal data is processed and this privacy notice fulfills C3’s obligation in that respect. If you have further questions or concerns not addressed in the notice, please contact info@c3.ky.

You have rights (with certain restrictions) to request access to your personal data, request rectification/correction of your personal data, request that processing of your personal data be stopped or restricted, and to require C3 to cease processing your personal data for direct marketing purposes. If you wish to exercise any of these rights, you should contact info@c3.ky.

If you feel that your personal data has not been handled correctly, or you are not satisfied with C3 responses to any requests you have made to C3 regarding the use of your personal data, you have the right to complain to the Cayman Islands’ Ombudsman. The Ombudsman can be contacted by calling 1-345-946-6283 or by email at info@ombudsman.ky.

Changes to policy

By using C3 services or accessing this website, you acknowledge and accept this Privacy Policy as part of the terms of service. If you do not agree, please do not use this website or C3 services. C3 reserves the right to make changes to this Privacy Policy at any time. Any changes to the Privacy Policy will be posted on this page. If changes are significant, we may choose to notify you by email or indicate on our homepage that the Privacy Policy has been updated.

Customer Privacy Policy