Privacy Policy

1.1. Everyone has rights with regard to how their personal information is handled. During the course of our activities we will collect, store and process personal information about our staff, suppliers and customers and any others we communicate with, and we recognise the need to treat it in an appropriate and lawful manner.

1.2. The types of information that we may be required to handle include details of current, past and prospective employees, suppliers, customers, and others that we communicate with. The information, which may be held on paper or on a computer or other media, is subject to certain legal safeguards specified in the EU General Data Protection Regulation (GDPR) and other UK data protection law. These laws impose restrictions on how we may use that information.

1.3. We have a commitment to ensuring that personal data is processed in line with GDPR and relevant UK law and that all our employees conduct themselves in line with this and other related policies. Where third parties process data on our behalf, we will ensure that the third party takes the necessary measures to maintain our commitment to protecting personal data.

1.4. This Data Protection Policy, also known as a Privacy Standard, does not form part of any employee’s contract of employment and it may be amended at any time. Any breach of this policy will be taken seriously and may result in disciplinary action.

2.1. This policy sets out our rules on data protection and the legal conditions that must be satisfied in relation to the obtaining, handling, processing, storage, transportation and destruction of personal information.

2.2. Our Privacy Officer is responsible for ensuring compliance with GDPR and with this policy. Your manager can advise you who our Privacy Officer is. If we have cause to appoint a Data Protection Officer (an official appointment) or use a different title for a Privacy Officer, we will let you know and any reference to Privacy Officer shall include reference to a new title or a Data Protection Officer. Any questions or concerns about the operation of this policy should be referred in the first instance to the Privacy Officer.

2.3. If you consider that this policy has not been followed in respect of personal data about yourself or others, you should raise the matter with your manager or the Privacy Officer.

3.1. Data is personal information about an individual who can be directly or indirectly identified from that information. Data can be factual (such as a name, address or date of birth) or it can be an opinion (such as a performance appraisal). This personal information is referred to as ‘Data’ in the remainder of this policy.

3.2. Data Subjects for the purpose of this policy include all living individuals about whom we hold Data. A Data Subject need not be a UK national or resident. All Data Subjects have legal rights in relation to their Data.

3.3. Data Controllers are the people who or organisations which determine the purposes for which, and the way, any Data is processed. They have a responsibility to establish practices and policies in line with relevant laws. We are the Data Controller of all Data used in our business.

3.4. Data Users include employees whose work involves using Data. Data Users have a duty to protect the Data they handle by following our data protection and security policies at all times. All employees have a responsibility, when using Data, to comply with any security safeguards and procedures we put in place.

3.5. Data Processors include any people who or organisations which process Data on behalf of a Data Controller. Employees of Data Controllers are excluded from this definition, but it could include third party suppliers which handle Data on our behalf.

3.6. Processing is any activity that involves use of Data. It includes obtaining, recording, or holding Data, or carrying out any operation or set of operations on Data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring Data to third parties.

3.7. Special Categories of Data are sensitive categories of Data about a person’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition, sexual life, or sexual orientation. It also includes genetic and biometric Data (where used for ID purposes). Special Categories of Data can only be processed under strict conditions and may require the explicit consent of the person concerned.

3.8. Criminal Offence Data is Data which relates to an individual’s criminal convictions and offences. It can only be processed under strict conditions and may require the explicit consent of the person concerned.

3.9. Data Breach is any act or omission which compromises the security, confidentiality, integrity or availability of Data, or the safeguards that we or a third party put in place to protect the Data, including losing the Data or disclosing it to unauthorised people.

4.1. Anyone processing Data must comply with the eight enforceable principles of good practice. These provide that personal data must be:

(a) Processed fairly, lawfully, and in a transparent manner. (Fairness, Lawfulness and Transparency)

(b) Processed for specified, explicit and legitimate purposes and in an appropriate way. (Purpose Limitation)

(c) Adequate, relevant and limited to what is necessary for the stated purpose. (Data Minimisation)

(d) Kept accurate and up to date (Accuracy)

(e) Not kept longer than necessary for the stated purpose. (Storage Limitation)

(f) Processed in a manner that ensures appropriate security of Data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage, by using appropriate technical or organisational measures. (Security, Integrity and Confidentiality)

(g) Not transferred to another country without appropriate safeguards being in place. (Transfer Limitation)

(h) Processed in line with Data Subjects’ rights. (Data Subject’s Rights and Requests)

4.2. We are responsible for and need to demonstrate compliance with the data protection principles listed above (Accountability).

9.1. Data must be accurate, complete and kept up to date. Information which is incorrect is not accurate and steps should therefore be taken to check the accuracy of any Data at the point of collection and at regular intervals afterwards. Inaccurate or out-of-date Data should be amended or destroyed.

10.1. Data should not be kept longer than is necessary to carry out the specified purposes. This means that Data should be destroyed or erased from our systems when it is no longer required, and in accordance with our Data Retention Policy.

11.2. We will put in place procedural and technological safeguards appropriate to our size, scope and business, our available resources and the amount of Data we hold, to maintain the security of all Data from the point of collection to the point of destruction.

11.3. We will consider and use, where appropriate, the safeguards of encryption, anonymisation and pseudonymisation (replacing identifying information with artificial information so that the Data Subject cannot be identified without the use of additional information which is kept separately and secure).

11.4. We will regularly evaluate and test the effectiveness of these safeguards. Employees have a responsibility to comply with any safeguards we put in place.

11.5. Maintaining data security means guaranteeing the confidentiality, integrity and availability of the Data, defined as follows:

(a) Confidentiality means that only people who are authorised to use the Data can access it.

(b) Integrity means that Data should be accurate and suitable for the purpose for which it is processed.

(c) Availability means that authorised users should be able to access the Data if they need it for authorised purposes.

11.6. Failure to follow rules on data security may be dealt with via the Disciplinary Procedure.

12.1. We will not transfer Data to any recipients outside the European Economic Area (EEA)

13.1. Data must be processed in line with Data Subjects’ rights. Data Subjects have the following rights which apply in certain circumstances:

A)  The right to be informed about processing of Data

B)  The right of access to their own Data

C)  The right for any inaccuracies to be corrected (rectification)

D)  The right to have information deleted (erasure)

E)  The right to restrict the processing of Data

F)  The right to portability

G)  The right to object to the inclusion of Data

H)  The right to regulate any automated decision-making and profiling of Data

I)  The right to withdraw consent when the only legal basis for processing Data is consent

J)  The right to be notified of a Data Breach which is likely to result in high risk to their rights and freedoms

K) The right to make a complaint to the Information Commissioner’s Office or other supervisory authority.

13.2. A formal request from a Data Subject for details of Data that we hold about them must be made in writing (Data Subject Access Request). Any member of staff who receives such a written request should forward it to their manager immediately.

18.1. We will keep full and accurate records of all our data processing activities.