Data Protection

Introduction

The business needs to gather and use certain information about individuals.

These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards — and to comply with the law.

Why this policy exists

This data protection policy ensures that we:

Comply with data protection law and follow good practice;
Protects the rights of staff, customers and partners;
Is open about how it stores and processes individuals’ data;
Protect ourself from the risks of a data breach

Data Protection Legislation

The UK General Data Protection Regulation (UK GDPR) (GDPR) describes how we must collect, handle and store personal information.

These rules apply regardless of whether personal data is stored electronically, on paper or on other materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

GDPR is underpinned by six important principles.

1. Lawfulness, fairness and transparency

Transparency: Tell the customer what data processing will be done.

Fair: What is processed must match up with how it has been described. Lawful: Processing must meet the tests described in GDPR [article 5, clause 1(a)]. We meet the lawfulness, fairness and transparency principle by providing or signposting individuals to our privacy policy at the point of collecting their personal information. If we collect individuals’ personal information from a third party, we provide them or signpost them to our privacy policy at the point of first communication with them.

2. Purpose limitations

Personal data can only be obtained for “specified, explicit and legitimate purposes”. Data can only be used for a specific processing purpose that the subject has been made aware of and no other, without further consent.

3. Data minimisation

Data collected on a subject should be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” [GDPR 2018 article 5, clause 1(c)]. In other words, no more than the minimum amount of data should be collected and kept for specific processing.

4. Accuracy

Data must be “accurate and where necessary kept up to date” [GDPR 2018 article 5, clause 1(d)]. Baselining ensures good protection and protection against identity theft. Data holders should build rectification processes into data management / archiving activities for subject data. We endeavour to ensure that our staff HR records remain up to date and accurate by periodically requesting that staff review and update their HR records (e.g. contact details, next of kin details, medical information etc.).

5. Storage limitations

The Regulator expects personal data to be “kept in a form which permits identification of data subjects for no longer than necessary” [GDPR 2018 article 5, clause 1(e)]. In summary, data no longer required should be removed in accordance with Regulatory and Legal requirements.

6. Integrity and confidentiality

Requires processors to handle data “in a manner ensuring appropriate security of the personal data, including protection against unlawful processing or accidental loss, destruction or damage” [GDPR 2018 article 5, clause 1(f)].

Accountability

The GDPR introduces the principle of accountability which means that data controllers and data processors should maintain adequate records to be able to demonstrate compliance with the GDPR. For example, if a data controller or processor relies on consent as a lawful basis to process personal data it must maintain a record of consent.

People, Risks and Responsibilities

Policy scope

This policy applies to:

Head office
All staff
All contractors, suppliers and other people working on behalf the business
It applies to all data that we hold relating to identifiable individuals, even if that information is not expressly illustrated in the GDPR 2018. This can include:
Names of individuals
Postal addresses
Email addresses
Telephone numbers
…plus any other information relating to individuals

Data protection risks

This policy helps to protect the business from some very real data security risks, including:

Breaches of confidentiality. For instance, information being given out inappropriately, lost or stolen.
Failing to offer choice (where appropriate). For instance, all individuals should be free to choose how the company uses data relating to them.
Reputational damage. For instance, the business could suffer if hackers successfully gained access to sensitive data.

Responsibilities

Everyone who works for the business has some responsibility for ensuring personal data is collected, stored and handled appropriately.

Each team that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles. However, these people have key areas of responsibility:

The Board of Directors is ultimately responsible for ensuring that the business meets its legal obligations.
The Compliance Officer or Appointed Partner is responsible for:
- Keeping the board updated about data protection responsibilities, risks and issues.
- Reviewing all data protection procedures and related policies, in line with an agreed schedule.
- Monitor compliance with all data protection procedures and related policies.
- Arranging data protection training and advice for the people covered by this policy.
- Handling data protection questions from staff and anyone else covered by this policy.
- Dealing with requests from individuals to see the data the business holds about them (also called ‘subject access requests’).
- Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data or personal data to which the company is a data controller.
- Co-operate with the ICO (where appropriate).

The IT Manager or Appointed Partner is responsible for:
- Ensuring all systems, services and equipment used for storing data meet acceptable security standards.
- Performing regular checks and scans to ensure security hardware and software is functioning properly.
- Evaluating any third-party services the business is considering using to store or process data. For instance, cloud computing services.

The Marketing Manager or Appointed Partner is responsible for:
- Approving any data protection statements attached to communications such as emails and letters.
- Addressing any data protection queries from journalists or media outlets like newspapers.
- Where necessary, working with other staff to ensure marketing initiatives abide by data protection principles.

General staff guidelines

The only people able to access data covered by this policy should be those who need it for their work.
Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
The business will provide training to all employees to help them understand their responsibilities when handling data.
Employees should keep all data secure, by taking sensible precautions and following the guidelines below.
In particular, strong passwords must be used and they should never be shared.
Personal data should not be disclosed to unauthorised people, either within the company or externally.
Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
Employees should request help from their line manager if they are unsure about any aspect of data protection.

Data storage

These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT Partner or the Data Protection Controller.

When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it.

These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:

When not required, the paper or files should be kept in a locked drawer or filing cabinet.
Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
Data printouts should be shredded and disposed of securely when no longer required.

When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:
Data should be protected by strong passwords that are changed regularly and never shared between employees.
If data is stored on removable media (like a CD or DVD), these should be kept locked away securely when not being used.
Data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing services.
Servers containing personal data should be sited in a secure location, away from general office space.
Data should be backed up frequently. Those backups should be tested regularly, in line with the company’s standard backup procedures.
Data should never be saved directly to personal laptops or other mobile devices like tablets or smart phones. Personal data to which the company is a data controller should always be saved on the company’s network unless approval is granted by management.
All servers and computers containing data should be protected by approved security software and a firewall.

Data use

Personal data is of no value to the business unless we can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft:

When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.
Personal data should not be shared informally. In particular, it should never be sent by email, as this form of communication is not secure.
Data must be encrypted before being transferred electronically. The IT manager can explain how to send data to authorised external contacts.
Personal data should never be transferred outside of the European Economic Area unless appropriate safeguarding measures are in place.
Employees should not save copies of personal data to their own computers and mobile devices. Always access and update the central copy of any data.

Data accuracy

The law requires the business to take reasonable steps to ensure data is kept accurate and up to date.

It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.

Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.
Staff should take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.
The business will make it as easy as possible for data subjects to update the information it holds about them
Data should be updated immediately if errors are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed from the database.
It is the marketing manager’s responsibility (or other designated person) to ensure marketing databases are checked against industry and internal suppression files every six months.

All individuals who are the subject of personal data held by the business are entitled to the following rights:

Your rights under applicable data protection law.

Your rights are listed below as effective from May 2018:

The right to be informed about the processing of your personal data;
The right to have your personal data corrected if it is inaccurate and to have incomplete personal data completed;
The right to object to processing of your personal data;
The right to restrict processing of your personal data;
The right to have your personal data erased (subject to legal and regulatory requirements);
The right to request access to your personal data and information about how we process it;
The right to move, copy, or transfer your data free of charge (appropriate fees may be charged if excessive requests are made);
The right to not be subject to automated decision making; and
You have the right to complain to the Information Commissioner’s Office. It has enforcement powers and can investigate compliance with data protection law. Ico.org.uk

For more details about the above you can contact us by telephone 020 3637 0570 or by email admin@credit4.co.uk

If an individual contacts the business requesting action in respect of their legal rights, an acknowledgement must be sent by the Compliance Manager (or nominated person) within 3 working days and a full response must be provided within 28 days of the original request.

Individuals will not be charged for information requests/ actions under GDPR 2018 unless the business feels the requests are excessive when an applicable small charge may be levied for the data.

The Compliance Manager (or appropriate person) will always verify the identity of anyone making a subject access request before handing over any information.

Disclosing data for other reasons

In certain circumstances, the Data Protection Legislation allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.

Under these circumstances, the business will disclose requested data. However, the Data Protection Officer will ensure the request is legitimate, seeking assistance from the board and from the business’s legal advisers where necessary.

Providing information

The business will ensure that individuals are aware that their data is being processed, and that they understand:

How the data is being used
How to exercise their rights

To these ends, the business has a privacy policy, setting out how data relating to individuals is used by the company, which can be found using the following link: https://www.credit4.co.uk/privacy/

A printed copy of the Privacy Policy is available on request.

The major UK credit agencies have an agreement to share information ‘Credit Reference Agency Information Notice’ (CRAIN) and full details of this agreement can be found at https://www.equifax.co.uk/crain