OFF THE RAILS YARMOUTH LIMITED

DATA PROTECTION PRIVACY NOTICE

Purpose

This Notice outlines the data protection policies and procedures we have adopted and to which we abide to ensure we are GDPR compliant.  The purpose of this Notice and any other documents referred to in it, is to clearly list and identify the legal requirements, procedures and rights which must be established when we obtain, process, transfer and/or store your personal data. This Notice will assist you in understanding the obligations, responsibilities and rights which arise from the Data Protection Laws.

Introduction

Everyone has rights with regard to the way in which their personal data is handled. In order to operate efficiently we need to collate and use information about the people with whom we work. This includes current, past and prospective employees, clients, and others with whom we communicate. 

We regard the lawful and correct treatment of personal information as integral to successful operation and to maintaining the confidence of the people we work and communicate with. To this end we fully endorse and adhere to the principles of the relevant Laws.

We are registered as a Data Controller on the Register kept by the Information Commissioner’s Office.

Definitions in this Privacy Notice

Data:                     Information stored electronically, on a computer, server or in certain paper-based filing systems.

Data:

Controller:          Off the Rails Yarmouth Limited have determined the purposes for which, and the manner in which, your Personal Data is processed. The Data Controller has overall responsibility for compliance with the Data Protection Laws.  Any questions about the operation of this Notice or any concerns that the Notice has not been followed should be referred in the first instance to Philippe Blot at Off The Rails Yarmouth Limited, Station Road, Yarmouth Isle of Wight , PO41 0QT

Privacy

Manager:             Philippe Blot is the appointed officer who is responsible for awareness-raising, training staff and informing and advising the Data Controller, Data Processors and Data Users how to ensure compliance with the enactments, and to monitor that compliance. Philippe Blot can be contacted at Off The Rails Yarmouth Limited, Station Road, Yarmouth Isle of Wight , PO41 0QT

Data 

Processor:           Any person or organisation that is not a Data User that processes personal data on our behalf and in accordance with our specific instructions. Our staff will be excluded from this definition but, the definition could include suppliers who handle personal data on our behalf.

Data 

Subjects:              All living individuals about whom we hold Personal Data. All Data Subjects have legal rights concerning the processing and storage of their personal information.

Data users:          Our employees whose work involves processing your Personal Data. Data users are responsible for the proper use of the data they process and must protect the data they handle in accordance with this Notice.

Enactments:       The Data Protection Act 1998 (the Act) up to and until 25 May 2018 after which The General Data Protection Regulations 2017 (GDPR) will apply, both of which regulate the way in which all Personal Data is held and processed.

Personal 

Data:                     Information which can be used to directly or indirectly identify a living individual.

Processing:          Any activity in which the data is used, including (but not limited to) obtaining, recording, organising, amending, retrieving, using, disclosing, erasing, destroying and/or holding the data. The term “processing” also includes transferring personal data to third parties.

Supervisor:

Authority:           The Authorised Body which is empowered to govern and manage how the GDPR is implemented and abided by in a particular EU state.  In the case of the UK the Supervisory Authority is the: Information Commissioner’s Office. 

Sensitive Personal

Data:                    

This includes information about a person's race, ethnicity, political opinions, convictions, religion, trade union membership, physical and/or mental health, and sexual preference. Sensitive personal data can only be processed with the express written consent of the person concerned.