Wupwoo Ltd Data Protection Policy

Introduction

Wupwoo Ltd needs to collect personal data from our staff, customers and suppliers, in order to carry out its business and provide its services. This information includes name, address, email address, date of birth, private and confidential information. No matter how it is collected, recorded and used (e.g. on a computer or other digital media, on hardcopy, paper or images, including CCTV) this personal information must be dealt with properly to ensure compliance with European General Data Protection Regulation (GDPR). The lawful and proper treatment of personal information by Wupwoo Ltd is extremely important to the success of our business and in order to maintain the confidence of our service users and employees. Wupwoo Ltd must ensure that it processes personal information lawfully and correctly.

Related Legislation

• EU General Data Protection Regulation (GDPR)
• Freedom of Information Act 2000
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Computer Misuse Act 1990

The General Data Protection Regulations Principles

Personal data shall be:

• Data processed lawfully, fairly and transparently.
• Collected for specific legitimate purposes.
• Adequate, relevant and limited to what is necessary.
• Must be accurate and up to date.
• Stored for as long as necessary.
• Ensure appropriate security, integrity and confidentiality.

Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Lawful Basis for Processing Personal Data

• Consent: Individual has given clear consent for the processing of their personal data for a specific purpose.
• Contract: The processing is necessary for entering into a contract with that person.
• Legal Obligation: The processing is necessary to comply with the law.
• Vital Interest: The processing is necessary to protect someone’s life.
• Public Task: The processing is necessary to perform a task of public interest.
• Legitimate interest: The processing is necessary for your legitimate interest, providing it doesn’t override the interest of the individual.

The Act’s definition of “personal data” covers any data that can be used to identify a living individual. Anonymised or aggregated data is not regulated by the Act, providing the anonymisation or aggregation has not been done in a reversible way. Individuals can be identified by various means including their name and address, telephone number or email address. The Act defines special categories of personal data as sensitive personal information:

• Race or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Health data
• Sexual history and/or sexual orientation
• Criminal data

Wupwoo Ltd and all its staff who process or use personal information must ensure that they follow these principles at all times. In order to ensure that this happens, Wupwoo Ltd has developed this Data Protection Policy.

Status of the Policy

This policy has been approved by the Wupwoo Ltd Board of Directors and any breach will be taken seriously and may result in more formal action. Any member of staff, customer or supplier who considers that the policy has not been followed in respect of personal data about themselves should raise the matter with their line Manager or the Data Protection Officer in the first instance.

All staff, customers and suppliers and other users are entitled to:

• Ask what information Wupwoo Ltd holds about them and why.
• Ask how to gain access to it.
• Right To Be Forgotten: Remove or erase all data from data controller
• Right To Data Portability: Individual may obtain and reuse their own data.

As part of our responsibilities we must comply with this Policy and with all relevant Legislation. All employees will adhere to this policy and make data security an integral part of their activities insofar as to build the tenets of this policy into any activity that the company is engaged with.

• Observe all forms of guidance, codes of practice and procedures about the collection and use of personal information.
• Understand fully the purposes for which Wupwoo Ltd uses personal information.
• Collect and process appropriate information, and only in accordance with the purposes for which it is to be used by Wupwoo Ltd to meet its needs or legal requirements.
• Ensure the information is destroyed (in accordance with the provisions of the Act) when it is no longer required.
• Not send any personal information outside of the United Kingdom.
• Understand that breaches of this Policy may result in disciplinary action, up to and including dismissal.
• On receipt of a request by or on behalf of an individual for information held about them, or any other data subjects rights in relation to their personal data, staff will immediately notify their line manager.

Data Security

The need to ensure that data is kept securely means that precautions must be taken against physical loss or damage, and that both access and disclosure must be restricted. Wupwoo Ltd and all of its Employees are responsible for ensuring that:

• Any personal data that is held is kept securely. All data that is held by Wupwoo is electronically stored on a secure server and or has an SSL certificate.
• Personal information is not disclosed either orally or in writing or otherwise to any unauthorised third party.
• Any personal data that is held as documentation is kept at any location that Wupwoo Ltd operate from. The documentation is secured when not in use. Wupwoo Ltd are working towards becoming paperless, where all data is held electronically.
• Provide training for all staff members who handle personal information.
• Develop and maintain Data Protection procedures to include: roles and responsibilities and training.
• Ensure the organisation complies with its transparency and fair processing obligations in relation to data subjects’ personal data.

Data Breach

• The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. Should this occur, then Wupwoo Ltd will do this within 72 hours of becoming aware of the breach, where feasible.
• If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, Wupwoo Ltd will inform those individuals without undue delay.
• Wupwoo Ltd will keep a record of any personal data breaches, regardless of whether it is notifiable.

Should a data breach be identified then we have a statutory obligation to inform the Information Commissioner’s Office  (Tel: 0303 123 1113, Website: https://ico.org.uk/).

What information will we need to provide?

• What has happened.
• When and how you found out about the breach.
• The people that have been or may be affected by the breach.
• What you are doing as a result of the breach.
• Who should we contact if we need more information and who else you have told.

Rights to Access Information

People have the right to access any personal data that is being kept about them on computer and also have access to paper-based data held in certain manual filing systems. Any person who wishes to exercise this right should make the request in writing to the Wupwoo Data Protection Officer. Wupwoo Ltd will make a charge of £15 on each occasion that access is requested.

Wupwoo Ltd aims to comply with requests for access to personal information as quickly as possible, but will ensure that it is provided within 40 days of receipt of a written request unless there is good reason for delay. In such cases, the reason for delay will be explained in writing to the individual making the request.

Wupwoo Ltd Designated Data Officer

Name: Peter Martin

Wupwoo Ltd is the data controller under the Act and is therefore ultimately responsible. Any questions or concerns about the interpretation or operation of this policy should be taken up in the first instance with the Company Data Controller.

Wupwoo Ltd is registered with the I.C.O Registration Number ZA141612         

Company Registration ( England and Wales) 7865444    

Registered office: 15 Queen Square, LS2 8AJ.

Wupwoo For A Better U

Version 2

Review. March 2020