Privacy Notice

Everyone has them, we’ve just made ours prettier than most. We encourage you to take your time and read through all the legalese.

Field Agent UK Privacy Policy

Last modified: 25th May 2018

Introduction

Field Agent UK understands that you are concerned about how your personal information is used and shared and we appreciate you trusting that we will be careful and sensible with your information. This notice describes the Privacy Policy applicable to Field Agent UK, its services, and our practices for collecting, using, maintaining, protecting and disclosing that information. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting the Field Agent UK Website (https://fieldagent.co.uk) and utilising the Field Agent mobile application (the “App”) and any other software or programs offered by Field Agent (collectively, the “Product”), you are accepting the practices described in this Privacy Policy.

For the purpose of the General Data Protection Regulation 2016/679 (the “GDPR”), the data controller is Field Agent UK Limited (Company No. 10756463) whose registered office is Second Floor, 77 Kingsway, London, WC2B 6SR.

We have appointed Luke Coady as our data protection manager and if you have any questions or concerns about the use of your personal data please email DPM@fieldagent.co.uk or write to us at Field Agent UK Limited, Second Floor, 77 Kingsway, London, WC2B 6SR.

1.What Personal Information About Users Does Field Agent Gather?

The information we learn from users helps us personalise and continually improve your experience with the Field Agent UK Website and such successor websites (collectively referred to as the “Site”), and the Product. Here are the types of information we gather.

Information you provide:

We receive and store any information you give us by filling out forms on the Field Agent UK Website, successor websites, by using the App or the Product or by corresponding with us by phone, email or in any other way.

You must provide us with your name and email address when you register to use the Field Agent Site, the App and/or the Product. You may also be required to provide other personal information before or after completion of work such as bank account details (where we need to make a payment to you), general demographic information, as well as certain other information, like your gender, birthday and Postcode.

You will also be asked optional questions regarding your family life e.g. how many children you have, your marital status and questions regarding your shopping habits. We do not usually ask you for details regarding your ethnicity or medical conditions unless that is a prerequisite for a particular survey.

We also receive and store information that you choose to share on the Field Agent Site, App and/or Product, such as your income and gender. We will receive other types of information about you when you provide photos or videos, such as the time, date, and place you took the photo or video. We additionally collect the information you provide to us in response to survey questions and specific demographic information.

You can choose not to provide certain information, however, as a result you might not be able to participate in all surveys provided in the App or Product. We use the information that you provide for ensuring that you receive information specific to you, responding to your requests, customising the Site for you, improving our Site, and communicating with you.

Information we collect about you:

We receive and store certain types of information whenever you interact with us. Like many websites, we use "cookies," and we obtain certain types of information when your Web browser accesses the Field Agent Site. This includes technical information such as the Internet protocol (IP) address used to connect your computer to the Internet, the type of mobile device you use, your log in information, browser type and version, time zone setting, operating systems and platform. You can instruct your browser, by editing its options, to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit.

We may also automatically collect certain information when you provide information to the App, such as your location/GPS coordinates (if you enable this feature) and a device identifier (including the UDID). You can enable or disable location services when you use the App at any time, through your mobile device settings. However, if you disable location services, you might not be able to participate in any or all surveys provided in the App since these are usually location specific. This location information is not treated as personal information unless we combine it with or link it to any of the personally identifiable information mentioned above.

Communications:

By registering on the Field Agent Site, App and/or Product, you will receive emails from Field Agent and/or its Affiliates. As a Field Agent Site, App and/or Product participant, it will be necessary for us to communicate with you to provide essential operational, status and transaction updates as well as notices in connection with your account and other information relevant to your participation and use of the Site, App and/or Product (collectively, Core Communications). You may not opt out of such Core Communications, and you agree to your receipt of Core Communications via email and/or other communication methods provided by you in your account registration. When you set up an account with us, we will ask for your consent to send you non-Core Communications such as newsletters and we will give you the opportunity to unsubscribe to them at any time.

As a Field Agent App participant, we may communicate with you with push notifications and other such notices in connection with your account and other information relevant to your participation and use of the App. You may opt out of such notifications by editing your mobile device settings.

2.What Does Field Agent do With the Personal Information It Receives?

Field Agent uses information held about you to comply with our contractual and legal obligations and to pursue our legitimate business interests. In particular, we use your information in the following ways:

Information you provide. We use this to:

Create and manage your account;

Process your transactions;

Perform research and analysis aimed at improving our services and technologies;

Notify you about changes to our service;and

Display content that is customised to your account.

Information we collect about you. We use this to:

Administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

Improve our Site, App and/or Product to ensure that content is presented in the most effective manner for you and for your computer/device;

Allow you to participate in interactive features of our service, when you choose to do so;

Help to keep our site safe and secure.

3.Does Field Agent Share the Personal Information It Receives?

Personal information about our users is an important part of our business, and we are not in the business of selling it to others. Except as set out in this privacy policy, Field Agent does not disclose or sell your personal information to any third parties.

You agree that we have the right to share your personal information with any member of our group (both inside and outside of Europe), which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

Participants:

We may share certain information in order to facilitate the service relationship outlined in the Participation Agreement or the Terms of Service and to improve the Site, App and Product.

Agents:

We employ other companies and individuals to perform functions on our behalf. Examples include analysing data, processing payments, and providing customer service. They have access to personal information needed to perform their functions but may not use it for other purposes.

Promotional Offers:

We may send offers to selected groups of Field Agent users on behalf of other businesses. When we do this, we do not give that business your personal information. If you do not want to participate in such offers you are not obliged to do so.

Business Transfers:

As we continue to develop our business, we might sell or buy additional services or business units. In such transactions, user information generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice (unless, of course, the user consents otherwise). Also, in the event that Field Agent or substantially all of its assets are acquired, user information will of course be one of the transferred assets.

Protection of Field Agent and Others:

We release account and other personal information when we believe release is appropriate to comply with the law; enforce or apply our Participation Agreement, Terms of Service and other agreements; or protect the rights, property, or safety of Field Agent, our users, or others. Obviously, however, this does not include selling, renting, sharing, or otherwise disclosing personally identifiable information from users for commercial purposes in violation of the commitments set forth in this Privacy Notice.

4.Your Rights

We endeavour to process all personal data in line with your rights under the GDPR. In particular, you have the rights to:-

Withdraw your consent to our processing your data at any time. You can do this at any time by changing your “preferences” when you log in to your account or by contacting us at Field Agent UK Limited, Second Floor, 77 Kingsway, London, WC2B 6SR or email DPM@fieldagent.co.uk

(a)In certain circumstances, we can process your personal data without your consent in line with the lawful processing requirements in GDPR. These include (amongst other reasons) where processing is necessary to comply with a legal obligation, or to protect your vital interests.

(b)Ask us to rectify inaccurate or incomplete personal data. We would seek to rectify the data as soon as possible and usually within one month unless the request is complex.

(c)Ask us to erase your personal data. This is commonly referred to as the right to be forgotten. This right is only applicable where there is no compelling reason for the continued processing of your personal data. There are some circumstances where this right to erasure does not apply and in such cases we would notify you of the reason(s) why we need to retain your personal data (unless prevented to do so by law).

(d)Restrict processing of your personal data where, for example, the data is inaccurate, being processed unlawfully or where the data is no longer relevant to the specific purpose for processing. In such cases, we would retain the data but we would not process it further without your consent, or if processing your data is for establishing, exercising or defending a legal claim, or for the protection of rights of other individuals, or for public interest reasons. In such circumstances, we would let you know that we intend to lift the restriction on processing your personal data.

(e)Request access to your personal data via a subject access request. Your request should be made to us in writing and we may ask you for proof of your identity before providing you with the data. There is usually no fee for making such a request however, in limited circumstances, we can charge an administrative fee (which will be based on the administrative cost of providing the information).

You have the right to ask us not to process your personal data for marketing purposes (including profiling). We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at [Second Floor, 77 Kingsway, London, WC2B 6SR. or DPO@fieldagent.co.uk

(f)Obtain and reuse your personal data for your own purposes across different services (right to data portability). This right is only applicable to data that you have provided to us, where we are processing the data based on your consent or for the performance of a contract and when the processing is carried out by automated means. Where this right applies, the data will be provided to you in a structured, commonly used and machine-readable format.

Closing your account

Separate to your rights under the GDPR, if you create an account with Field Agent, you can close your account by contacting us with a request that we delete your account and information. We will take steps to delete your personal information as soon as practical, but some information may remain in archived/backup copies for our records and as otherwise required by law.

We will not use your personal data marketing purposes, except with your express consent.

5.Participation Agreement, Notices and Revisions

If you choose to visit the Field Agent Site or use the App or Product, your visit and any dispute over privacy is subject to this Privacy Notice, our Participation Agreement and our Terms of Service, including limitations on damages, arbitration of disputes, and application of the laws of England and Wales. If you have any concern about privacy at Field Agent, please contact us with a thorough description, and we will try to resolve it.

Our business changes constantly, and our Privacy Notice, the Participation Agreement and Terms of Service will change also. We may e-mail periodic reminders of our notices and conditions, but you should check our Site frequently to see recent changes. Unless stated otherwise, our current Privacy Notice applies to all information that we have about you and your account. We stand behind the promises we make, however, and will never materially change our policies and practices to make them less protective of user information collected in the past without the consent of affected users.

6.How Secure Is Information About Me and Where is it being stored?

The data that we collect from you will be transferred to, and stored at, a destination outside the European Economic Area (EEA), in particular to the USA, where our holding company is based. It will be process by staff operating outside the EEA who work for us, one of our Group companies or our suppliers. These staff may be engaged in the fulfilment of your request, the processing of data collated via your participation in job provided by the App or Product, the processing of payment details and the provision of support services. By submitting your personal data you agree to this transfer, storing or processing. Field Agent will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

All information you provide to us is stored on our secure servers. We protect your information during transmission by using Secure Socket Layer (SSL) software, which encrypts information you input. Any payment transactions carried out by us or our chosen third-party provide of payment processing services will be encrypted using SSL software. However, the transmission of information via the internet is not completely secure and whilst we do try our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Site, the App or Product; any transmission is at your own risk.

It is important for you to protect against unauthorised access to your password and to your computer/device. Be sure to sign off when finished using a shared computer and avoid using unsecured internet connections. We are not responsible for circumvention of any privacy settings or security measures contained on the Field Agent Site, App and Product. It is your responsibility to protect the security of your login information, your computer/device and the internet connection that you use. Please help keep your account safe by using a strong password. The safety and security of your information also depends on you.

We will not keep your personal data for longer than is necessary for the purpose or purposes for which they were collected, unless there is another legal reason for us to retain the data. We will take all reasonable steps to destroy, or erase from our systems, all data which is no longer required. If you stop using your account we will delete your account 7 years after your last survey with us, however we may keep a record of your name and email address on our records.

7.Children

Our Field Agent Site, App and Product are not intended for children under 16 years of age and we do not knowingly collect personal information from children under 16. If we learn we have collected or received personal information from a child under 16, we will delete that information.

8.Changes to this Policy

Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

9. Contact and Complaints

If you have any questions, comments and requests regarding this privacy policy these should be addressed to our data protection officer by writing to Field Agent UK Limited, Second Floor, 77 Kingsway, London, WC2B 6SR. or DPM@fieldagent.co.uk

If you have any concerns about the processing of your personal data, we hope that you will contact us in the first instance however if you wish, you can raise your concerns directly with the Information Commissioner’s Office. For details on how to contact the ICO, please do to their website https://ico.org.uk/concerns/ or call 0303 123 1113

DATA PROTECTION POLICY

1.POLICY STATEMENT

1.1Everyone has rights with regard to the way in which their personal data is handled. During the course of our activities we will collect, store and process personal data about our customers, suppliers, field agents and other third parties, and we recognise that the correct and lawful treatment of this data will maintain confidence in the organisation and will provide for successful business operations.

1.2Staff are obliged to comply with this policy when processing personal data on our behalf. Any breach of this policy may result in disciplinary action.

2.ABOUT THIS POLICY

2.1The types of personal data that Field Agent UK Limited (We) may be required to handle include information about current, past and prospective suppliers, customers, field agents and others that we communicate with. The personal data, which may be held on paper or on a computer or other media, is subject to certain legal safeguards specified in the General Data Protection Regulation (GDPR), Directive 95/46/EC and other relevant legislation on data protection.

2.2This policy and any other documents referred to in it sets out the basis on which we will process any personal data we collect from data subjects, or that is provided to us by data subjects or other sources.

2.3This policy does not form part of any employee’s contract of employment and may be amended at any time.

2.4This policy sets out rules on data protection and the legal conditions that must be satisfied when we obtain, handle, process, transfer and store personal data.

2.5The data protection manager is responsible for ensuring compliance with relevant data protection legislation and with this policy. That post is held by Luke Coady, Field Agent UK Limited, Second Floor, 77 Kingsway, London, WC2B 6SR. or DPM@fieldagent.co.ukAny questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Data Protection robin@fieldagent.co.uk)

3.DEFINITIONS

3.1Data is information which is stored electronically, on a computer, or in certain paper-based filing systems.

3.2Data subjects for the purpose of this policy include all living individuals about whom we hold personal data. A data subject need not be a UK national or resident. All data subjects have legal rights in relation to their personal information. In particular, data subjects in the EU have rights under GDPR.

3.3Personal data means data relating to a living individual who can be identified from that data (or from that data and other information in our or another’s possession e.g. pseudonymisation). Personal data can be, for example, a name, address, date of birth, identification number, online identifier or it can be one or more factors specific to physical, physiological, genetic, mental economic cultural or social identity from which a person can be identified. It can also be an opinion about that person, their actions and behaviour.

3.4Data controllers are the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed. They are responsible for establishing practices and policies in line with relevant legislation. We are the data controller of all personal data used in our business for our own commercial purposes.

3.5Data processors include any person or organisation that processes personal data on our behalf and on our instructions. Employees of data controllers are excluded from this definition, but it could include suppliers which handle personal data on our behalf.

3.6Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alternation, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

3.7Processing is any activity that involves use of the data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including collecting, recording, organising, structuring, storing, amending, retrieving, adapting, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.

3.8Special Categories of personal data includes information about a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health or condition (including genetic or biometric data) or data concerning a person’s sex life or sexual orientation. These Special Categories of personal data can only be processed under strict conditions, including a condition requiring the express permission of the person concerned.

4.DATA PROTECTION PRINCIPLES

4.1Anyone processing personal data must comply with the six data protection principles contained in the GDPR. These provide that personal data must be:

(a)Processed lawfully, fairly and in a transparent manner (“lawfulness, fairness and transparency”).

(b)Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (“purpose limitation”).

(c)Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”).

(d)Accurate and, where necessary, kept up to date having regard to the purposes for which they are processed (“accuracy”)

(e)Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data was processed (“storage limitation”).

(f)Processed in a manner that ensures appropriate security of the personal data (“integrity and confidentiality”).

4.2In addition, data must be:

(a)Processed in line with data subjects’ rights.

(b)Not transferred to people or organisations situated in countries without adequate protection for personal data and associated rights.

5.LAWFULNESS, FAIRNESS AND TRANSPARENCY

5.1The law seeks to ensure that the processing of personal data is done fairly and without adversely affecting the rights of the data subject.

5.2For personal data to be processed lawfully, it must be processed on the basis of one or more of the legal grounds set out in the GDPR. These are:-

(a)Where the data subject has given consent to the processing of his or her personal data for one or more specific purpose. The consent must be specific to the purpose for which we are processing the data so several consents may be required from a data subject. When processing personal data of a data subject that is a child, parental consent may need to be obtained where there is not another lawful reason for processing. We do not process personal data relating to children (Under 16 ) in the course of our business.

(b)Where processing is necessary for entering into or performance of a contract with the data subject.

(c)Where processing is necessary for the compliance with a legal obligation to which we are subject.

(d)Where processing is necessary to protect the vital interests of the data subject or another person.

(e)Where processing is necessary for the performance of a task carried out in the public interest.

(f)Where processing is necessary for the legitimate interest of the company or the party to whom the data is disclosed (except where such interests are overridden by the interests or fundamental rights of the data subject).

(g)When the data that is being processed falls within the Special Categories of personal data, or is personal data relating to criminal convictions and offences or related security measures, additional conditions must be met, for example, the consent requirements are more stringent and explicit consent to processing of such data for specified purposes must be obtained unless there is another lawful reason for processing. When processing personal data as data controllers in the course of our business, we will ensure that these requirements are met.

5.3If we collect personal data directly from data subjects, we will inform them about:

(a)The purpose or purposes for which we intend to process that personal data.

(b)The types of third parties, if any, with which we will share or to which we will disclose that personal data.

(c)The means, if any, with which data subjects can limit our use and disclosure of their personal data, including their rights to withdraw consent, rectify and move their personal data.

5.4We may receive personal data about a data subject from other sources. We will provide this information to the data subject within a reasonable time, and within one month of us obtaining this data, having regard to the circumstances in which the data is processed and as required under GDPR.

5.5We will also inform data subjects whose personal data we process that we are the data controller with regard to that data.

6.PURPOSE LIMITATION

6.1In the course of our business, we may collect and process the personal data set out in the Schedule. This may include data we receive directly from a data subject (for example, by completing forms or by corresponding with us by mail, phone, email or otherwise) and data we receive from other sources (including, for example, business partners, sub-contractors in technical, payment and delivery services, credit reference agencies and others).

6.2We will only process personal data for the specific purposes set out in the Scheduleor for any other purposes specifically permitted by GDPR and relevant legislation, for example we may process data for a further purpose where it is not incompatible with the original purpose for processing.

7.DATA MINIMISATION

We will only process personal data to the extent that it is adequate, relevant and required for the specific purpose notified to the data subject.

8.ACCURACY

We will ensure that personal data we hold is accurate and kept up to date. We will check the accuracy of any personal data at the point of collection and at regular intervals afterwards. We will take all reasonable steps to destroy or amend inaccurate or out-of-date data.

9.STORAGE LIMITATION

We will not keep personal data longer than is necessary for the purpose or purposes for which they were collected, unless there is another legal reason for us to retain the data. We will take all reasonable steps to destroy, or erase from our systems, all data which is no longer required. It is not possible to specify the retention period for every category of data we process, but we do adopt the following periods:

(a)Personal data concerning our employees will be retained throughout their employment and for a period of 7 years after their employment has ended, unless there is special reason for further retention;

(b)Personal data concerning applicants for employment will be retained for one year after an unsuccessful application, unless there is special reason for further retention;

(c)Customer data will be retained for 7 years after the end of a contract, unless there is special reason for further retention;

(d)Marketing data will be retained for 7 years after the last communication, unless there is special reason for further retention

(e)Website traffic data will be retained for 7 years after the last communication, unless there is special reason for further retention

(f)Personal data on “Agents” and Contractors will be retained for up to 7 years, unless there is special reason for further retention.

10.INTEGRITY AND CONFIDENTIALITY – DATA SECURITY

10.1We will take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

10.2We will put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data will only be transferred to a data processor where there is a written contract between us and the data processor under which the processor agrees to comply with our procedures and policies, or if he puts in place adequate measures himself.

10.3We will maintain data security by protecting the confidentiality, integrity and availability of the personal data, defined as follows:

(a)Confidentiality means that only people who are authorised to use the data can access it.

(b)Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.

(c)Availability means that authorised users should be able to access the data if they need it for authorised purposes. Personal data should therefore be stored on the Field Agent UK’s central computer system instead of individual PCs.

10.4Security procedures include:

(a)Entry controls. Any stranger seen in entry-controlled areas should be reported.

(b)Secure lockable desks and cupboards. Desks and cupboards should be kept locked if they hold confidential information of any kind. (Personal information is always considered confidential.)

(c)Methods of disposal. Paper documents should be shredded. Digital storage devices should be physically destroyed when they are no longer required.

(d)Equipment. Data users must ensure that individual monitors do not show confidential information to passers-by and that they log off from their PC when it is left unattended.

11.PROCESSING IN LINE WITH DATA SUBJECT’S RIGHTS

11.1We will process all personal data in line with data subjects’ rights, in particular their right to:

(a)Rectification of inaccurate or incomplete personal data. We would seek to rectify the information as soon as possible and usually within one month unless the request is complex.

(b)Be forgotten where there is no compelling reason for the continued processing of personal data. There are some circumstances where this right to erasure does not apply and in such cases we would notify to the data subject the reason(s) why we need to retain personal data (unless prevented to do so by law).

(c)Restrict processing where, for example, the data is inaccurate, being processed unlawfully or where the data is no longer relevant to the specific purpose for processing.

(d)Request access to any data held about them by a data controller (via a subject access request).

(e)Object to the processing of their personal data for direct-marketing purposes, including profiling.

(f)Obtain and reuse their personal data for their own purposes across different services (right to data portability). This right is only applicable to data provided to the company by the data subject where the processing is based on consent or the performance of a contract and when processing is carried out by automated means. Where this right applies, the data will be provided to the data subject in a structured, commonly used and machine-readable format.

11.2Unless necessary for entering into or performance of a contract with the data subject, or authorised by law we will not, without the data subject’s prior consent, base decisions solely on automated processing (including profiling) where such processing produces legal effects concerning a data subject or similarly significantly effects the data subject. In any event, we will not use automated decision making for decisions concerning children. Where the data processed falls within the Special Categories of personal data we will not use automated decision making without the data subject’s explicit consent unless the processing is necessary for reasons of substantial public interest.

12.TRANSFERRING PERSONAL DATA TO A COUNTRY OUTSIDE THE EEA

12.1We may transfer any personal data we hold to a country outside the European Economic Area (”EEA”), provided that one of the following conditions applies:

(a)The country to which the personal data are transferred ensures an adequate level of protection for the data subjects’ rights and freedoms.

(b)The data subject has given his consent.

(c)The transfer is necessary for one of the reasons set out in the GDPR or other relevant legislation, including the performance of a contract between us and the data subject, or to protect the vital interests of the data subject.

(d)The transfer is legally required on important public interest grounds or for the establishment, exercise or defence of legal claims.

(e)The transfer is authorised by the relevant data protection authority where we have adduced adequate safeguards with respect to the protection of the data subjects’ privacy, their fundamental rights and freedoms, and the exercise of their rights.

12.2Subject to the requirements in paragraph 12.1 above, personal data we hold may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. That staff may be engaged in, among other things, the fulfilment of contracts with the data subject, the processing of payment details and the provision of support services.

13.DISCLOSURE AND SHARING OF PERSONAL INFORMATION

13.1We may share personal data we hold with any member of our group (inside or outside of Europe), which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

13.2We may also disclose personal data we hold to third parties:

(a)In the event that we sell or buy any business or assets, in which case we may disclose personal data we hold to the prospective seller or buyer of such business or assets.

(b)If we or substantially all of our assets are acquired by a third party, in which case personal data we hold will be one of the transferred assets.

13.3If we are under a duty to disclose or share a data subject’s personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the data subject or other agreements; or to protect our rights, property, or safety of our employees, customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

14.DEALING WITH SUBJECT ACCESS REQUESTS

14.1Data subjects must make a formal request for information we hold about them. This must be made in writing. Employees who receive a written request should forward it to their line manager and the data protection manager immediately.

14.2When receiving telephone enquiries, we will only disclose personal data we hold on our systems if the following conditions are met:

(a)We will check the caller’s identity to make sure that information is only given to a person who is entitled to it.

(b)We will suggest that the caller put their request in writing if we are not sure about the caller’s identity and where their identity cannot be checked.

14.3Our employees will refer a request to their line manager or the data protection manager for assistance in difficult situations. Employees should not be bullied into disclosing personal information.

14.4There is usually no fee for making a subject access request, however where a request is manifestly unfounded or excessive or repetitive we may charge an reasonable fee to cover the administrative cost of providing the information. We will respond to any request in a proportionate manner.

15.NOTIFICATION OF DATA SECURITY BREACHES

15.1Where a personal data breach that is likely to result in a risk to the rights and freedoms of a person or persons, we will notify both the data subject and the Information Commissioner’s Office (or other relevant supervisory authority) of the breach in accordance with the reporting requirements in GDPR. This means that such breaches will be reported without undue delay and, where feasible, within 72 hours of us becoming aware of a breach.

15.2A data user that becomes aware of a breach should immediately notify his line manager and the Data Protection Manager.

16.CHANGES TO THIS POLICY

We reserve the right to change this policy at any time. Where appropriate, we will notify affected data subjects of those changes by mail or email.