Data Protection Policy & Procedure

(1)

Page | 1 Proconnect Marketing Data Protection Policy V1.2

Data Protection Policy &

Marketing Data Protection Policy V1.2

Data Protection Policy &

Procedure

(2)

Data protection policy

Context and overview

Key details

• Policy prepared by: Adam Haycock • Approved by board / management on: • Policy became operational on:

• Next review date: 01/01/2016

Introduction

Proconnect Marketing needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people th organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards

Why this policy exists

This data protection policy ensures Proconnect Marketing:

• Complies with data protection law and follow good practice • Protects the rights of staff, customers and partners

• Is open about how it stores and processes individuals’ data • Protects itself from the risks of

Data protection law

The Data Protection Act 1998 describes how organisations

Marketing— must collect, handle and store personal information.

These rules apply regardless of whether data is stored electronically, on pap materials.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The Data Protection Act is underpinned by eight important principles. These say that personal data must:

Data protection policy

Context and overview

Adam Haycock

Approved by board / management on: 01/01/2015 Policy became operational on: 01/01/2015

01/01/2016

Proconnect Marketing needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people th organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards — and to comply with the law.

Why this policy exists

protection policy ensures Proconnect Marketing:

Complies with data protection law and follow good practice Protects the rights of staff, customers and partners

Is open about how it stores and processes individuals’ data Protects itself from the risks of a data breach

Data protection law

The Data Protection Act 1998 describes how organisations — including Proconnect must collect, handle and store personal information.

These rules apply regardless of whether data is stored electronically, on pap

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The Data Protection Act is underpinned by eight important principles. These say that Proconnect Marketing needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people the This policy describes how this personal data must be collected, handled and stored to meet

including Proconnect

These rules apply regardless of whether data is stored electronically, on paper or on other To comply with the law, personal information must be collected and used fairly, stored The Data Protection Act is underpinned by eight important principles. These say that

(3)

1. Be processed fairly and lawfully

2. Be obtained only for specific, lawful purposes 3. Be adequate, relevant and not excessive 4. Be accurate and kept up to date

5. Not be held for any longer than necessary

6. Processed in accordance with the rights of data subjects 7. Be protected in appropriate ways

8. Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection

People, risks and responsibilities

Policy scope

This policy applies to:

• The head office of Proconnect Marketing • All branches of Proconnect Marketing • All staff and volunteers of

• All contractors, suppliers and other people working on behalf of Proconnect

Marketing

It applies to all data that the company hold

information technically falls outside of the Data Protection Act 1998. This can include:

• Names of individuals • Postal addresses • Email addresses • Telephone numbers

• …plus any other information relating to in

Data protection risks

This policy helps to protect Proconnect Marketing including:

• Breaches of confidentiality.

inappropriately.

• Failing to offer choice.

company uses data relating to them.

• Reputational damage.

gained access to sensitive data.

Responsibilities

Be processed fairly and lawfully

Be obtained only for specific, lawful purposes Be adequate, relevant and not excessive Be accurate and kept up to date

Not be held for any longer than necessary

Processed in accordance with the rights of data subjects otected in appropriate ways

Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection

People, risks and responsibilities

Proconnect Marketing Proconnect Marketing

All staff and volunteers of Proconnect Marketing

All contractors, suppliers and other people working on behalf of Proconnect

It applies to all data that the company holds relating to identifiable individuals, even if that information technically falls outside of the Data Protection Act 1998. This can include:

plus any other information relating to individuals

Data protection risks

Proconnect Marketing from some very real data security risks, Breaches of confidentiality. For instance, information being given out

Failing to offer choice. For instance, all individuals should be free to choose how the company uses data relating to them.

Reputational damage. For instance, the company could suffer if hackers successfully gained access to sensitive data.

Not be transferred outside the European Economic Area (EEA), unless that country

All contractors, suppliers and other people working on behalf of Proconnect

s relating to identifiable individuals, even if that information technically falls outside of the Data Protection Act 1998. This can include:

from some very real data security risks, For instance, information being given out

nce, all individuals should be free to choose how the For instance, the company could suffer if hackers successfully

(4)

Everyone who works for or with

data is collected, stored and handled appropriately.

Each team that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles.

However, these people have key areas of responsibility:

• The board of directors

Marketing meets its legal obligations.

• The Data Protection Officer o Keeping the board updated

issues.

o Reviewing all data protection procedures and related policies, in line with an

agreed schedule.

o Arranging data protection training and advice for the people covered by this

policy.

o Handling data pr

this policy.

o Dealing with requests from individuals to see the data

holds about them (also called ‘subject access requests’).

o Checking and approving any contracts or agreements w

may handle the company’s sensitive data.

• The IT manager, Adam Haycock

o Ensuring all systems, services and equipment used for storing data meet

acceptable security standards.

o Performing regular checks and scans to

software is functioning properly.

o Evaluating any third

or process data. For instance, cloud computing services.

• The Marketing Manager

o Approving any data protection statements attached to communications such

as emails and letters.

o Addressing any data protection queries from journalists or media outlets like

newspapers.

o Where necessary, working with other staff to ensure marketing initiativ

abide by data protection principles.

General staff guidelines

Everyone who works for or with Proconnect Marketing has some responsibility for ensuring data is collected, stored and handled appropriately.

Each team that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles.

r, these people have key areas of responsibility:

board of directors is ultimately responsible for ensuring that Proconnect meets its legal obligations.

Officer, Barry Raymond, is responsible for:

Keeping the board updated about data protection responsibilities, risks and Reviewing all data protection procedures and related policies, in line with an agreed schedule.

Arranging data protection training and advice for the people covered by this Handling data protection questions from staff and anyone else covered by Dealing with requests from individuals to see the data Proconnect Marketing holds about them (also called ‘subject access requests’).

Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data.

Adam Haycock, is responsible for:

Ensuring all systems, services and equipment used for storing data meet acceptable security standards.

Performing regular checks and scans to ensure security hardware and software is functioning properly.

Evaluating any third-party services the company is considering using to store or process data. For instance, cloud computing services.

Marketing Manager, Adam Haycock, is responsible for:

pproving any data protection statements attached to communications such as emails and letters.

Addressing any data protection queries from journalists or media outlets like Where necessary, working with other staff to ensure marketing initiativ abide by data protection principles.

General staff guidelines

has some responsibility for ensuring Each team that handles personal data must ensure that it is handled and processed in line

Proconnect about data protection responsibilities, risks and Reviewing all data protection procedures and related policies, in line with an Arranging data protection training and advice for the people covered by this

otection questions from staff and anyone else covered by Proconnect Marketing

ith third parties that Ensuring all systems, services and equipment used for storing data meet

ensure security hardware and party services the company is considering using to store pproving any data protection statements attached to communications such Addressing any data protection queries from journalists or media outlets like Where necessary, working with other staff to ensure marketing initiatives

(5)

• The only people able to access data covered by this policy should be those who

it for their work.

• Data should not be shared informally

required, employees can request it from their line managers.

• Proconnect Marketing

understand their responsibilities when handling data.

• Employees should keep all data secure, by taking sensible

the guidelines below.

• In particular, strong passwords must be used • Personal data should not be disclosed

company or externally.

• Data should be regularly re

longer required, it should be deleted and disposed of.

• Employees should request help

officer if they are unsure about any aspect of data protection.

Data storage

These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT manager or data controller.

When data is stored on paper, people cannot see it.

These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:

• When not required, the paper or files should be kept

cabinet.

• Employees should make sure pa

people could see them

• Data printouts and paperwork

no longer required.

When data is stored electronically

accidental deletion and malicious hacking attempts:

The only people able to access data covered by this policy should be those who should not be shared informally. When access to confidential information is required, employees can request it from their line managers.

Proconnect Marketing will provide training to all employees to help them understand their responsibilities when handling data.

Employees should keep all data secure, by taking sensible precautions and following strong passwords must be used and they should never be shared.

should not be disclosed to unauthorised people, either within the company or externally.

regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.

should request help from their line manager or the data protection officer if they are unsure about any aspect of data protection.

These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT manager or data controller.

stored on paper, it should be kept in a secure place where unauthorised These guidelines also apply to data that is usually stored electronically but has been printed

When not required, the paper or files should be kept in a locked drawer or filing Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.

and paperwork should be shredded and disposed of securely when stored electronically, it must be protected from unauthorised access,

accidental deletion and malicious hacking attempts:

The only people able to access data covered by this policy should be those who need . When access to confidential information is

to all employees to help them

precautions and following and they should never be shared. to unauthorised people, either within the

if it is found to be out of date. If no from their line manager or the data protection

These rules describe how and where data should be safely stored. Questions about storing it should be kept in a secure place where unauthorised These guidelines also apply to data that is usually stored electronically but has been printed

in a locked drawer or filing not left where unauthorised and disposed of securely when

(6)

Page | 6 Proconnect Marketing Data Protection Policy V1.2 • Data should be protected by strong passwords

shared between employees.

• If data is stored on removable media

away securely when not being used.

• Data should only be stored on

uploaded to an approved cloud computing services

• Servers containing personal data should be

general office space.

• Data should be backed up frequently

line with the company’s standard backup procedures.

• Data should never be saved directly

or smart phones.

• All servers and computers containing data should be protected by

software and a firewall

Data use

Personal data is of no value to

However, it is when personal data is accessed loss, corruption or theft:

• When working with personal data, employees should ensure

computers are always locked

• Personal data should not be shared informally

by email, as this form of communication is not secure.

• Data must be encrypted before being transferred electronically

explain how to send data to authorised external contacts.

• Personal data should never

• Employees should not save copies of personal data to their own computers.

access and update the central copy of any data.

Data accuracy

The law requires Proconnect Marketing accurate and up to date.

protected by strong passwords that are changed regularly and never shared between employees.

stored on removable media (like a CD or DVD), these should be kept l away securely when not being used.

Data should only be stored on designated drives and servers, and should only be approved cloud computing services.

Servers containing personal data should be sited in a secure location

backed up frequently. Those backups should be tested regularly, in line with the company’s standard backup procedures.

never be saved directly to laptops or other mobile devices like tablets All servers and computers containing data should be protected by

software and a firewall.

Personal data is of no value to Proconnect Marketing unless the business can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of

When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.

should not be shared informally. In particular, it should never be sent by email, as this form of communication is not secure.

encrypted before being transferred electronically. The IT manager can explain how to send data to authorised external contacts.

never be transferred outside of the European Economic Area should not save copies of personal data to their own computers. access and update the central copy of any data.

Proconnect Marketing to take reasonable steps to ensure data is kept that are changed regularly and never (like a CD or DVD), these should be kept locked

, and should only be sited in a secure location, away from . Those backups should be tested regularly, in to laptops or other mobile devices like tablets All servers and computers containing data should be protected by approved security

unless the business can make use of it. and used that it can be at the greatest risk of

the screens of their rticular, it should never be sent

. The IT manager can be transferred outside of the European Economic Area. should not save copies of personal data to their own computers. Always

(7)

The more important it is that the personal data is accurate, the greater the effort Proconnect Marketing should put into ensuring its accuracy.

It is the responsibility of all employees who work with da ensure it is kept as accurate and up to date as possible.

• Data will be held in as few places as necessary

unnecessary additional data sets.

• Staff should take every opportunity to ensure data is u

confirming a customer’s details when they call.

• Proconnect Marketing

Proconnect Marketing

• Data should be updated

can no longer be reached on their stored telephone number, it should be removed from the database.

• It is the marketing manager’s responsibility to ensure

checked against industry suppression files

Subject access requests

All individuals who are the subject of personal data held by entitled to:

• Ask what information • Ask how to gain access

• Be informed how to keep it up to date. • Be informed how the company is

If an individual contacts the company requesting this information, this is called a subject access request.

Subject access requests from indivi

controller at [email protected]

request form, although individuals do not have to use this. Individuals will be charged £10 per subject access requ provide the relevant data within 14 days.

The data controller will always verify the identity of anyone making a subject access request before handing over any information.

The more important it is that the personal data is accurate, the greater the effort should put into ensuring its accuracy.

It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.

as few places as necessary. Staff should not create any unnecessary additional data sets.

take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.

Proconnect Marketing will make it easy for data subjects to update the information Proconnect Marketing holds about them. For instance, via the company website.

updated as inaccuracies are discovered. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed It is the marketing manager’s responsibility to ensure marketing databases are

ndustry suppression files every 28 days.

Subject access requests

All individuals who are the subject of personal data held by Proconnect Marketing what information the company holds about them and why.

how to gain access to it.

how to keep it up to date.

Be informed how the company is meeting its data protection obligations

If an individual contacts the company requesting this information, this is called a subject Subject access requests from individuals should be made by email, addressed to the data

[email protected]. The data controller can supply a standard request form, although individuals do not have to use this.

Individuals will be charged £10 per subject access request. The data controller will aim to provide the relevant data within 14 days.

The data controller will always verify the identity of anyone making a subject access request before handing over any information.

The more important it is that the personal data is accurate, the greater the effort ta to take reasonable steps to . Staff should not create any

For instance, by easy for data subjects to update the information holds about them. For instance, via the company website.

. For instance, if a customer can no longer be reached on their stored telephone number, it should be removed

marketing databases are

Proconnect Marketing are

meeting its data protection obligations. If an individual contacts the company requesting this information, this is called a subject

duals should be made by email, addressed to the data . The data controller can supply a standard

est. The data controller will aim to The data controller will always verify the identity of anyone making a subject access request

(8)

Disclosing data for other reasons

In certain circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.

Under these circumstances, Proconnect Marketing

the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

Providing information

Proconnect Marketing aims to ensure that individuals are aware that their data is being processed, and that they understand:

• How the data is being used • How to exercise their rights

To these ends, the company has a privacy statement, setting out how data relating to individuals is used by the company.

Disclosing data for other reasons

circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.

Proconnect Marketing will disclose requested data. However, l ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

Providing information

aims to ensure that individuals are aware that their data is being they understand:

How the data is being used How to exercise their rights

To these ends, the company has a privacy statement, setting out how data relating to individuals is used by the company.

circumstances, the Data Protection Act allows personal data to be disclosed to law will disclose requested data. However, l ensure the request is legitimate, seeking assistance from the board

aims to ensure that individuals are aware that their data is being