Lewis & Godsil Ltd. T/A Planmydebs needs to gather and use certain information about individuals in order to provide services to them. These can include customer names, date of birth, addresses, telephone numbers. This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards — and to comply with the law. Lewis & Godsil Limited endeavours to provide best practice in data storage and handling in line with EU General Data Protection Regulation (EU) 2016/679 (‘GDPR’) and ePrivacy Regulations 2011.
This policy applies to:
- The head office of Lewis &Godsil Limited
- All staff and volunteers of Lewis & Godsil Limited
- All contractors, suppliers and other people working on behalf Lewis & Godsil Limited
It applies to all data that the company holds relating to identifiable individuals. This can include:
- Names of individuals
- Date of Birth
- Postal addresses
- Email addresses
- Telephone numbers
- Any other information relating to individuals
What is the policy intended to achieve?
The objectives may include the following:
- To ensure that Lewis&Godsil Limited complies with GDPR.
- To ensure compliance with the principles of data protection as set down by the Data Protection Commissioner.
- To ensure that the data protection rights of customers are safeguarded.
The policy sets down the arrangements in place to ensure that all personal data records held by Lewis & Godsil Limited are obtained, processed, used and retained in accordance with the following six principles of data protection:
- Process data lawfully, fairly and Transparently
- Keep for one specified, explicit and legitimate purposes
- Keep it safe and secure
- Keep it accurate, complete and up-to-date
- Ensure that it is adequate, relevant and limited to what is necessary
- Keep in a form that the data subject can be identified only as long as necessary
Everyone who works for or with Lewis & Godsil Limited has some responsibility for ensuring data is collected, stored and handled appropriately. However, these people have key areas of responsibility:
- The Board of Directors
The board of directors is ultimately responsible for ensuring that Lewis&Godsil Limited meets its legal obligations.
- The Compliance and Data Protection Officer
- Keeping the board updated about data protection responsibilities, risks and issue
- Reviewing all data protection procedures and related policies, in line with an agreed schedul
- Arranging data protection training and advice for the people covered by this policy
- Handling data protection questions from staff and anyone else covered by this policy
- Dealing with requests from individuals to see the Lewis & Godsil Limited holds about them. Checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data
- The Marketing Manager
- Approving any data protection statements attached to communications such as emails and letters.
- Addressing any data protection queries from journalists or media outlets like newspapers.
- Where necessary, working with other staff to ensure marketing initiatives abide by data protection principles.
General Staff Guidelines
- The only people able to access data covered by this policy should be those who need it for their work.
- Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
- Lewis & Godsil Limited will provide training to all employees to help them understand their responsibilities when handling data.
- Employees should keep all data secure, by taking sensible precautions and following the guidelines below.
- In particular, strong passwords must be used and they should never be shared.
- Personal data should not be disclosed to unauthorised people, either within the company or externally.
- Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
- Employees should request help from their line manager or the data protection officer if they are unsure about any aspect of data protecol
- Data stored on paper
- It should be kept in a secure place where unauthorised people cannot see it.
- When not required, the paper or files should be kept in a locked drawer or filing cabinet.
- Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
- Data printouts should be shredded and disposed of securely when no longer required.
- Data stored on electronic devices
- It must be protected from unauthorised access, accidental deletion and malicious hacking attempts.
- Data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing services.
- Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
- All servers and computers containing data should be protected by approved security software and a firewall.
- Data stored on Approved CRM Cloud Service, Ontraport
For the purposes of compliance, security and excellent customer service, Lewis& Godsil Limited is subscribed to a third-party CRM software service provider. This means that customer data is stored and accessed by authorized staff by means of secure internet connection.
The CRM system utilizes some of the most advanced technology for Internet security available today. The site uses industry standard Secure Socket Layer (SSL) technology, so the information is protected using both server authentication and data encryption, ensuring that the data is safe, secure, and available only to registered Users Lewis&Godsil Limited. Each user is provided with a unique user name and password, PIN that must be entered each time they logs on. In addition, The CRM system is hosted in a secure server environment that uses a firewall and other advanced technology to prevent interference or access from outside intruders.
For more information on Ontraport, please see the following pages:
Personal data is handled by Lewis&Godsil Limited only for the purposes of providing advice to its customers on the relevant event they have with us. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft. The following measures are taken to avoid such risks:
- When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.
- Personal data should never be transferred outside of the European Economic Area.
- Employees should not save copies of personal data to their own computers. Always access and update the central copy of any data.
The law requires Lewis&Godsil Limited to take reasonable steps to ensure data is kept accurate and up to date. The more important it is that the personal data is accurate, the greater the effort should be put into ensuring its accuracy. It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible:
- Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.
- Staff should take every opportunity to ensure data is updated. For instance, by confirming a customer’s details when they call.
- Data should be updated as inaccuracies are discovered.
Sharing information with third parties
In certain instances, we may make your information available to third parties with whom we have a relationship where that third party is providing services on our behalf to clients. We will only provide those third parties with information that is necessary for them to perform the services and we take measures to protect your information.
Subjects Access Requests
All individuals who are the subject of personal data held by Lewis&Godsil Limited are entitled to:
- Right of access – you have the right to request a copy of the information that we hold
- Right of rectification – you have a right to correct data that we hold about you that is
inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about
you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to
restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred
to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct
- Right to object to automated processing, including profiling – you also have the right
to be subject to the legal effects of automated processing or profiling.
In the event that you wish to make a complaint about how your personal data is being processed by Lewis & Godsil Ltd. or how your complaint has been handled, you have the right to lodge a complaint directly with the data supervisory authority.
Link below to the complaints section of the Data Commissioner website
Or email Data Protection Commissioner at firstname.lastname@example.org