FELL PONY ADVENTURES
Data management policy
1. Context and overview
Introduction:
Fell Pony Adventures needs to gather and use certain information about individuals. These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact. This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards – and to comply with the law.
Why this policy exists:
This data management policy ensures Fell Pony Adventures
Complies withdata protection law and follows good practice
Protects the rights of customers, staff and partners
Is transparent about how it stores and processes individuals’ data
Protects itself from the risks of a data breach
Data protection law:
The General Data Protection Regulation (GDPR) applies in the UK and across the EU from May 2018. It requires personal data shall be:
Processed lawfully, fairly and in a transparent manner in relation to individuals;
Collected for specified, explicit and legitimate purposes and not further processedin a manner that is incompatible with those purposes; further processing forarchiving purposes in the public interest, scientific or historical research orstatistical purposes shall not be considered to be incompatible with the initialpurposes;
Adequate, relevant and limited to what is necessary in relation to the purposes forwhich they are processed;
Accurate and, where necessary, kept up to date; every reasonable step must betaken to ensure that personal data that are inaccurate, having regard to thepurposes for which they are processed, are erased or rectified without delay;
Kept in a form which permits identification of data subjects for no longer than isnecessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will processedsolely for archiving purposes in the public interest, scientific or historical researchpurposes or statistical purposes subject to implementation of the appropriatetechnical and organisational measures required by GDPR in order to safeguard therights and freedoms of individuals;
Processed in a manner that ensures appropriate security of personal data, includingprotection against unauthorised or unlawful processing and against accidental loss,destruction or damage, using appropriate technical or organisational measures.
The controller shall be responsible for, and be able to demonstrate, compliance with the principles
2. Who? People and responsibilities
Everyone at Fell Pony Adventures contributes to compliance with GDPR. Key decision makers understand the requirements and accountability of the organisation sufficiently to prioritise and support the implementation of compliance. Below are the key areas of responsibility to ensure clarity about who in the organisation is responsible for leading oncompliance with the regulations and how policy and procedural information is disseminated within the team:
The Data Protection Officer is responsible for keeping senior management and board updated about data protection issues, risks and responsibilities
The Data Protection Officer is responsible for Documenting, maintaining and developing the organisation’s data protection policy and related procedures, in line with agreed schedule
The Data Protection Officer will ensure that ongoing privacy measures are embedded into corporate policies and day-to-day activities, throughout the organisation and within each business unit that processes personal data. The policies themselves will stand as proof of compliance. This will be done through staff meetings.
The policy will be disseminated across the organisation during staff meetings and training and advice will be offered to staff
Fell Pony Adventures in conjunction with the Data Protection Officer will deal with subject access requests, deletion requests and queries from clients, stakeholdersand data subjects about data protection related matters
Fell Pony Adventures will check and approve contracts or agreements with third parties that may handle the company’s sensitive data
The Data Protection Officer will ensure all systems, services and equipment used for storing data meet acceptable security standards
Fell Pony Adventures will perform regular checks and scans to ensure security hardware and software is functioning properly
The Data Protection Officer will be informed of any third party services the company is considering using to store or process data, and will evaluate their systems to ensure their compliance with obligations under the regulations
Fell Pony Adventures will ensure that privacy notices to reflect lawful basis for fairprocessing, ensuring that intended uses are clearly articulated, and that data subjects understand how they can give or withdraw consent, or else otherwise exercise their rights in relation to the companies use of their data
Fell Pony Adventures and the Data Protection Officer will ensure that audience development, marketing, fundraising and all other initiatives involving processing personal information and/or contacting individuals abide by the GDPR principles
Data Protection Officer (DPO)–the person responsible for fulfilling the tasks of the DPO in respect of Fell Pony Adventures is Tom LLoyd.
The DPO will:
inform and advise the organisation and its employees about their obligations tocomply with the GDPR and other data protection laws
Monitor compliance with the GDPR and other data protection laws, includingmanaging internal data protection activities, advise on data protection impactassessments; train staff and conduct internal audits
To be the first point of contact for supervisory authorities and for individualswhose data is processed (employees, customers etc)
3. Scope of personal information to be processed
Fell Pony Adventures collects the following information:
Full Names of individuals
Postal address
Telephone number
Email addresses
Data is stored on Mail chimp
Data is reviewed at least annually to ensure that the data we hold is accurate,relevant tothe purpose, not excessive, up-to-date and is not kept longer thannecessary.
4. Uses and conditions for processing
Here, document the various specific types of processing that you carry out, intended purpose for that processing, the data to be processed and what is the lawful basis forprocessing, and how these conditions for processing are supported. Expand and add to thefields in the following table as required to give appropriate level of detail
Outcome and use: Mailchimp – Newsletters and emails about upcoming events. Contacting traders / performers with details of events they have applied to attend
Processing required: Mail-merge of name and email address details from Mailchimp. Collation on spreadsheet on Google Drive
Data to be processed: Name and email address. Name, address, email, telephone number, type of business, risk assessments and food hygiene details if necessary
Conditions for processing: Consent when signing up to Eden Arts mailing list. Consent when applying on line to be part of the event.
Evidence for lawful basis: Specific consent is given when people sign up to our mailing list. There is also an unsubscribe option on every email sent out. Subscribers are asked to specify which events they would like to receive information about and they are only added to these mailing lists when consent has been received. When traders and performers sign up online to take part in events they are specifically informed that we will contact them via email with details of the event.
Consent – in cases where you rely on consent as the lawful condition for processing, you should be able to demonstrate and describe how you have reviewed your processes and systems to make sure that consent is freely and unambiguously given for specific purposes, and that you can evidence an affirmative action on the part of the data subject to have indicated consent, and such that data subjects can reasonably understand who is using their personal information, what information, and for what purposes, and using which communications channels. Do your practises and systems incorporate a suitable audit trail which would enable you to demonstrate how and when consent was obtained, upon request? Do your practices and systems communicate an individual’s right to withdraw consent at any time, and do your processes and systems support the functionality to do so?
Where ‘soft opt-in’ is used in as the lawful basis for processing for electronic communications (email/SMS/automated-telephone) contact, you should record the notification statement detailing the intended use of personal information given at the point of collecting personal information during the course of sale or negotiation for sale which gave the customer the opportunity to opt out, and also how subsequently notify the customer of their right to unsubscribe with every following communication.
Where ‘legitimate interest’ is the lawful condition for processing, evidence should be given of the process by which the rights and freedoms of the individual have been weighed against the interests of the company, and how consideration/mitigation of the outcomes of the process have been made. How has the individual been informed of this processing, and what information have they been given to help them exercise their rights?
5. Privacy Impact Assessments
Privacy Impact Assessments (PIAs - also known as Data Protection Impact Assessments, DPIAs) form an integral part of taking a privacy by design, best practice approach, and there are certain circumstances under which organisations must conduct PIAs. They are a tool which can help organisations identify the most effective way to comply with their data protection obligations and meet individuals’ expectations of privacy, and protect against the risk of harm through use or misuse of personal information. An effective DPIA will allow organisations to identify and fix problems at an early stage, reducing the associated costs and damage to reputation which might otherwise occur.
PIAs undertaken by your company may be detailed here, or else referenced here and presented as an appendix to this data management policy document. The DPIA should contain:
A description of the processing operations and the purposes, including, where applicable, the legitimate interests pursued by the controller.
An assessment of the necessity and proportionality of the processing in relation to the purpose.
An assessment of the risks to individuals.
The measures in place to address risk, including security and to demonstrate that you comply.
A DPIA can address more than one project.
6. Data sharing
In this section provide details of any/all Third Party organisations that [name of company] intends to share personal information with.
Where consent is the basis for sharing, describe how [company name] has obtained and recorded the necessary specific, clear, granular permissions for sharing data with NAMED third parties, for specifically defined uses, and in specified communications channels. Where other lawful conditions for processing are relied upon for data sharing, these should also be described.
Details should be given as to when data sharing agreements, describing and ensuring the arrangements concerning the collection of the necessary permissions, defining the scope of the personal data to be shared – along with the meta-data that will enable the receiving party to be able to create an audit trail, sufficient to enable them to respond to any challenge as to why an individual’s data has been processed, or to facilitate a data subject access request, and which details the security measures that will be put in place to protect the data in transit, and which establishes the shared understanding of the receiving organisations’ obligations as a data controller with responsibility for all aspects of the regulation as data controllers of the new copy of the data which is being shared with them.
7. Security measures
Here, describe the measures that are in place to protect the personal information that you store from breach.
Details should be documented here of the technical infrastructure considerations and measures put in place to leverage technology to require or ensure compliance, such as restricting and protecting access to the data to those people for whom it is necessary to perform the processing - such as measures like security software and firewalls, encryption, the use of secure Virtual Private Networks (VPN), log-in restricted access and two step authentications, etc.
The procedural and organisational policy measures, such as protocols for safe transfer of data in transit, and protocols for password management, and data back-up should also be detailed.
Describe also the measures in place to enable your organisation to know if a data breach has taken place and what measures are in place to ensure that reporting of any breaches are reported to the ICO within the required timescales. You should also articulate the measures you have in place to ensure that any data to be deleted, is deleted securely and without further risk of breach.
8. Automated processing
Provide details of any automated processing or decision making undertaken by your company name, including profiling. You should describe the lawful condition for that processing, what the outcomes are, and that in a case where such processing leads to a significant legal or other effect on the individual, how you have weighed the outcomes of that processing against the rights and freedoms of the individuals. The process of weighing the organisation’s interest against the rights of the individual should always be transparently demonstrated. Privacy statements should include details of any automated processing, (including details of any third party profiling tools or datasets that are used to append information which will build a profile of individuals) and the outcomes of this processing, together with details of how individuals can exercise their right not to be subjected to such.
9. Subject access requests
All individuals who are the subject of data held by your company are entitled to:
Ask what information the company holds about them and why
Ask how to gain access to it
Be informed how to keep it up to date
Be informed how the company is meeting its data protection obligations
Details should be given here of the process by which [company name] will fulfil subject access requests and how individuals are notified of this process.
10. The right to be forgotten
In certain circumstances, subjects have the right to be deleted from your database.
Here, articulate your organisation’s policy and process for evaluating this right, and how you would comply technically with those cases where you will carry out the individual’s right to be forgotten – what would be deleted and what data would be retained anonymously.
11. Privacy notices
Fell Pony Adventures aims to ensure that individuals are aware that their data is being processed, and that they understand:
Who is processing their data
What data is involved
The purpose for processing that data
The outcomes of data processing
How to exercise their rights.
To these ends the company has a privacy statement, setting out how data relating to these individuals is used by the company.
Detail here where and how the privacy statement can be viewed by individuals.
12. Ongoing documentation of measures to ensure compliance
Meeting the obligations of the GDPR to ensure compliance will be an ongoing process. Fell Pon y Adventures details here the ongoing measures implemented to:
Maintain documentation/evidence of the privacy measures implemented and records of compliance
Regularly test the privacy measures implemented and maintain records of the testing and outcomes.
Use the results of testing, other audits, or metrics to demonstrate both existing and continuous compliance improvement efforts.
Keep records showing training of employees on privacy and data protection matters.
Once you have completed your first draft of this document, it will need ongoing review whenever any changes occur to personnel, practices or policies, or technical infrastructure that impact any of the information given. A formal date for holistic review is given in section 1, but the document should be considered a dynamic articulation of the organisations data management policy which is under constant revision.