Overview
A UK-based organization has released a comprehensive privacy notice that sets out in detail how it collects, uses, stores, and shares personal data. The notice, last updated on 04 February 2024, is designed to give individuals clear information about their privacy rights and the legal protections that apply when they interact with the organization's website, products, and services. It is presented in a layered format, allowing readers to navigate to specific sections, and it includes a glossary of key terms. The document emphasizes that it supplements other privacy notices rather than overriding them, and it encourages individuals to read it alongside any specific fair processing notices provided on particular occasions.
Who Controls Your Data
The notice identifies the organization as the controller responsible for personal data. A data protection officer has been appointed to oversee questions relating to the privacy notice, including requests to exercise legal rights. Individuals with questions are directed to contact the data protection officer using the details provided in the notice. The document also explains that individuals have the right to make a complaint at any time to the Information Commissioner's Office, the UK supervisory authority for data protection issues, although the organization requests the chance to address concerns first.
Categories of Personal Data Collected
The privacy notice groups personal data into several categories. Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, and gender. Contact Data includes billing address, delivery address, email address, and telephone numbers. Financial Data includes bank account and payment card details. Transaction Data includes details about payments to and from the individual and other details of products and services purchased. Technical Data includes internet protocol address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices used to access the website. Profile Data includes username and password, purchases or orders, interests, preferences, feedback, and survey responses. Usage Data includes information about how the website, products, and services are used. Marketing and Communications Data includes preferences in receiving marketing from the organization and third parties, and communication preferences.
The notice also states that aggregated data, such as statistical or demographic data, may be collected, used, and shared for any purpose. Aggregated data may be derived from personal data but is not considered personal data in law if it does not directly or indirectly reveal identity. However, if aggregated data is combined with personal data so that it can directly or indirectly identify an individual, it is treated as personal data. The organization does not collect any special categories of personal data, such as details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic, or biometric data. It also does not collect information about criminal convictions and offences.
How Personal Data Is Collected
Personal data is collected through different methods. Direct interactions occur when individuals provide Identity, Contact, and Financial Data by filling in forms or corresponding by post, phone, email, or otherwise. This includes data provided when applying for products or services, creating an account, subscribing to a service or publications, requesting marketing, entering a competition, promotion, or survey, or giving feedback. Automated technologies or interactions may collect Technical Data about equipment, browsing actions, and patterns. This is done using cookies, server logs, and other similar technologies. The notice notes that Technical Data may also be received from other websites that employ the organization's cookies. Third parties or publicly available sources may provide personal data, including Technical Data from analytics providers and advertising networks.
Lawful Bases for Processing
The organization will only use personal data when the law allows it. Most commonly, processing occurs where it is necessary to perform a contract, where it is necessary for legitimate interests and individual rights do not override those interests, or where it is necessary to comply with a legal or regulatory obligation. Generally, the organization does not rely on consent as a legal basis for processing personal data, except in relation to sending third-party direct marketing communications via email or text message. Individuals have the right to withdraw consent to marketing at any time by contacting the organization.
Purposes of Processing
The notice provides a detailed table describing how personal data will be used and the lawful basis for each purpose. Purposes include registering new customers, processing and delivering orders, managing payments, fees, and charges, collecting and recovering money owed, managing the relationship with customers, notifying about changes to terms or privacy policy, asking for reviews or surveys, enabling participation in prize draws, competitions, or surveys, administering and protecting the business and website, delivering relevant website content and advertisements, using data analytics to improve the website and services, and making suggestions and recommendations about goods or services that may be of interest. The table identifies the types of data used for each purpose and the lawful basis, including performance of a contract, legitimate interests, and compliance with legal obligations.
Marketing and Cookies
The notice explains that the organization strives to provide choices regarding certain personal data uses, particularly around marketing and advertising. A member area is available where individuals can view and make decisions about their personal data use. Promotional offers may be sent based on Identity, Contact, Technical, Usage, and Profile Data to form a view on what may be relevant. Individuals will receive marketing communications if they have requested information, purchased goods or services, or provided details when entering a competition or registering for a promotion, and have not opted out. The organization will obtain express opt-in consent before sharing personal data with any company outside its group for marketing purposes. Individuals can ask the organization or third parties to stop sending marketing messages at any time by logging into the website and adjusting preferences, following opt-out links, or contacting the organization. Opting out of marketing will not apply to personal data provided as a result of a product or service purchase, warranty registration, product or service experience, or other transactions.
Regarding cookies, individuals can set their browser to refuse all or some browser cookies, or to alert them when websites set or access cookies. If cookies are disabled or refused, some parts of the website may become inaccessible or not function properly. The notice directs readers to a cookie policy for more information.
Disclosures of Personal Data
The organization may share personal data with internal third parties and external third parties as set out in the glossary. It may also share personal data with third parties to whom it may choose to sell, transfer, or merge parts of its business or assets. Alternatively, it may seek to acquire other businesses or merge with them. If a change happens to the business, the new owners may use personal data in the same way as set out in the privacy notice. The organization requires all third parties to respect the security of personal data and to treat it in accordance with the law. Third-party service providers are not allowed to use personal data for their own purposes and are only permitted to process it for specified purposes and in accordance with instructions.
International Transfers
The notice states that personal data is not transferred outside the European Economic Area. However, it also lists safeguards that would apply if such transfers were necessary, including transferring to countries deemed to provide an adequate level of protection by the European Commission, using specific contracts approved by the European Commission, and relying on the Privacy Shield for providers based in the United States. Individuals can contact the organization for further information on specific mechanisms used when transferring personal data out of the EEA.
Data Security and Retention
Appropriate security measures have been put in place to prevent personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. Access to personal data is limited to employees, agents, contractors, and other third parties who have a business need to know. They process personal data only on instructions and are subject to a duty of confidentiality. Procedures are in place to deal with any suspected personal data breach, and individuals and any applicable regulator will be notified of a breach where legally required. By law, basic information about customers, including Contact, Identity, Financial, and Transaction Data, must be kept for six years after they cease being customers for tax purposes. In some circumstances, individuals can ask for data to be deleted. In other circumstances, personal data may be anonymised for research or statistical purposes and used indefinitely without further notice.
Your Legal Rights
Under certain circumstances, individuals have rights under data protection laws in relation to their personal data. These include the right to request access to personal data, request correction, request erasure, object to processing, request restriction of processing, request transfer of personal data, and withdraw consent at any time where consent is relied upon. Individuals who wish to exercise any of these rights should contact the organization. No fee is usually required, although a reasonable fee may be charged if a request is clearly unfounded, repetitive, or excessive, or the organization may refuse to comply in such circumstances. The organization may need to request specific information to confirm identity and ensure the right to access personal data or exercise other rights. This is a security measure to ensure personal data is not disclosed to any person who has no right to receive it. The organization tries to respond to all legitimate requests within one month, but it may take longer if a request is particularly complex or if multiple requests are made. In such cases, the individual will be notified and kept updated.
Glossary of Key Terms
The notice includes a glossary explaining lawful bases. Legitimate Interest means the interest of the business in conducting and managing its business to enable the best service, product, and most secure experience. The organization considers and balances any potential impact on individuals and their rights before processing personal data for legitimate interests. It does not use personal data for activities where its interests are overridden by the impact on the individual unless it has consent or is otherwise required or permitted by law. Performance of Contract means processing data where it is necessary for the performance of a contract to which the individual is a party or to take steps at the request of the individual before entering into such a contract. Comply with a legal or regulatory obligation means processing personal data where it is necessary for compliance with a legal or regulatory obligation. Internal third parties include other companies in the group acting as joint controllers or processors and based in the UK or EU, providing IT and system administration services and undertaking leadership reporting. External third parties include service providers acting as processors based in the UK or EU who provide IT and system administration services, professional advisers including lawyers, bankers, auditors, and insurers based in the UK or EU who provide consultancy, banking, legal, insurance, and accounting services, and HM Revenue & Customs, regulators, and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances.
Exercising Your Rights
The notice details specific rights. Request access enables individuals to receive a copy of the personal data held and to check that it is lawfully processed. Request correction enables individuals to have incomplete or inaccurate data corrected, though verification of the accuracy of new data may be needed. Request erasure enables individuals to ask for deletion or removal of personal data where there is no good reason for continued processing. This right also applies where the individual has successfully exercised the right to object to processing, where information may have been processed unlawfully, or where erasure is required to comply with local law. However, the organization may not always be able to comply with a request for erasure for specific legal reasons, which will be notified at the time of the request. Object to processing applies where the organization relies on a legitimate interest or those of a third party and there is something about the particular situation that makes the individual want to object because it impacts on fundamental rights and freedoms. Individuals also have the right to object where personal data is processed for direct marketing purposes. In some cases, the organization may demonstrate compelling legitimate grounds to process information which override the individual's rights and freedoms. Request restriction of processing enables individuals to ask the organization to suspend processing in specific scenarios: if the accuracy of the data is in question, if the use is unlawful but erasure is not wanted, if the data is needed to establish, exercise, or defend legal claims even though the organization no longer requires it, or if an objection to use has been made but verification of overriding legitimate grounds is needed. Request the transfer of personal data to the individual or a third party requires the organization to provide personal data in a structured, commonly used, machine-readable format. This right only applies to automated information initially provided with consent or used to perform a contract. Withdraw consent at any time applies where consent is relied upon to process personal data. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. If consent is withdrawn, the organization may not be able to provide certain products or services, and the individual will be advised if this is the case at the time of withdrawal.
The document was last updated on 04 February 2024.
Source: UKTN News