OTWT Data Protection Policy
As part of our operations, we need to obtain and process information. This information includes any offline or online data that makes a person identifiable such as names, addresses, email addresses Our company collects this information in a transparent way and only with the full cooperation and knowledge of our customers. Once this information is available to us, the following rules apply.
Our data will be:
Accurate and kept up-to-date
Collected fairly and for lawful purposes only
Processed by the OTWT within its legal and moral boundaries
Protected against any unauthorised or illegal access by internal or external parties
Our data will not be:
Communicated informally
Stored for more than a specified amount of time
Transferred to other organisations that do not have adequate data protection policies
Distributed to any party other than the ones agreed upon by the data’s owner.
In addition to ways of handling the data the OTWT has direct obligations towards people to whom the data belongs. Specifically we must: · Let people know which of their data is collected
Inform people about how we’ll process their data · Inform people about who has access to their information
Have provisions in cases of lost, corrupted or compromised data
Allow people to request that we modify, erase, reduce or correct data contained in our databases
Actions
To exercise data protection we’re committed to: · Restrict and monitor access to sensitive data
Develop transparent data collection procedures
Train employees in online privacy and security measures
Build secure networks to protect online data from cyberattacks
Establish clear procedures for reporting privacy breaches or data misuse
Include contract clauses or communicate statements on how we handle data
Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorisation etc.)
Data processing activities
Email Addresses/telephone number to confirm order and contact a customer >Written down on an order form > filed away in a Diary > Taken to the kitchen to process order > File order form for a maximum of a month > Shredded at source
- Bank Card details to take payment over the phone >Written down on an order form to take payment once a phone call has ended > order form filed for a maximum of a month > Shredded at source
Staff Sort code and Account numbers to process payroll > Processed by 10CA. Secure and can be deleted by user at any time.
Staff Personal Information for Accountant > National insurance, bank details to be held by 10CA
Website Traffic Information
Volume of people visited
What pages they clicked on
Communicate fair processing notices/privacy notices
All staff to inform customers and staff of where and how their personal data will be used and how long for and when it will be deleted or destroyed.
What area they’re from.
Training and awareness
Monthly review of staff knowledge and Data Protection policy. Ensuring staff have an understanding of their rights and the rights of others.
Data breach reporting
Ensuring all data breaches are reported to the Information Commissioner’s Office –
0303 123 1113
Review ICO/DPC website
Employers at OTWT to have access to : ico.org.uk – Information Commissioner’s Office