Privacy Policy
Background:
Approved Resin Franchise Ltd understands that your privacy is important to you and that you care about how your information is used and shared online. We respect and value the privacy of everyone who visits Our Site and will only collect and use information in ways that are useful to you and in a manner consistent with your rights and Our obligations under the law.
This Policy applies to Our use of any and all data collected by us in relation to your use of Our Site. Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of Our Privacy Policy is deemed to occur upon your first use of Our Site. If you do not accept and agree with this Privacy Policy, you must stop using Our Site immediately.
Definitions and Interpretation
In this Policy the following terms shall have the following meanings:
“Account” means an account required to access and/or use certain areas and features of Our Site;
“Cookie” means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out in section 12, below;
“Our Site” means this website, https://approvedfranchise.co.uk/
ant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended in 2004, 2011 and 2015; and
“We/Us/Our” Approved Resin Franchises LTD
-
What Data Do We Collect?
Some data will be collected automatically by Our Site (for further details, please see section 9 below), other data will only be collected if you voluntarily submit it, for example, when signing up for an Account.
Depending upon your use of Our Site, We may collect some or all of the following data:
name; date of birth; gender; business/company name job title; profession; contact information such as email addresses and telephone numbers; demographic information such as post code, preferences and interests; financial information such as credit / debit card numbers; IP address (automatically collected); web browser type and version (automatically collected); operating system (automatically collected); a list of URLs starting with a referring site, your activity on Our Site, and the site you exit to (automatically collected).
2. How Do We Use Your Data?
All personal data is stored securely in accordance with the principles of the Data Protection Act 1998. For more details on security see section 4, below.
We use your data to provide the best possible products and services to you. This could include: Providing and managing your Account; Providing and managing your access to Our Site; Personalising and tailoring your experience on Our Site; Supplying Our products and services to you; Personalising and tailoring Our products and services for you; Responding to communications from you; Supplying you with email Email, e.g. Newsletters, Alerts etc. that you have subscribed to (you may unsubscribe or opt-out at any time by following instructions on the communication); Market research; Analysing your use of Our Site and gathering feedback to enable Us to continually improve Our Site and your user experience.
With your permission and/or where permitted by law, We may also use your data for marketing purposes which may include contacting you by email, telephone, text message and/or post with information, news and offers on Our products and services. We will not, however, send you any unsolicited marketing or spam and will take all reasonable steps to ensure that We fully protect your rights and comply with Our obligations under the Data Protection Act 1998 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended in 2004, 2011 and 2015.
3. How and Where Do We Store Your Data?
We only keep your data for as long as We need to in order to use it as described above in section 3, and/or for as long as We have your permission to keep it.
Data security is of great importance to Us, and to protect your data We have put in place suitable physical, electronic and managerial procedures to safeguard and secure data collected through Our Site.
Notwithstanding the security measures that We take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting to Us data via the internet.
4. Do We Share Your Data?
We may sometimes contract with third parties to supply products and services to you on Our behalf. These may include payment processing, delivery of goods, search engine facilities, advertising and marketing. In some cases, the third parties may require access to some or all of your data. Where any of your data is required for such a purpose, We will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, Our obligations, and the obligations of the third party under the law.
We may compile statistics about the use of Our Site including data on traffic, usage patterns, user numbers, sales and other information. All such data will be anonymised and will not include any personally identifying information. We may from time to time share such data with third parties such as prospective investors, affiliates, partners and advertisers. Data will only be shared and used within the bounds of the law.
In certain circumstances We may be legally required to share certain data held by Us, which may include your personal information, for example, where We are involved in legal proceedings, where We are complying with the requirements of legislation, a court order, or a governmental authority. We do not require any further consent from you in order to share your data in such circumstances and will comply as required with any legally binding request that is made of Us.
5. How Can You Control Your Data?
When you submit information via Our Site, you may be given options to restrict Our use of your data. In particular, We aim to give you strong controls on Our use of your data for direct marketing purposes (including the ability to opt-out of receiving emails from Us which you may do by unsubscribing using the links provided in Our emails and at the point of providing your details AND/OR by managing your Account).
You may also wish to sign up to one or more of the preference services operating in the UK: The Telephone Preference Service (“the TPS”), the Corporate Telephone Preference Service (“the CTPS”), and the Mailing Preference Service (“the MPS”). These may help to prevent you receiving unsolicited marketing. Please note, however, that these services will not prevent you from receiving marketing communications that you have consented to receiving.
6. Your Right to Withhold Information
You may access certain areas of Our Site without providing any data at all. However, to use all features and functions available on our Site you may be required to submit or allow for the collection of certain data.
You may restrict your internet browser’s use of Cookies. For more information, see section 9 below
7. How Can You Access Your Data?
You have the legal right to ask for a copy of any of your personal data held by Us (where such data is held). We reserve the right to charge a small fee for this service.
8. Cookies
Our Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve Our products and services. Our Site also uses analytics services provided by Google which also use Cookies. Website analytics refers to a set of tools used to collect and analyse usage statistics, enabling Us to better understand how people use Our Site.
9. Contacting Us
If you have any questions about Our Site or this Privacy Policy. please contact Us. Our contact details can be found on our Contact Page. Please ensure that your query is clear, particularly if it is a request for information about the data We hold about you (as under section 4, above).
10. Changes to Our Privacy Policy
We may change this Privacy Policy as we may deem necessary from time to time, or as may be required by law. Any changes will be immediately posted on Our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up-to-date.
11. How GDPR Policy Overview
Approved resin franchise LTD (“we or “us”) is committed to data protection and data privacy. With the General Data Protection Regulation (GDPR) becoming enforceable from 25 May 2018, we have undertake a GDPR readiness programme to review our entire business, the way we handle data and the way in which we use it to provide our services and manage our business operations.
The Approved resin franchise Ltd are dedicated to safeguarding the personal information under our remit and in developing a data protection regime that is effective, fit for purpose and demonstrates an understanding of, and appreciation for the new Regulation. Our preparation and objectives for GDPR compliance have been summarised in this statement and include the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.
12. How We Prepared for GDPR
We already have a consistent level of data protection and security across our organisation, however it is our aim to be fully compliant with the GDPR by 25th May 2018. Our preparation includes: –
Information Audit- carrying out a company-wide information audit to identify and assess what personal information we hold, where it comes from, how and why it is processed and if and to whom it is disclosed
Policies & Procedures-[revising/implementing new] data protection policies and procedures to meet the requirements and standards of the GDPR and any relevant data protection laws, including: –
Data Protection– our main policy and procedure document for data protection has been overhauled to meet the standards and requirements of the GDPR. Accountability and governance measures are in place to ensure that we understand and adequately disseminate and evidence our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.
Data Retention & Erasure– we have updated our retention policy and schedule to ensure that we meet the ‘data minimisation’ and ‘storage limitation’principles and that personal information is stored, archived and destroyed compliantly and ethically. We have dedicated erasure procedures in place to meet the new ‘Right to Erasure’obligation and are aware of when this and other data subject’s rights apply; along with any exemptions, response time frames and notification responsibilities.
Data Breaches– our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report any personal data breach at the earliest possible time. Our procedures are robust and have been disseminated to all employees, making them aware of the reporting lines and steps to follow.
International Data Transfers & Third-Party Disclosures– where Approved Driveways Ltd stores or transfers personal information outside the EU, we have robust procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of the data. Our procedures include a continual review of the countries with sufficient adequacy decisions, as well as provisions for binding corporate rules; standard data protection clauses or approved codes of conduct for those countries without. We carry out strict due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights and have effective legal remedies for data subjects where applicable.
Subject Access Request (SAR)– we have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.
Legal Basis for Processing- we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.
Privacy Notice/Policy– we have revised our Privacy Notice(s) to comply with the GDPR, ensuring that all individuals whose personal information we process have been informed of why we need it, how it is used, what their rights are, who the information is disclosed to and what safeguarding measures are in place to protect their information.
Obtaining Consent- we are revising our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. We have developed stringent processes for recording consent, making sure that we can evidence an affirmative opt-in, along with time and date records; and an easy to see and access way to withdraw consent at any time.
Direct Marketing- we are revising the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear notice and method for opting out and providing unsubscribe features on all subsequent marketing materials.
Data Protection Impact Assessments (DPIA)– where we process personal information that is considered high risk, involves large scale processing or includes special category/criminal conviction data; we have developed stringent procedures and assessment templates for carrying out impact assessments that comply fully with the GDPR’s Article 35 requirements. We have implemented documentation processes that record each assessment, allow us to rate the risk posed by the processing activity and implement mitigating measures to reduce the risk posed to the data subject(s).
Processor Agreements– where we use any third-party to process personal information on our behalf (i.e. Payroll, Recruitment, Hosting etc), we have drafted compliant Processor Agreements and due diligence procedures for ensuring that they (as well as we), meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of the processing activity, the technical and organisational measures in place and compliance with the GDPR.
Special Categories Data- where we obtain and process any special category information, we do so in complete compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Special category data is only processed where necessary and is only processed where we have first identified the appropriate Article 9(2) basis or the Data Protection Bill Schedule 1 condition. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.
13. Data Subject Rights
In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information via our websites, in the office, during training of an individual’s right to access any personal information that Approved resin franchise Ltd processes about them and to request information about: –
What personal data we hold about them
The purposes of the processing
The categories of personal data concerned
The recipients to whom the personal data has/will be disclosed
How long we intend to store your personal data for
If we did not collect the data directly from them, information about the source
The right to have incomplete or inaccurate data about them corrected or completed and the process for requesting this
The right to request erasure of personal data (where applicable) or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
The right to lodge a complaint or seek judicial remedy and who to contact in such instances
14. Information Security & Technical and Organisational Measures
Approved resin franchise ltd takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures including SSL, access controls, password policy, encryptions, authentication, practices, restriction etc.
15. GDPR and Employees
Approved Resin Franchise Ltd understands that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans. We have implemented an employee training program specific to the which will be provided to all employees prior to May 25th, 2018, and forms part of our induction and annual training program. If you have any questions about our preparation for the GDPR, please contact Matt Bestall