Cartwright Communications 

Data Protection Policy

This policy sets out how Cartwright P R Limited (t/a Cartwright Communications) manages its responsibilities with regard to the management of the requirements of the General Data Protection Regulation (GDPR).

The Company obtains, uses, stores and otherwise processes personal data relating to potential staff and applicants, current staff, former staff, current and former workers, contractors, clients, website users and contacts, collectively referred to in this policy as data subjects. When processing personal data, the Company is obliged to fulfil individuals’ reasonable expectations of privacy by complying with GDPR and other relevant data protection legislation (data protection law).

This policy therefore seeks to ensure that the Company:

1. Is clear about how personal data must be processed and the Company’s expectations for all those who process personal data on its behalf.
2. Complies with the data protection law and with good practice.
3. Protect the Company’s reputation by ensuring the personal data entrusted to us is processed in accordance with data subjects’ rights.
4. Protect the Company from risks of personal data breaches and other breaches of data protection law.
5. The main terms used are explained in the glossary at the end of this policy (Appendix 3).

Scope

This policy applies to all personal data the Company processes regardless of the location where that personal data is stored (e.g. on an employee’s own device) and regardless of the data subject. All staff and others processing personal data on the Company’s behalf must read it. A failure to comply with this policy may result in disciplinary action.

All members of the senior team are responsible for ensuring that all staff within their area of responsibility comply with this policy and should implement appropriate practices, processes, controls and training to ensure that compliance.

The Managing Director is responsible for overseeing this policy and is the Data Protection Officer (DPO). 

Personal data protection principles

When you process personal data, you should be guided by the following principles, which are set out in the GDPR. The Company is responsible for, and must be able to demonstrate compliance with, the data protection principles listed below:

Those principles require personal data to be:

1. Processed lawfully, fairly and in a transparent manner (Lawfulness, fairness and transparency). Detail on how to achieve this can be found in Appendix 1.
2. Collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes (Purpose limitation). Detail on how to achieve this can be found in Appendix 2.
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (Data minimisation). Detail on how to achieve this can be found in Appendix 2.
4. Accurate and where necessary kept up to date (Accuracy). Detail on how to achieve this can be found in Appendix 2.
5. Not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the personal data is processed (Storage limitation). Detail on how to achieve this can be found in Appendix 2.
6. Processed in a manner that ensures its security, using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage (Security, integrity and confidentiality). Detail on how to achieve this can be found in Appendix 2.

Data Subjects’ Rights

Data subjects have rights in relation to the way the Company handles their personal data. These include the following rights:

1. Where the legal basis of processing is Consent, to withdraw that Consent at any time;
2. To ask for access to the personal data that the Company holds (see below);
3. To prevent use of the personal data for direct marketing purposes.
4. To object to processing of personal data in limited circumstances.
5. To ask the Company to erase personal data without delay:
   1. if it is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
   2. if the only legal basis of processing is Consent and that Consent has been withdrawn and there is no other legal basis on which the Company can process that personal data;
   3. if the data subject objects to processing where the legal basis is the pursuit of a legitimate interest or the public interest and we can show no overriding legitimate grounds or interest;
   4. d. if the data subject has objected to the Company processing for direct marketing purposes;
   5. if the processing is unlawful.
6. To ask the Company to rectify inaccurate data or to complete incomplete data;
7. To restrict processing in specific circumstances e.g. where there is a complaint about accuracy;
8. To ask the Company for a copy of the safeguards under which personal data is transferred outside of the EU;
9. The right not to be subject to decisions based solely on automated processing, including profiling, except where necessary for entering into, or performing, a contract, with the Company; it is based on the data subject’s explicit consent and is subject to safeguards; or is authorised by law and is also subject to safeguards;
10. To prevent processing that is likely to cause damage or distress to the data subject or anyone else;
11. To be notified of a personal data breach which is likely to result in high risk to their rights and freedoms;
12. To make a complaint to the ICO; and
13. In limited circumstances, receive or ask for their personal data to be transferred to a third party in a structured, commonly used and machine readable format.
    1. It is necessary to verify the identity of an individual requesting data under any of the rights listed above.

Requests (including for data subject access – see below) must be complied with, usually within one month of receipt. Any Data Subject Access Request received must be passed to the DPO. A charge can be made for dealing with requests relating to these rights only if the request is excessive or burdensome.

Accountability

The Company must implement appropriate technical and organisational measures in an effective manner to ensure compliance with data protection principles. The Company is responsible for, and must be able to demonstrate compliance with, the data protection principles.

We must therefore apply adequate resources and controls to ensure and to document GDPR compliance including:

1. Appointing a suitably qualified DPO;
2. Implementing appropriate technical and organisational measures in an effective manner to ensure compliance with the GDPR;
3. Integrating data protection into our policies and procedures, in the way personal data is handled by us and by producing required documentation such as Privacy Notices, Records of Processing and records of Personal Data Breaches;
4. Training staff on compliance with Data Protection Law and keeping a record accordingly; and
5. Regularly testing the privacy measures implemented and conducting periodic reviews and audits to assess compliance, including using results of testing to demonstrate compliance improvement effort.

Responsibilities

1. Company responsibilities

As the Data Controller, the Company is responsible for establishing policies and procedures in order to comply with data protection law.

2. Data Protection Officer responsibilities

The DPO is responsible for:

(a) advising the Company and its staff of its obligations under GDPR.

(b) monitoring compliance with this Regulation and other relevant data protection law, the Company policies with respect to this and monitoring training and audit activities relate to GDPR compliance.

(c) to provide advice where requested on data protection impact assessments

(d) to cooperate with and act as the contact point for the Information Commissioner’s Office.

(e) having due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

3. Staff responsibilities

Staff members who process personal data must comply with the requirements of this policy. Staff members must ensure that:

(a) all personal data is kept securely;

(b) no personal data is disclosed either verbally or in writing, accidentally or otherwise, to any unauthorised third party;

(c) personal data is kept in accordance with the Company’s retention schedule;

(d) any queries regarding data protection, including subject access requests and complaints, are promptly directed to the DPO;

(e) any data protection breaches are swiftly brought to the attention of the DPO and that they support the DPO in resolving breaches;

(f) where there is uncertainty around a data protection matter advice is sought from the DPO.

Staff who are unsure about who are the authorised third parties to whom they can legitimately disclose personal data should seek advice from the DPO.

4. Third-Party Data Processors

Where external companies are used to process personal data on behalf of the Company, responsibility for the security and appropriate use of that data remains with the Company.

Where a third-party data processor is used:

(a) a data processor must be chosen which provides sufficient guarantees about its security measures to protect the processing of personal data;

(b) reasonable steps must be taken to ensure that such security measures are in place;

(c) a written contract establishing what personal data will be processed and for what purpose must be set out;

For further guidance about the use of third-party data processors please contact the DPO.

Data subject Access Requests

Data subjects have the right to receive copy of their personal data which is held by the Company. In addition, an individual is entitled to receive further information about the Company’s processing of their personal data as follows:

1. The purposes
2. The categories of personal data being processed
3. Recipients/categories of recipient
4. Retention periods
5. Information about their rights
6. The right to complain to the ICO,
7. Details of the relevant safeguards where personal data is transferred outside the EEA
8. Any third-party source of the personal data

No-one should allow third parties to persuade them into disclosing personal data without proper authorisation. 

The entitlement is not to documents per se, but to such personal data as is contained in the document. The right relates to personal data held electronically and to limited manual records.

No-one should alter, conceal, block or destroy personal data once a request for access has been made. 

Reporting a personal data breach

The GDPR requires that we report to the Information Commissioner’s Office (ICO) any personal data breach where there is a risk to the rights and freedoms of the data subject. Where the Personal data breach results in a high risk to the data subject, he/she also has to be notified unless subsequent steps have been taken to ensure that the risk is unlikely to materialise, security measures were applied to render the personal data unintelligible (e.g. encryption) or it would amount to disproportionate effort to inform the data subject directly. We have put in place procedures to deal with any suspected personal data breach and will notify data subjects or the ICO where we are legally required to do so.

If you know or suspect that a personal data breach has occurred, you should immediately contact the DPO. The Company must retain all evidence relating to personal data breaches in particular to enable the Company to maintain a record of such breaches, as required by the GDPR.

Limitations on the transfer of personal data

The GDPR restricts data transfers to countries outside the EU in order to ensure that the level of data protection afforded to individuals by the GDPR is not undermined. Personal data originating in one country is transmitted across borders when anyone transmits or sends that data to a different country or views/accesses it in a different country.

No-one may transfer personal data outside the EU unless one of the following conditions applies:

1. The European Commission has issued a decision confirming that the country to which we transfer the personal data ensures an adequate level of protection for the data subjects’ rights and freedoms. 
2. Appropriate safeguards are in place such as binding corporate rules, standard contractual clauses approved by the European Commission, an approved code of conduct or a certification mechanism, a copy of which can be obtained from the DPO;
3. The data subject has provided explicit Consent to the proposed transfer after being informed of any potential risks; or
4. The transfer is necessary for one of the other reasons set out in the GDPR including:
5. The performance of a contract between us and the data subject 
6. Reasons of public interest,
7. To establish, exercise or defend legal claims or
8. To protect the vital interests of the data subject where the data subject is physically or legally incapable of giving Consent.

Record Keeping

The GDPR requires us to keep full and accurate records of all our data processing activities. You must keep and maintain accurate corporate records reflecting our processing, including records of data subjects’ Consents and procedures for obtaining Consents, where Consent is the legal basis of processing.

These records should include, at a minimum, the name and contact details of the Company as Data Controller and the DPO, clear descriptions of the personal data types, data subject types, processing activities, processing purposes, third-party recipients of the personal data, personal data storage locations, personal data transfers, the personal data’s retention period and a description of the security measures in place.

Records of personal data breaches must also be kept, setting out:

1. the facts surrounding the breach
2. its effects; and
3. the remedial action taken

Training and Audit

We are required to ensure that all Company staff undergo adequate training to enable them to comply with data protection law. We must also regularly test our systems and processes to assess compliance. You must undergo all mandatory data privacy related training. 

Direct Marketing

We are subject to certain rules and privacy laws when marketing to any potential user of our services.

The right to object to direct marketing must be explicitly offered to the data subject in an intelligible manner so that it is clearly distinguishable from other information.

A data subject’s objection to direct marketing must be promptly honoured. If a data subject opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.

Sharing Personal Data

In the absence of Consent, a legal obligation or other legal basis of processing, personal data should not generally be disclosed to third parties unrelated to the Company. 

Some bodies have a statutory power to obtain information (e.g. regulatory bodies, government agencies such as the Child Support Agency). Confirmation of any such power should be sought before disclosing personal data in response to a request. 

Further, without a warrant, the police have no automatic right of access to records of personal data, though voluntary disclosure may be permitted for the purposes of preventing/detecting crime or for apprehending offenders. 

Changes to this policy

This policy may change from time to time without notice to you, as circumstances, regulations and guidance require.

Appendix 1

Principle 1 of GDPR – Processing personal data lawfully, fairly and transparently

1. Lawfulness and fairness

We may only process personal data fairly and lawfully and for specified purposes. 

The legal bases for processing non-sensitive personal data are as follows:

1. The data subject has given Consent
2. The processing is necessary for the performance of a contract with the data subject 
3. To meet legal compliance obligations
4. To protect the data subject’s vital interests (i.e. matters of life or death)
5. To pursue our legitimate interests (or another’s legitimate interests) which are not overridden because the processing prejudices the interests or fundamental rights and freedoms of data subjects. 

 (a) Consent

You should only obtain a data subject’s Consent if there is no other legal basis for the processing. Consent requires genuine choice and genuine control.

A data subject consents to processing of his/her personal data if he/she indicates agreement clearly either by a statement or positive action to the processing. Data subjects must be able to withdraw Consent to processing easily at any time. Withdrawal of Consent must be promptly honoured. Consent may need to be renewed if you intend to process personal data for a different and incompatible purpose which was not disclosed when the data subject first consented, or if the Consent is historic.

You will need to ensure that you have evidence of Consent and you should keep a record of all Consents obtained so that we can demonstrate compliance.

Consent is required for some electronic marketing and some research purposes.

(b) Legal bases for Processing Sensitive Personal Data.

The processing of sensitive personal data by the Company must be based on one of a number of specific bases (together with one of the legal bases for processing non-sensitive personal data as listed above). Guidance from the DPO must be sought in all cases

Processing sensitive personal data represents a greater intrusion into individual privacy than when processing non-sensitive personal data. We must therefore take special care when processing sensitive personal data and ensure that we comply with the data protection principles (as set out in the main body of this policy) and with this policy, in particular in ensuring the security of the sensitive personal data.

2. Transparency (notifying data subjects)

Under the GDPR the Company is required to provide detailed, specific information to data subjects depending on whether the information was collected directly from data subjects or from elsewhere. That information must be provided through appropriate Privacy Notices which must be concise, transparent, intelligible, easily accessible, and in clear and plain language so that a data subject can easily understand what happens to their personal data.

Whenever we collect personal data directly from data subjects, for example for the recruitment and employment of staff, at the time of collection we must provide the data subject with all the prescribed information which includes:

1. Company’s details
2. Contact details of DPO
3. Purposes of processing
4. Legal basis of processing
5. Where the legal basis is legitimate interest, identify the particular interests (e.g. marketing, fundraising)
6. Where the legal basis is Consent, the right to withdraw
7. Where statutory/contractual necessity, the consequences for the Data Subject of not providing the data

Appendix 2

Principle 2 of GDPR – Purpose Limitation

Personal data must be collected only for specified, explicit and legitimate purposes. It must not be further processed in any manner incompatible with those purposes.

You cannot therefore use personal data for entirely new, different or incompatible purposes from those disclosed when it was first obtained unless you have informed the data subject of the new purposes. 

Principle 3 of the GDPR – Data minimisation

Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. You should not therefore amass large volumes of personal data that are not relevant for the purposes for which they are intended to be processed. 

You must ensure that when personal data is no longer needed for specified purposes, it is deleted or anonymised in accordance with the Company’s data retention policy.

Principle 4 of the GDPR – Accuracy

Personal data must be accurate and, where necessary, kept up to date. You should ensure that personal data is recorded in the correct files.

Principle 5 of the GDPR – Storage limitation

You must not keep personal data in a form that allows data subjects to be identified for longer than needed for the legitimate educational/research or Company business purposes or other purposes for which the Company collected it. Those purposes include satisfying any legal, accounting or reporting requirements. Records of personal data can be kept for longer than necessary if anonymised.

Principle 6 of the GDPR – Security, Integrity and Confidentiality

The Company is required to implement and maintain appropriate safeguards to protect personal data, taking into account in particular the risks to data subjects presented by unauthorised or unlawful processing or accidental loss, destruction of, or damage to their personal data. 

You may only transfer personal data to third-party service providers (i.e. data processors) who provide sufficient guarantees to implement appropriate technical and organisational measures to comply with Data Protection Law and who agree to act only on the Company’s instructions. Data processors should therefore be appointed subject to the Company’s standard contractual requirements for data processors.

Appendix 3

Glossary of Terms

Consent: agreement which must be freely given, specific, informed and be an unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear positive action, signifies agreement to the processing of personal data relating to them.

Data Controller: the person or organisation that determines when, why and how to process personal data. It is responsible for establishing practices and policies in accordance with the GDPR. The Company is the Data Controller of all personal data relating to it and used delivering education and training, conducting research and all other purposes connected with it including business purposes. .

Data Subject: a living, identified or identifiable individual about whom we hold personal data.

Personal Data: any information identifying a data subject or information relating to a data subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal data includes sensitive personal data and pseudonymised personal data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.

Privacy Notices: separate notices setting out information that may be provided to data subjects when the Company collects information about them.