Privacy Policy

This data protection and privacy policy relates to the personal data processed by Martins Heron Associates.  This document outlines how data is processed and managed. It:

1. identifies our data controller;
2. provides our lawful basis for processing personal data;
3. outlines the scope of personal data we hold and process;
4. describes and justifies our data retention policy;
5. shows how we intend to respond to Subject Access Requests;
6. shows how we share your data;
7. outlines your rights to your personal data;
8. states how to contact us about your data; and
9. states how to make a complaint.

The policies outlined within this document come into full effect on 1 January 2020.

1. WHO IS THE DATA CONTROLLER?

The Data Controller is Gerry Barber

2. LAWFUL BASIS FOR PROCESSING

Personal data is processed under the lawful basis of consent. it does not fall within the definition of direct marketing.  We undertake to always act within the reasonable expectations of our constituents and any other individuals about whom we hold personal data.

3. DATA WE HOLD 

Personal data is stored electronically and securely on our computer systems and paper records are stored in a locked filing cabinet system. This information predominantly includes but is not limited to:

• Names, addresses and email addresses.
• Telephone numbers.

4. DATA RETENTION POLICY

Personal data will be held for no longer than necessary. 

5. SUBJECT ACCESS REQUESTS

We will comply with Subject Access Requests in line with the guidance given by the Information Commissioners Office (ICO).

i. We will respond as quickly as possible, within 30 calendar days.
ii. We will request verification of the identity of any individual making a request and ask for further clarification and details if needed.
iii. Data subjects have the right to the following:

a. To be told whether any personal data is being processed.
b. To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
c. To be given a copy of the information comprising the data and given details of the source of the data where this is available.

6. WILL WE SHARE YOUR DATA WITH ANYONE ELSE?

Any third parties that we may share your data with are obliged to keep your details securely, and to use them only for the basis upon which they were originally intended. When they no longer need your data to fulfil this service, they will dispose of the details in line with our procedures.

In any case, we will not use your personal data in a way that goes beyond your reasonable expectations in contacting us.

7. WHAT RIGHTS DO I HAVE TO MY PERSONAL DATA?

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing, such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: if our office refuses your request under rights of access, we will provide you with a reason why. You have the right to complain.

8. HOW CAN I CONTACT SOMEBODY ABOUT MY PRIVACY?

You can get in touch with our office by letter, email or telephone using the details at the foot of this page.

Please note that we will ask for identification should you choose to exercise any of the above rights in relation to personal data we hold.

9. MAKING A COMPLAINT

If you are unhappy with the way that we have processed or handled your data then you have a right to complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom. The contact details for the ICO are:

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
• Telephone: 0303 123 1113
• Website: https://ico.org.uk/concerns/

If you have any questions about the data held please contact Gerry Barber via the contact information on this website.

Please note that proof of identity is required should you choose to exercise any of the above rights in relation to personal data.

We retain the right to update this policy at any time. If there are changes that significantly impact your rights, we will contact you in advance.