Please find below information on our latest company information regards the latest changes in line with GDPR.
Data Protection Statement (Privacy Notice)
We’re updating our Data Protection Statement to take account of the new General Data Protection
Regulation (GDPR) which takes effect in the UK from 25 May 2018.
This Data Protection Statement will give you some important information on how we will process
your personal information. It applies from when you receive this information (though some of the
rights mentioned in it are only relevant on and after 25 May 2018)
Introduction
Your personal data is data which by itself or with other data available to us can be used to identify
you. We are Carn Software Ltd, the data controller. This data protection statement sets out how we
will use your personal data. You can contact our Data Protection Officer (DPO) at Carn House, 31
Academy Street, Coatbridge, ML5 3AW if you have any queries.
The types of personal data we collect and use
The personal data we use may include:
• Full name and personal details including contact information (address, email address,
telephone number, NI number)
• Financial details (bank account and sort code numbers)
Providing your personal data
We will tell you if providing some of your personal data is optional, including if we ask for your
consent to process it. In all other cases you must provide your personal data so we can process it.
Monitoring of communications
Subject to applicable laws, we will monitor your emails and any correspondence in relation to your
dealings with us.
Using your personal data: the legal basis and purposes
We will process your personal data:
1. As necessary to perform our contract with you
a. To provide support to you
b. To solve problems you encounter
c. To provide ongoing updates to your software
2. As necessary for our own legitimate interests
a. For good governance, accounting, managing and auditing our business operations
b. To send you marketing communications
3. Based on your consent
a. To send you marketing communications where we have asked for your consent to
do so
You are free at any time to change your mind and withdraw your consent. The consequence might
be that we cannot do certain things for you.
Sharing of your personal data
Subject to applicable data protection laws we may share your personal data with:
• Our legal and professional advisors, including our auditors;
• Anyone else where we have your consent or as required by law;
• To protect the security or integrity of our business operations;
• Our employees.
International Transfers
We will not transfer your data outside the UK or the European Economic Area.
Criteria used to determine retention periods
The following criteria are used to determine retention period for your personal data:
• Retention in case of problem solving. We will retain your personal data as long as necessary
to deal with your problem. Once the problem has been solved, we will delete your data
within 3 weeks.
• Retention in case of legal requirements. We will retain your personal data after your
account has been closed or has otherwise come to an end based on our legal requirements.
Data Anonymisation
When we process your personal data to solve your problems, we will anonymise the data in such a
way to make it impossible to identify you. This anonymisation will cover your name, address, contact
details (including but not limited to telephone numbers, email addresses) and bank details.
Your rights under applicable data protection law
Your rights are as follows (noting that these rights don’t apply in all circumstances and that data
portability is only relevant from May 2018):
• The right to be informed about our processing of your personal data;
• The right to have your personal data corrected if it’s inaccurate and to have incomplete
personal data completed;
• The right to object to processing of your personal data;
• The right to restrict processing of your personal data;
• The right to have your personal data erased (the “right to be forgotten”);
• The right to move, copy or transfer your personal data (“data portability”); and
• The right to request access to your personal data and information about how we process it.
You have the right to complain to the Information Commissioner’s Office. It has enforcement powers
and can investigate compliance with data protection law: ico.co.uk
For more details on the above you can contact our Data Protection Officer (DPO).
Data Protection Policy
Context and Overview
Key Details
• Policy Prepared by Neil Kelly
• Approved by Management on: 30/03/2018
• Policy became operational on: 01/04/2018
• Next review date: 01/04/2019
Introduction
Carn Software Ltd needs to gather and use certain information about individuals.
These can include customers, suppliers, business contact, employees and other people the
organisation has a relationship with or may need to contact.
This policy describes how this personal data must be collected, handled and stored to meet the
company’s data protection standards – and to comply with the law.
Why this policy exists
This data protection policy ensures Carn Software Ltd:
• Complies with data protection law and follow good practice
• Protects the rights of staff, customers and partners
• Is open about how it stores and processes individuals’ data
• Protects itself from the risks of a data breach
Data protection law
The Data Protection Act 1998 (and subsequent General Data Projection Regulations 2018) describes
how organisations – including Carn Software Ltd – must collect, handle and store personal
information.
These rules apply regardless of whether data is stored electronically, on paper or on other materials.
To comply with the law, personal information must be collected and used fairly, stored safely and
not disclosed unlawfully.
The Data Protection Act is underpinned by eight important principles. These say that personal data
must:
1. Be processed fairly and lawfully
2. Be obtained only for specific, lawful purposes
3. Be adequate, relevant and not excessive
4. Be accurate and kept up to date
5. Not be held for any longer than necessary
6. Processed in accordance with the rights of data subjects
7. Be protected in appropriate way
8. Not be transferred outside the European Economic Area (EEA), unless that country or
territory also ensures an adequate level of protection
People, risks and responsibilities
Policy scope
This policy applies to:
• The head office of Carn Software Ltd
• All staff and volunteers of Carn Software Ltd
• All contracts, supplies and other people working on behalf of Carn Software Ltd
It applies to all data that the company holds relating to identifiable individuals, even if that
information technically falls outside of the GDPR. This can include:
• Names of individuals
• Postal addresses
• Email addresses
• Telephone numbers
• … plus any other information relating to individuals
Data protection risks
This policy helps to protect Carn Software Ltd from some very real data security risks, including:
• Breaches of confidentiality. For instance, information being given out inappropriately.
• Failing to offer choice. For instance, all individuals should be free to choose how the
company uses data relating to them.
• Reputational damage. For instance, the company could suffer if hackers successfully gained
access to sensitive data.
Responsibilities
Everyone who works for or with Carn Software Ltd has some responsibility for ensuring data is
collected, stored and handled appropriately.
Each team that handles personal data must ensure that is handled and processed in line with this
policy and data protection principles.
However, these people have key areas of responsibility:
• The Directors are ultimately responsible for ensuring that Carn Software Ltd meets its legal
obligations.
• The Data Protection Officer is responsible for:
o Keeping the directors updated about data protection responsibilities, risks and
issues.
o Reviewing all data protection procedures and related policies, in line with an agreed
schedule.
o Arranging data protection training and advice for the people covered by this policy.
o Handling data protection questions from staff and anyone else covered by this
policy.
o Dealing with requests from individuals to see the data Carn Software Ltd holds about
them (also called “subject access requests”).
o Checking and approving any contracts or agreements with third parties that may
handle the company’s sensitive data.
• The IT Manager, is responsible for:
o Ensuring all systems, services and equipment used for storing data meet acceptable
security standards.
o Performing regular checks and scans to ensure security hardware and software is
functioning properly.
o Evaluating any third-party services the company is considering using to store or
process data. For instance, cloud computing services.
General Staff Guidelines
• The only people able to access data covered by this policy should be those who need it for
their work.
• Data should not be shared informally. When access to confidential information is required,
employees can request it from their line manager.
• Carn Software Ltd will provide training to all employees to help them understand their
responsibilities when handling data.
• Employees should keep all data secure, by taking sensible precautions and following the
guidelines below.
• In particular, strong passwords must be used and they should never be shared.
• Personal data should not be disclosed to unauthorised people, either within the company or
externally.
• Data should be regularly reviewed and updated if it is found to be out of date. If no longer
required, it should be deleted and disposed of.
• Employees should request help from their line manager of the data protection officer if they
are unsure about any aspect of data protection.
Data Storage
These rules describe how and where data should be safely stored. Questions about storing data
safely can be directed to the IT manager.
When data is stored on paper, it should be kept in a secure place where unauthorised people cannot
see it.
These guidelines also apply to data that is usually stored electronically but has been printed out for
some reason:
• When not required, the paper or files should be kept in a locked drawer or filing cabinet.
• Employees should make sure paper and printouts are not left where unauthorised people
could see them, like on a printer.
• Data printouts should be shredding and disposed of securely when no longer required.
When data is stored electronically, it must be protected from unauthorised access, accidental
deletion and malicious hacking attempts:
• Data should be protected by strong passwords that are changed regularly and never shared
between employees.
• If data is stored on removable media (like a CD, DVD, USB), these should be kept locked
away securely when not being used.
• Data should only be stored on designated drives and servers, and should only be uploaded
to an approved cloud computing services.
• Servers containing personal data should be sited in a secure location.
• Data should be backed up frequently. Those backups should be tested regularly, in line with
the company’s standard backup procedures.
• Data should never be saved directly to laptops or other mobile devices like tablets or smart
phones.
• All servers and computers containing data should be protected by approved security
software and a firewall.
Data use
Personal data is of no value to Carn Software Ltd unless the business can make use of it. However, it
is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or
theft:
• When working with personal data, employees should ensure the screen of the computers
are always locked when left unattended.
• Personal data should not be shared informally. In particular, it should never be sent by
emails, as this form of communication is not secure.
• Data must be encrypted before being transferred electronically. The IT manager can explain
how to send data to authorised external contacts.
• Personal data should never be transferred outside of the European Economic Area.
• Employees should not save copies of personal data to their own computers. Always access
and update the central copy of any data.
Data accuracy
The law requires Carn Software Ltd to take reasonable steps to ensure data is kept accurate and up
to date.
The more important it is that the personal data is accurate, the greater the effort Carn Software Ltd
should put into ensuring its accuracy.
It is the responsibility of all employees who work with data to take reasonable steps to ensure it is
kept as accurate and up to date as possible.
• Data will be held in as few places as necessary. Staff should not create any unnecessary
additional data sets.
• Staff should take every opportunity to ensure data is updated. For instance, by confirming a
customer’s details when they call.
• Data should be updated as inaccuracies are discovered. For instance, if a customer can no
longer be reached on their stored telephone number, it should be removed from the
database.
Subject access requests
All individuals who are the subject of personal data held by Carn Software Ltd are entitled to:
• Ask what information the company holds about them and why.
• Ask how to gain access to it.
• Be informed how to keep it up to date.
• Be informed how the company is meeting its data protection obligations.
If an individual contacts the company requesting this information, this is called a subject access
request.
Subject access requests from individual should be made by letter, addressed to the data protection
officer at Carn Software Ltd, Carn House, 31 Academy Street, Coatbridge, ML5 3AW.
The DPO will aim to provide the relevant data within 28 days.
The DPO will always verify the identity of anyone making a subject access request before handing
over any information.
Disclosing data for other reason
In certain circumstance, the GDPR allows personal data to be disclosed to law enforcement agencies
without the consent of the data subject.
Under these circumstances, Carn Software Ltd will disclose requested data. However, the data
protection officer will ensure the request is legitimate, seeking assistance from the Directs and the
from the company’s legal adviser where necessary.
Providing information
Carn Software Ltd aims to ensure that individuals are aware that their data is being processed, and
that they understand:
• How the data is being used
• How to exercise their rights
To these ends, the company has a privacy statement, setting out how data relating to indicial is used
by the company.