Our Privacy Notice

Your rights under the GDPR

You have a number of rights under the GDPR:

Access to personal information

You have the right to ask us what personal information we hold about you, and to request a copy of your information.  We have a form you can use for this purpose (available on our website), but this request can be made by email or over the phone. You can download a Subject Access Request Form here and return it to us at the address below.

We have one calendar month within which to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible). Following your SAR, we will provide you with a copy of the information we hold that relates to you. 

We will advise you if there is some information we cannot provide. This could be if your request is manifestly unfounded or excessive, or if it would adversely affect the rights and freedoms or others. We may also refuse if the request would cost too much or take too much staff time to deal with.

Rectification

If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting your Sales Negotiator or alternatively, contact the Business Improvement Team by email to [email protected], by post at Pilgrim House, High Street, Billericay, Essex CM12 9XY or by telephone on 0300 3032500.

Erasure (‘right to be forgotten’)

You have the right to ask us to delete personal information we hold about you.  You can do this where:

• the information is no longer necessary in relation to the purpose for which we originally collected/processed it
• where you withdraw consent
• where you object to the processing and there is no overriding legitimate interest for us continuing the processing
• where we unlawfully processed the information
• the personal information has to be erased in order to comply with a legal obligation

We can refuse to erase your personal information where the personal information is processed for the following reasons:

• to exercise the right of freedom of expression and information;
• to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
• for public health purposes in the public interest;
• archiving purposes in the public interest, scientific research historical research or statistical purposes;
• the exercise or defence of legal claims; or

Restriction on processing

You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

• You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
• You challenge whether we have a legitimate interest in using the information
• If the processing is  a breach of the GDPR or otherwise unlawful
• If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

Objection to processing

You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

Withdrawal of consent

You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.

Right to data portability

The right to data portability allows us to obtain and reuse your personal data across different services. It allows us to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. The right only applies to personal data you have provided to us where the reason we are relying on to use the information is either your consent or for the performance of a contract. It also only applies when processing is carried out by us using automated means.

Automatic Processing

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We do not make decisions based on automatic processing.