DATA PROTECTION AND CONFIDENTIALITY
WHO WE ARE
Sigma Management Development Limited (Sigma) are committed to protecting your personal data in line with the relevant legislation (“Data Protection Law”). The relevant legislation includes the General Data Protection Regulation (EU 2016/679) and the UK Data Protection Act 2018, as well as other potentially supporting legislation.
WHY THIS POLICY IS IMPORTANT
This policy is intended to provide information about how we will use (or “process”) personal data about individuals including our current, past and prospective clients, staff, suppliers and other third parties as well as visitors to our website. It also covers the way in which Sigma will handle personal data when it has access to the personal data in circumstances where a client is the data controller and Sigma is the data processor for its client. This will arise in respect of personal data processed pursuant to an agreement or other contract with our client.
This information is provided in accordance with the rights of individuals under Data Protection Law to understand how their data is used.
This Privacy Notice applies alongside any other information Sigma may provide about a particular use of personal data, for example when collecting data.
RESPONSIBILTY FOR DATA PROTECTION
Sigma has appointed Pat Davis to oversee its role as Data Protection Manager (DPM), who will deal with all requests and enquiries concerning Sigma’s use of your personal data (see section on Your Rights below) and endeavour to ensure that all personal data is processed in compliance with this policy and Data Protection Law.
Pat Davis may be contacted by:
- e-mail: Pat@thinksigma.co.uk
- telephone: 01189771855
- post: 4 The Courtyard, Denmark St, Wokingham, Berkshire, RG40 2AZ
WHY SIGMA NEEDS TO USE PERSONAL DATA
In order to carry out its ordinary duties to clients, Sigma may need to process personal data about current, past and prospective staff and clients as part of its daily operation.
Sigma will need to carry out some of this activity in order to fulfil legal rights, duties or obligations.
Other uses of personal data will be made in accordance with Sigma’s legitimate interests, provided that these are not outweighed by the impact on individuals, and provided it does not involve special categories of personal data.
Sigma expects that the following uses may fall within the category of its “legitimate interests”:
- Maintaining relationships with clients and the business community;
- For the purposes of management planning;
- For security purposes; and
- Where otherwise reasonably necessary for Sigma’s purposes, including to obtain appropriate professional advice and insurance.
TYPES OF PERSONAL DATA OBTAINED BY SIGMA
This will include by way of example:
- names, addresses, telephone numbers, e-mail addresses and other contact details;
- bank details and other financial information;
- access to personal data held by clients
HOW SIGMA COLLECTS DATA
Generally, Sigma receives personal data from the individual directly in the ordinary course of interaction or communication (such as verbally, by e-mail or by written documents).
However in some cases personal data may be supplied by third parties (for example an employer or customer)
DATA COLLECTED THROUGH THE SIGMA WEBSITE
Sigma may collect the following information from visitors to its website:
- IP addresses and information about the location of the visitor
- the way that a visitor uses the website, including the pages viewed, dates, times and duration
- data to show where visitors navigated to or from our website and searches made on our website.
This data is used to enable Sigma to:
- run the website ensuring that it works properly
- improve the information on the website
- maintain the website’s security
WHO HAS ACCESS TO PERSONAL DATA AND WHO SIGMA SHARES IT WITH
Occasionally, Sigma will need to share personal information with third parties, such as professional advisers (lawyers and accountants) or relevant authorities such as the police.
For the most part, personal data collected or accessed by Sigma will remain within the company, and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a “need to know” basis). Sigma will where appropriate ensure that their personnel access or Personal Data is only for the purpose of performing services to clients in accordance with instructions given by the clients to Sigma from time to time.
In accordance with Data Protection Law, some of Sigma’s processing activity is carried out on its behalf by third parties, such as cloud services and storage providers. This is always subject to undertakings from such third parties that personal data will be kept securely and only in accordance with Sigma’s specific direction.
Sigma shall not cause or allow Personal Data to be transferred and/or processed in a country or territory which is outside of the European Economic Area without prior written consent.
HOW LONG SIGMA KEEPS PERSONAL DATA
Sigma will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason.
If you have any specific queries about how this policy is applied, or wish to request that personal data that you no longer believe to be relevant is considered for erasure, please contact the DPM. However, please bear in mind that Sigma may have lawful and necessary reasons to hold on to some data.
Sigma has implemented and shall maintain appropriate technical and organisational security measures, processes and controls to safeguard all Personal Data processed by them against unauthorised and unlawful processing and accidental loss, disclosure or destruction.
Sigma acknowledges that in the provision of its services, it may have access to a client’s confidential information concerning their business affairs, customers or suppliers.
Sigma undertakes that it shall not at any time disclose to any person any confidential information belonging to the client and shall ensure that its staff, officers, representatives or advisers to whom it discloses a client’s confidential information complies with this clause.
Sigma may however disclose confidential information to the extent that such confidential
information is required to be disclosed by law, by any government or other regulatory authority or by a Court or other authority of competent jurisdiction provided that, to the extent it is legally permitted to do so, it gives the client as much notice of such disclosure as possible.
Sigma shall notify a client when it becomes aware of or suspects that a data breach has taken place. Such notification will be made within 24 hours of Sigma becoming aware of the breach save where the breach comes to the attention of Sigma during a weekend or bank holiday when the notification will be made to the client by 10am of the next business day. The notification will include a description of the data breach, the date and time of the breach, the type of data affected by the breach, an explanation of how the breach occurred and details of how and when Sigma first became aware of the breach. In circumstances where there has been a breach Sigma will provide all reasonable advice and assistance to the client involved in a timely manner.
Individuals have various rights under Data Protection Law to access and understand personal data about them held by Sigma, and in some cases ask for it to be erased or amended or for Sigma to stop processing it, but subject to certain exemptions and limitations.
Any individual wishing to access or amend their personal data, or wishing it to be transferred to another person or organisation should put their request in writing to the DPM.
Sigma will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within the statutory time-limits, which is one month in the case of requests for access to information. Sigma will be better able to respond quickly to smaller, targeted requests for information. If the request is manifestly excessive or similar to previous requests, Sigma may ask you to reconsider or charge a proportionate fee, but only where Data Protection Law allows it. Sigma shall also provide its clients with such assistance as the client reasonably requests in order to comply with its obligations and to fulfil a data subject’s rights.
You should be aware that certain data is exempt from the right of access. This may include information which identifies other individuals or information which is subject to legal professional privilege.
Where Sigma is relying on consent as a means to process personal data, any person may withdraw this consent at any time. Please be aware however that Sigma may have another lawful reason to process the personal data in question even without your consent. That reason will usually have been asserted under this Data Protection and Confidentiality provision or may otherwise exist under some form of contract or agreement with the individual (for example: an employment contract).
DATA ACCURACY AND SECURITY
Sigma will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible. Individuals must please notify the DPM of any changes to information held about them.
An individual has the right to request that any inaccurate or out-of-date information about them is erased or corrected (subject to certain exemptions and limitations under Act): please see above.
Sigma will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to company systems. All staff will be made aware of this policy and their duties under Data Protection Law.
QUERIES AND COMPLAINTS
Any comments or queries on this policy should be directed to the DPM.
If an individual believes that Sigma has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should notify the DPM. An individual can also make a referral to or lodge a complaint with the Information Commissioner’s Office (“ICO”), although the ICO recommends that steps are taken to resolve the matter with Sigma as the Data Controller or Processor before involving the regulator.