The DPA (Data Protection Act) 2018 and UK GDPR (General Data Protection Regulation) and the EU GDPR (If applicable) with effect from 25t May 2018
PRIVACY POLICY FOR IP INSOLVENCY LIMITED
IP Insolvency is a limited company of Insolvency Practitioners.
We mainly process personal data in order to comply with the legal and statutory obligations placed on us as office-holders in formal insolvency appointments.
We process personal data for a number of purposes and the means of collections, lawful basis of processing, use and retention periods for each purpose may differ.
The privacy of your personal data is very important to us. The collection and processing of personal data by IP Insolvency is governed by the General Data Protection Regulation (the “GDPR'”) IP Insolvency complies with its obligations by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, mis-use, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
This privacy policy explains:
- What constitutes ‘personal data’
- Who we collect personal data’ from
- How we process personal data
- Who we share your data with
- What measures we take to keep your data private and secure
- Your rights
- Who to contact if you have any queries or concerns about any personal data we may store about you
Personal data – What is it?
Personal data is any information which identifies you as a living individual. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession.
This may include name, address, phone numbers, email addresses, employee details, dates of birth, creditor contact details, debtor contact details, professional adviser contact details and any other stakeholder contact details.
We will only collect personal data that we need in order to fulfil our legal and statutory obligations, and to deliver our services as Insolvency Practitioners. We will not misuse, transfer or sell any personal data.
Who we collect Personal data from?
We collect personal data from:
Directors / Employees / Professional Advisers / Stakeholders
We never sell personal data.
How do we process your personal data
We will only process your ‘personal data’ for legitimate purposes, as set out in the GDPR and the UK Data Protection Act.
If asked by the police, or any other regulatory or government authority investigating suspected illegal activities, we may be obliged to provide them with your personal data.
Sharing your personal data?
Your personal data will be treated as strictly confidential.
We do not share your personal data with any third parties for commercial purposes. We only share personal data with third parties in order to comply with our legal and statutory obligations as Insolvency Practitioners. When we do share personal data with third parties, we take measures to ensure they are compliant with GDPR and there are appropriate measures and controls in place to keep your data secure.
Keeping your data safe and secure
We undertake the following measures to ensure the personal data we hold is kept safe and secure:
- We maintain an Information Asset Register which details the data, including personal data we hold, the staff responsible, who has access, how access is secured and how long the data is retained.
- Senior managers are responsible for undertaking regular data audits and developing and implementing a set of data handling instructions to ensure their teams process and secure ‘personal data’ in accordance with guidelines
- Our IT support suppliers undertake regular audits and implement appropriate measures to minimise the risk of cyber attacks
- All new staff receive training on the importance of data protection at their induction and regularly thereafter to re-inforce their responsibilities
- We only use and retain information for as long as it is required for the purpose it was collected for and in order to comply with legal and statutory requirements. Our retention periods are set out in the Information Asset Register.
- Once we no longer require personal data, it will be deleted in accordance with the timeframes set out in the Data Retention, Archiving and Deletion Policy
Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:
- The right to request a copy of your personal data which we hold about you;
- The right to request that we correct any personal data if it is found to be inaccurate or out of it date;
- The right to request your personal data is erased where it is no longer necessary for us to retain such data;
- The right to withdraw your consent to processing at any time;
- The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability);
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data, (where applicable); The right to lodge a complaint with the Information Commissioner’s Office.
If you would like further information on your rights, please write to the Data Protection Officer, John Pearson of IP Insolvency Limited, Station House, Midland Drive, Sutton Coldfield, West Midlands B72 1TU or by email at ipinsolvency@gmail.com
What to do if you are not happy
In the first instance, please talk to us directly so we can try and resolve your issue.
You also have the right to contact the Information Commissioner’s Office (ICO) if you have any questions about Data Protection.
You can contact them using their help line0303 123 113, or by post at: Information Commissioner’s Office, Wyclife House, Water lane, Wilimslow, Cheshire SK9 5AF or at www.lco.org.uk
Updating this policy
If we wish to use your personal data for a new purpose, not covered by this Privacy Policy, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
