Privacy Policy

YOUR LEGAL RIGHTS:

​

Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please email us at compliance@ramseylomax.co.uk

​

 

YOUR RIGHT TO BE INFORMED:

​

The right to be informed encompasses our obligation to provide ‘fair processing information’, typically through a privacy notice. It emphasises the need for transparency over our uses of personal data.

The information we will supply relating to the processing of personal data must be:

• Concise, transparent, intelligible and easily accessible;

• Written in clear and plain language, particularly if addressed to a child; and

• Free of charge.

The use of data, including how we protect and store data, will be made readily available to individuals through our privacy notice on our website.

What information must be supplied?

The below summarises the information we should supply to individuals and at what stage:

• We need to provide full contact details of our firm (and where applicable, the controller’s representative) and the data protection officer;

• We need to detail the purpose of the processing and the legal basis for the processing;

• We need to include the legitimate interests of the controller or third party, where applicable;

• List the categories of personal data;

• We need to detail any recipient or categories of recipients of the personal data;

• We need to include details of transfers to third country and safeguards;

• We need to include our retention period or criteria used to determine the retention period;

• We need to include the existence of each of data subject’s rights;

• We need to inform the customer of their right to withdraw consent at any time, where relevant;

• We need to inform the customer of their right to lodge a complaint with a supervisory authority;

• We are to inform the customer of the source the personal data originates from and whether it came from publicly accessible sources;

• Whether the provision of personal data part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data; and

• We are to include the existence of automated decision making, including profiling and information about how decisions are made, the significance and the consequences.

​

 

YOUR RIGHT TO ACCESS:

​

The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source.

(h) Information on the existence of automated decision making, including profiling, and providing meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data is transferred to a third country outside the EEA or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

Such safeguards include:

A legally binding and enforceable instrument between public authorities or bodies; and

Binding corporate rules in accordance with Article 47.

When requested, the controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. The right to obtain a copy shall not adversely affect the rights and freedoms of others.

​

​

YOUR RIGHT TO RESTRICT PROCESSING:

​

Under the DPA, individuals have a right to ‘block’ or suppress processing of personal data. The restriction of processing under the GDPR is similar, as detailed in Articles 18 (Right to restriction of processing) and 19 (Notification obligation regarding rectification or erasure of personal data or restriction of processing) respectively.

When processing is restricted, we are permitted to store the personal data, but not process it further. We can retain just enough information about the individual to ensure that the restriction is respected in future. This needs to be applied and communicated to each data processor where applicable and documented where appropriate.

When does the right to restrict processing apply?

We are required to restrict the processing of personal data in the following circumstances:

• Where an individual contest the accuracy of the personal data, we should restrict the processing until we have verified the accuracy of the personal data. We would do this by asking the individual to confirm the information is correct and where required update accordingly.

• Where an individual has objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and we are considering whether our organisation’s legitimate grounds override those of the individual. This can only be confirmed by way of evidenced consent from the individual or for the purpose of criminal proceedings.

• When processing is unlawful, and the individual opposes erasure and requests restriction instead, we are obliged to ensure this request is documented and the data collected is only used for the intent on which it was originally collected for, and not process it further.

• If we no longer need the personal data but the individual requires the data to establish, exercise or defend a legal claim. We would ask the individual to submit a DSAR and release the data upon receipt and in accordance with the DSAR procedure.

• We may need to review procedures to ensure we are able to determine where you may be required to restrict the processing of personal data.

• If we have disclosed the personal data in question to third parties, we must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so. We must inform individuals when we decide to lift a restriction on processing.

​

​

YOUR RIGHT TO OBJECT:

​

Individuals have the right to object to:

• Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);

• Direct marketing (including profiling); and

• Processing for purposes of scientific/historical research and statistics.

•  

How to comply with the right to object?

If we process personal data for the performance of a legal task or our organisation’s legitimate interests Individuals must have an objection on “grounds relating to his or her particular situation”.

We must stop processing the personal data unless:

• We can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or

• the processing is for the establishment, exercise or defence of legal claims.

We must inform individuals of their right to object “at the point of first communication” and in our privacy notice.

This must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.

If we process personal data for direct marketing purposes

We must stop processing personal data for direct marketing purposes as soon as we receive an objection. There are no exemptions or grounds to refuse.

We must deal with an objection to processing for direct marketing at any time and free of charge.

We must inform individuals of their right to object “at the point of first communication” and in your privacy notice.

This must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.

If we process personal data for research purposes

Individuals must have “grounds relating to his or her particular situation” in order to exercise their right to object to processing for research purposes.

If we are conducting research where the processing of personal data is necessary for the performance of a public interest task, we are not required to comply with an objection to the processing.

If our processing activities fall into any of the above categories and are carried out online:

We must offer a way for individuals to object online.