GDPR Policy
Bijou Bangles Silver
Limited
GDPR/Privacy Statement
- May 2018.
Our Commitment
Bijou Bangles Silver Limited (BBS) is committed to ensuring the
security and protection of the personal information that we process, and to
provide a compliant and consistent approach to data protection. We have always
had a robust and effective data protection programme in place which complies
with existing law and abides by the data protection principles. However, we
recognise our obligations in updating and expanding this programme to meet the
demands of the GDPR and the UK’s Data Protection Bill.
BBS is dedicated to safeguarding
the personal information under our remit and in developing a data protection
regime that is effective, fit for purpose and demonstrates an understanding of,
and appreciation of the new Regulation. Our preparation and objectives for GDPR
have been summarised in this statement, to ensure ongoing compliance.
How We have Prepared for the GDPR
BBS already has a consistent
level of data protection and security.
Additional measures to comply with the new GDPR regulations include:
- Information
Audit - carrying out an information audit to identify and assess what personal
information we hold, where it comes from, how and why it is processed and if
and to whom it is disclosed.
- Policies
& Procedures – revising relevant policies and procedures to meet the
requirements and standards of the GDPR, including: -
- Data
Protection – our main policy and procedure document for data protection has
been overhauled to meet the standards and requirements of the GDPR. We understand our obligations and
responsibilities; with a dedicated focus on privacy by design and the rights of
individuals.
- Data
Retention & Erasure – we have updated our retention policy and schedule to
ensure that we meet the ‘data minimisation’ and ‘storage limitation’ principles
and that personal information is stored, archived and destroyed compliantly and
ethically. We have dedicated erasure procedures in place to meet the new ‘Right
to Erasure’ obligation and are aware of when this and other data subject’s
rights apply; along with any exemptions, response timeframes and notification
responsibilities.
- Data
Breaches – our breach procedures ensure that we have safeguards and measures in
place to identify, assess, investigate and report any personal data breach at
the earliest possible time. Our procedures have been disseminated to all
employees, making them aware of the reporting lines and steps to follow.
- International
Data Transfers & Third-Party Disclosures – we do not store any personal
information outside the EU.
- Subject
Access Request (SAR) – we have revised our SAR procedures to accommodate the
revised 30-day timeframe for providing the requested information and for making
this provision free of charge.
- Legal
Basis for Processing - we have reviewed all processing activities to identify
the legal basis for processing and ensuring that each basis is appropriate for
the activity it relates to.
- Privacy
Notice/Policy – we have revised our Privacy Notice(s) to comply with the GDPR,
ensuring that all individuals whose personal information we process have been
informed of why we need it, how it is used, what their rights are, who the
information is disclosed to and what safeguarding measures are in place to
protect their information.
- Obtaining
Consent - we have revised our consent mechanisms for obtaining personal data,
ensuring that individuals understand what they are providing, why and how we
use it and giving clear, defined ways to consent to us processing their
information. We have developed stringent processes for recording consent,
making sure that we can evidence an affirmative opt-in, along with time and
date records; and an easy to see and access way to withdraw consent at any
time.
- Direct
Marketing - we have revised the wording and processes for direct marketing,
including clear opt-in mechanisms for marketing subscriptions; a clear notice
and method for opting out and providing unsubscribe features on all subsequent
marketing materials.
- Data
Protection Impact Assessments (DPIA) – where we process personal information
that is considered high risk, involves large scale processing or includes
special category/criminal conviction data; we have developed procedures for
carrying out impact assessments.
- Processor
Agreements – where we use any third-party to process personal information on
our behalf (e.g. employee, payment or payroll information), we have compliant
processes and due diligence procedures for ensuring that they (as well as we),
meet and understand their/our GDPR obligations. These measures include initial
and ongoing reviews of the service provided, the necessity of the processing
activity, the technical and organisational measures in place and compliance
with the GDPR.
Data Subject Rights
In addition to the policies and
procedures mentioned above that ensure individuals can enforce their data
protection rights, we provide easy to access information via the office of an
individual’s right to access any personal information that BBS processes about
them and to request information about: -
• What
personal data we hold about them
• The
purposes of the processing
• The
categories of personal data concerned
• The
recipients to whom the personal data has/will be disclosed
• How
long we intend to store the personal data for
• If
we did not collect the data directly from them, information about the source
• The
right to have incomplete or inaccurate data about them corrected or completed
and the process for requesting this
• The
right to request erasure of personal data (where applicable) or to restrict processing
in accordance with data protection laws, as well as to object to any direct
marketing from us and to be informed about any automated decision-making that
we use
• The
right to lodge a complaint or seek judicial remedy and who to contact in such instances
Information Security & Technical and Organisational Measures
BBS takes the privacy and
security of individuals and their personal information very seriously and take
every reasonable measure and precaution to protect and secure the personal data
that we process. We have robust information security policies and procedures in
place to protect personal information from unauthorised access, alteration,
disclosure or destruction and have several layers of security measures.
GDPR Roles and Employees
BBS has designated Christine
Muchmore as our Appointed Person to implement our roadmap for complying with
the new data protection Regulations.
BBS understands that continuous
employee awareness and understanding is vital to the continued compliance of
the GDPR.
If you have any questions about
our preparation for the GDPR, please contact Christine Muchmore, via Bijou
Bangles Silver on: [email protected]