Policy 19: Data Protection Policy

Simplyfruit (Ire) Limited needs to gather and use personal information about many individuals in the course of our business.

These can include candidates, employees, workers, clients, suppliers, business contacts, and other people we have a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled and stored to meet data protection standards and to ensure that as a Data Controller and Data Processor we comply with data protection law.

Why this policy exists

This data protection policy ensures Simplyfruit (Ire) Limited:

• Complies with data protection law and follows good practice.
• Protects the rights of candidates, employees, workers, clients, suppliers and business contacts.
• Is open about how it stores and processes individuals’ data.
• Protects the organisation from the risks of a data breach.

Data protection law

The General Data Protection Regulation [EU 2016/679) (GDPR) regulates how organisations collect, handle and store personal information.

These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully. The GDPR is underpinned by six important principles to which Simplyfruit (Ire) Limited will adhere to. These say that personal data shall be:

1. Processed lawfully, fairly and in a transparent manner in relation to individuals;
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Policy scope

This policy applies to:

• All offices and workplaces within Simplyfruit (Ire) Limited.
• All candidates, employees, workers, clients, suppliers, business contacts and other people working with, for or on behalf of Simplyfruit (Ire) Limited.

It applies to all data that we hold relating to identifiable individuals. This can include for example:

• Names of individuals, Postal/email addresses, telephone numbers.
• Sensitive personal data such as information in relation to physical or mental health conditions, religious beliefs, ethnic origin, genetic data and biometric data.

Data Protection Risks

This policy helps to protect Simplyfruit (Ire) Limited from some very real data security risks, including:

• Breaches of confidentiality – for instance, information being given out inappropriately about our clients or staff.
• Failing to offer choice – for instance, all individuals should be free to choose how the organisation uses data relating to them.
• Damage – for instance, Simplyfruit (Ire) Limited could suffer significant reputational and financial damage if hackers successfully gained access to the personal data of our staff or clients.

Responsibilities

Everyone who works for or with Simplyfruit (Ire) Limited has some responsibility for ensuring data is collected, stored and handled appropriately.

Everyone who handles personal data must ensure that it is handled and processed in line with this policy and data protection principles. Failure by staff to comply with the data protection policy and principles could result in disciplinary action.

However, the following have key areas of responsibility:

• The Operations Director is ultimately responsible for ensuring that Simplyfruit (Ire) Limited meets its legal obligations.
• Data Protection Co-ordinator is responsible for Data Protection compliance including the following.
• Keeping updated about data protection responsibilities, risks and issues
• Reviewing all data protection procedures and related policies, in line with an agreed schedule.
• Arranging data protection training and advice for the people covered by this policy.
• Dealing with requests from individuals to see the data we hold about them (also called “subject access requests”).
• Checking and approving any contracts or agreements with third parties that may handle the firm’s sensitive data.
• External I.T. consultant is responsible for:
  • Ensuring all systems, services and equipment used for storing data meet acceptable security standards.
  • Performing regular checks and scans to ensure security hardware and software is functioning properly.
  • Ensuring all personal and company data is non-recoverable from any computer system previously used within the organisation, which has been passed on/sold to a third party.
  • Evaluating any third party services the company is considering using to store or process data. For instance, cloud computing services.
• Data Protection Co-ordinator is also responsible for:
  • Approving any data protection statements attached to communications to service users, staff and third parties.
  • Addressing any data protection queries from journalists or media outlets like newspapers.
  • Where necessary, working with other staff to ensure marketing initiatives abide by data protection principles.

General Staff Guidelines

• The only people able to access data covered by this policy should be those who need it for their work.
• Personal Data should not be shared informally and must only be used for the purpose for which it is was given to us.
• Simplyfruit (Ire) Limited will provide training to all employees to help them understand their responsibilities when handling data.
• Employees should keep all data secure, by taking sensible precautions and following the guidelines below.
• In particular, strong passwords must be used and changed regularly; they should never be shared.
• Personal data relating to staff, clients or third parties should never be shared with or disclosed to unauthorised people, either within Simplyfruit (Ire) Limited or externally.
• When receiving telephone enquiries, we should only disclose personal data we hold on our systems if the following conditions are met:

We will check the caller's identity to make sure that information is only given to a person who is entitled to it.

We will suggest that the caller put their request in writing if we are not sure about the caller’s identity and where their identity cannot be checked.

Our employees will refer a request to their line manager for assistance in difficult situations. Employees should not be pressurised into disclosing personal information.

• Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
• Employees should request help from the Operations director if they are unsure about any aspect of data protection.

Data Collection & Processing

Simplyfruit (Ire) Limited will ensure that data is collected and processed within the boundaries defined in this policy. This applies to data that is collected in person, digitally or in hard copy.

Simplyfruit (Ire) Limited will only collect and process personal data on the basis of one or more of the following lawful grounds:

(a)  the Individual has given his or her Consent;

 (b)  the Processing is necessary for the performance of a contract with the Individual;

 (c)  to comply with our legal obligations.;

 (d)  to protect the individual’s vital interests;

 (e)  to pursue our legitimate interests for purposes where the interests or fundamental rights and freedoms of the individual do not override those interests.

 (f)  for public interest reasons.

(g) where it is necessary for carrying out rights and obligations under employment law.

Informed consent is when

• A person clearly understands why their information is needed, who it will be shared with, the possible consequences of them agreeing or refusing the proposed use of the data And then gives their informed and unambiguous consent.

When collecting data for business and employment purposes, Simplyfruit (Ire) Limited will ensure that the individual

1. Has received sufficient information on why their data is needed and how it will be used.
2. Is made aware what the data will be used for, the lawful basis for processing the information and what the consequences are should the individual decide not to give consent to processing
3. When required, is asked for explicit consent, either written or verbal for data to be processed
4. Is, as far as reasonably practicable, competent enough to give consent and has given so freely without any duress
5. In the absence of valid consent (that which is freely given, specific, informed and unambiguous) or where consent is not required, has received information as to the lawful basis for processing their information.

Processing in line with Data Subject’s Rights

We will process all personal data in line with data subjects' rights, in particular their right to:

Request access to data held about them by a data controller and to check that we are lawfully processing it.

Prevent the processing of their data for direct-marketing purposes.

Ask to have inaccurate data corrected or erased.

Object to processing of personal information where we are relying on a legitimate interest (or those of a third party)

Prevent processing that is likely to cause damage or distress to themselves or anyone else.

Request the transfer of personal information to another party

Data Storage

These rules describe how and where data should be safely stored and the security measures implemented by Simplyfruit (Ire) Limited. Questions about storing data safely can be directed to Data Protection Co-ordinator.

When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it. These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:

• When not required, the paper or files should be kept in a locked drawer or filing cabinet.
• Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
• Data printouts should be shredded and disposed of securely when no longer required.
• A “clear desk” policy is in effect. All data stored on paper should be returned to the appropriate drawer or filing cabinet at the end of the day and no papers should be unnecessarily left on desks during the day.

When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:

• Data should be protected by strong passwords that are changed regularly and never shared between employees.
• Data should only be stored on designated drives and servers and should only be uploaded to an approved cloud computing service.
• Servers containing personal data should be sited in a secure location, away from general office space.
• Data is backed up frequently. These backups are tested regularly in line with standard backup procedures. [See IT Policy].
• Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
• All servers and computers containing data are protected by approved security software and a firewall. [See IT Policy]

Data Retention and Secure Destruction

Personal data will not be retained longer than necessary, in relation to the purpose for which such data is processed. Simplyfruit (Ire) Limited will ensure that secure storage/archiving periods are clearly defined for each type of data and confidential destruction of data when no longer required, in accordance with the Data Retention policy.

Data Use

Data use is essential to all aspects of our business. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft and as such Simplyfruit (Ire) Limited adopts the following additional security measures:

• When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.
• Personal data should not be shared informally. In particular, employees should be particularly vigilant when sending data by e-mail as this form of communication is not secure.
• Financial Data, and in particular bank details must not be transferred electronically unless in encrypted form.
• Personal data should never be transferred outside of the European Economic Area without the approval of the Board and will only be permitted in the event that an adequate level of protection can be guaranteed.
• Employees should not save copies of personal data to their own computers. Always access and update the central copy of any data.
• Consideration will be given to the anonymization or pseudonymising of personal data if necessary to promote the safe use or sharing of data within the organisation

Data Accuracy

The law requires Simplyfruit (Ire) Limited to take reasonable steps to ensure data is kept accurate and up to date.

The more important it is that the personal data is accurate, the greater the effort we should put into ensuring its accuracy.

It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.

• Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.
• Staff should take every opportunity to ensure data is updated. For instance, by confirming client contact details on a regular basis.
• Simplyfruit (Ire) Limited will make it easy for data subjects to update the information we hold about them. For instance, via the company website.
• Data should be updated as inaccuracies are discovered.

Subject Access Requests

All individuals who are the subject of personal data held by Simplyfruit (Ire) Limited are entitled to:

• Ask what information the company holds about them and why.
• Ask how to gain access to it and to have inaccurate data corrected or erased.
• Be informed how Simplyfruit (Ire) Limited is meeting its data protection obligations.

If an individual contacts us requesting this information, this is called a subject access request.

Subject access requests from individuals should be made in writing (or email), addressed to, Data Protection Co-ordinator.

The DPC with responsibility for data protection compliance, will aim to provide the relevant data within 21 days and in any event within 1 month.

The Data Protection Co-ordinator will always verify the identity of anyone making a subject access request before handing over any information.

Disclosing data for other reasons

In certain circumstances, the GDPR allows personal data to be disclosed to local authorities, law enforcement and statutory agencies without the consent of the data subject. Under these circumstances, Simplyfruit (Ire) Limited will disclose the necessary data. However, the Data Protection Co-ordinator will ensure the request is legitimate, seeking assistance and approval from the Managing Director where necessary.

Individuals will be made aware in most circumstances how and with whom their information will be shared. There are however circumstances where the law allows Simplyfruit (Ire) Limited to disclose data (including sensitive data) without the data subject’s consent. These include carrying out a legal duty and protecting vital interests of an individual.

Simplyfruit (Ire) Limited regards the lawful and correct treatment of personal information as very important to successful working and to maintaining the confidence of those with whom we engage with in our business on a daily basis.

Providing information to Data Subjects

Simplyfruit (Ire) Limited aims to ensure that individuals are aware that their data is being processed and that they understand:

• How the data is being used.
• How to exercise their rights in relation to same.

To these ends, the organisation will issue privacy notices as appropriate to employees, candidates, clients and other individuals we have a relationship with or may need to contact, setting out how data relating to an individual is used by the organisation, how to exercise their rights in relation to same including options available and how to raise a complaint.

Security Breach Management

Simplyfruit (Ire) Limited has an incident response procedure in place so that any breach of data protection/GDPR can be acted upon immediately. The breach will be internally investigated with appropriate remedial action taken and where required, notification will further be made within 72 hours to the ICO and those individuals affected providing details of the nature of the breach, likely consequences and mitigations being taken to address same.

Review

This policy and related data protection procedures will be reviewed on an annual basis by Data Protection Co-ordinator to reflect best practice in data management, security and control and to ensure compliance with GDPR.

Glossary of Key Terms

Personal Data

Any information relating to an identifiable natural person ‘data subject’; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as: a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Sensitive Personal Data

Any data relating to: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health conditions, sexual life or sexual orientation, genetic data and/or biometric data. We process this data in respect of our both our service users and our staff.

A Data Subject

An individual who is the subject of personal data, not including deceased individuals or individuals who cannot be identified or distinguished from others – e.g. statistics.

Data Processing

The operation or set of operations performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data Controller

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing the data.

Data Processor

A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Privacy Notice for Staff

Simplyfruit is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice does not form part of your contract of employment and may be updated from time to time.

Data protection principles

The kind of information we hold about you

We will collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Date of birth, Gender, Marital status and dependants, Next of kin and emergency contact information, National Insurance number, copy driving licence.
• Bank account details, payroll records and tax status information, Salary, annual leave, pension and benefits information.
• Start date and, if different, the date of your continuous employment.
• Leaving date and your reason for leaving.
• Location of employment or workplace.
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
• Employment records (including job titles, work history, working hours, holidays, training records and professional memberships), performance information, disciplinary and grievance information, information about your use of our IT and communication systems.
• CCTV footage and photographs.

We may also collect, store and use the following more sensitive types of personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation, political opinions and Trade union membership.
• Information about your health, including any disability, medical condition, health and sickness records, including:
• details of any absences (other than holidays) from work including time on statutory parental leave and sick leave; and
• where you leave employment and the reason for leaving is related to your health, information about that condition needed for pensions and permanent health insurance purposes.
• Information about criminal convictions and offences.

How is your personal information collected?

We collect personal information about our staff through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including referees, former employers, credit reference agencies or other background check agencies. We may also collect personal information from the trustees or managers of pension arrangements operated by a third party.

We will collect additional personal information in the course of job-related activities throughout the period of you working for us.

How we will use information about you

Situations in which we will use your personal information

We need all your personal information to allow us to perform our contract with you, to comply with rights and obligations in relation to employment law and to enable us to comply with our legal obligations generally. In some cases we may use your personal information to pursue legitimate interests, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below.

• Making a decision about your recruitment or appointment and determining the terms on which you work for us.
• Checking you are legally entitled to work in the UK.
• Paying you and, if you are an employee or deemed employee for tax purposes, deducting tax and National Insurance contributions (NICs).
• Providing employment related or contractual benefits to you.
• Enrolling you in a pension arrangement in accordance with our statutory automatic enrolment duties.
• Liaising with the trustees or managers of a pension arrangement, your pension provider and any other provider of employee benefits.
• Administering the contract we have entered into with you.
• Business management and planning, including accounting and auditing.
• Conducting performance reviews, managing performance and determining performance requirements.
• Making decisions about salary reviews and compensation.
• Assessing qualifications for a particular job or task, including decisions about promotions.
• Gathering evidence for possible grievance or disciplinary hearings.
• Making decisions about your continued employment or engagement.
• Making arrangements for the termination of our working relationship.
• Education, training and development requirements.
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.
• Ascertaining your fitness to work.
• Managing sickness absence.
• Complying with health and safety obligations.
• To prevent fraud.
• To monitor your use of our information and communication systems to ensure compliance with our IT policies.
• To ensure network and information security, including preventing unauthorised or inappropriate access to our computer and electronic communications systems and preventing malicious software distribution.
• To conduct data analytics studies to review and better understand employee retention and attrition rates.
• Equal opportunities monitoring.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we use particularly sensitive personal information

Our obligations as an Employer

We will use your particularly sensitive personal information in the following ways:

• We will use information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws.
• We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits including statutory maternity pay, statutory sick pay, pensions and permanent health insurance.
• We will use information about your race or national or ethnic origin, religious belief, community background, age, marital status, gender or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
• We will use trade union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations.

Do we need your consent?

We do not need your consent if we use your personal information in accordance with our data protection policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. It is not a condition of your contract with us that you agree to any request for consent from us.

Information about criminal convictions

Data sharing

How secure is my information with third-party service providers and other entities in our group?

All our third-party service providers and any other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

What about other third parties?

We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymised or encrypted data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

Transferring information outside the EU

We may on occasion have cause to transfer the personal information we collect about you to countries outside the EU in order to perform our contract with you.

However, to ensure that your personal information does receive an adequate level of protection we will put in place appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection. If you require further information about this, you can request it from NAME, Data Protection Co-ordinator.

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from the Data Protection Co-ordinator.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from the Data Protection Co-ordinator. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance applicable laws and regulations.

Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact Data Protection Co-ordinator in writing.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Co-ordinator. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Data protection Compliance

Our Data Protection Co-ordinator, has been appointed to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact her. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.