Data Management Policy

• Complies with data protection law and follows good practice
• Protects the rights of customers, staff and partners
• Is transparent about how it stores and processes individuals' data
• Protects itself from the risks of a data breach

Data protection law:
The General Data Protection Regulation (GDPR) applies in the UK and across the EU from May 2018. It requires personal data shall be:

• Processed lawfully, fairly and in a transparent manner in relation to individuals;
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered to be incompatible with the initial purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organizational measures required by GDPR in order to safeguard the rights and freedoms of individuals;
• Processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
  The controller shall be responsible for, and be able to demonstrate, compliance with the principles.

 

Everyone at SoniaDane.com (Brad and Sonia are everyone) contributes to compliance with GDPR. As the only decision makers, they understand the requirements and accountability of the organization sufficiently to prioritize and support the implementation of compliance. Sonia and Brad are solely responsible for compliance with the regulations. These responsibilities include (but are not necessarily limited to):

• Keeping senior management and board updated about data protection issues, risks and responsibilities
• Documenting, maintaining and developing the organization's data protection policy and related procedures, in line with agreed schedule
• Embedding ongoing privacy measures into corporate policies and day-to-day activities, throughout the organization and within each business unit that processes personal data. The policies themselves will stand as proof of compliance.
• Dissemination of policy across the organization, and arranging training and advice for staff
• Dealing with subject access requests, deletion requests and queries from clients, stakeholders and data subjects about data protection related matters
• Checking and approving contracts or agreements with third parties that may handle the company's sensitive data
• Ensuring all systems, services and equipment used for storing data meet acceptable security standards
• Performing regular checks and scans to ensure security hardware and software is functioning properly
• Evaluating any third party services the company is considering using to store or process data, to ensure their compliance with obligations under the regulations
• Developing privacy notices to reflect lawful basis for fair processing, ensuring that intended uses are clearly articulated, and that data subjects understand how they can give or withdraw consent, or else otherwise exercise their rights in relation to the companies use of their data
• Ensuring that audience development, marketing, fundraising and all other initiatives involving processing personal information and/or contacting individuals abide by the GDPR principles

Data Protection Officer (DPO) – the person responsible for fulfilling the tasks of the DPO in respect to SoniaDane.com is Brad Gravesen. The minimum tasks of the DPO are:

• To inform and advise the organization and its employees (we have none) about their obligations to comply with the GDPR and other data protection laws
• To monitor compliance with the GDPR and other data protection laws, including managing internal data protection activities, advise on data protection impact assessments; train staff (it's just us) and conduct internal audits
• To be the first (and only) point of contact for supervisory authorities and for individuals whose data is processed (employees, customers etc)

Scope of personal information to be processed

In this section you should detail:
the scope of the data you process, including whether you process any of the following:
names of individuals
postal addresses of individuals
email addresses
telephone numbers
online identifiers
any other information relating to individuals
where the data is collected from and stored
details of how you have made consideration to ensure that the data is accurate, (for example, what measures you have in place to check accuracy/duplication/completeness of data) relevant to the purpose, not excessive, up-to-date (for example, what measures you have in place to clean and update records) and not kept for longer than is necessary
When and how relevant data will be checked against industry suppression files, such as the telephone preference service, the mailing preference service and the fundraising preference service
Details of any sensitive special categories of personal information that it is necessary for SoniaDane.com to process. Describe the enhanced measures that are set in place to protect this information, and respect the rights and freedoms of the individuals to whom it relates

Uses and conditions for processing

Here, document the various specific types of processing that you carry out, intended purpose for that processing, the data to be processed and what is the lawful basis for processing, and how these conditions for processing are supported. Expand and add to the fields in the following table as required to give appropriate level of detail.

Consent
In cases where you rely on consent as the lawful condition for processing, you should be able to demonstrate and describe how you have reviewed your processes and systems to make sure that consent is freely and unambiguously given for specific purposes, and that you can evidence an affirmative action on the part of the data subject to have indicated consent, and such that data subjects can reasonably understand who is using their personal information, what information, and for what purposes, and using which communications channels. Do your practices and systems incorporate a suitable audit trail which would enable you to demonstrate how and when consent was obtained, upon request? Do your practices and systems communicate an individual's right to withdraw consent at any time, and do your processes and systems support the functionality to do so?
Where 'soft opt-in' is used in as the lawful basis for processing for electronic communications (email/SMS/automated-telephone) contact, you should record the notification statement detailing the intended use of personal information given at the point of collecting personal information during the course of sale or negotiation for sale which gave the customer the opportunity to opt out, and also how subsequently notify the customer of their right to unsubscribe with every following communication.
Where 'legitimate interest' is the lawful condition for processing, evidence should be given of the process by which the rights and freedoms of the individual have been weighed against the interests of the company, and how consideration/mitigation of the outcomes of the process have been made. How has the individual been informed of this processing, and what information have they been given to help them exercise their rights?