Information Security & Privacy Policy

Standards: BS ISO/IEC 27001: and BS10012-2017 (UK GDPR / DPA 2018)

About This Privacy Notice

Trans Data Management Ltd (“we”, “us”, “TDM”) takes your privacy and the protection of your personal data very seriously. We are committed to Data Protection and Information Security in accordance with the Data Protection Act 2018, the UK General Data Protection Regulation (“UK GDPR”), and our management standards BS ISO/IEC 27001:2013 and BS10012-2017.

This privacy notice applies to anyone accessing our website or providing personal data to us via our digital platforms. Our website is not intended for minors, and we do not knowingly collect data relating to individuals under the age of 18, except where we have put specific safeguards in place to do so lawfully.

This notice explains what information we may collect about you, how we may use it, and the steps we take to ensure it is kept secure. It also explains your rights in respect of your personal data and how to raise a query or complaint.

Please note that our website may contain links to third-party websites provided for your convenience. We are only responsible for the privacy practices of our own platforms. We recommend you check the privacy policies of any other website you visit.

We may update this notice at any time. The latest version will always be available on our website. If you have questions, please contact us using the details at the bottom of this page.

Information We May Collect About You

Personal data means any information relating to an identified or identifiable individual. This includes information such as your name, address, email address and telephone number. It may also include sensitive personal data such as information about health, biometric data, sexual orientation, trade union membership, religious or other beliefs, racial or ethnic origin, or criminal convictions.

When using our website or digital platforms, you may be asked to provide personal data including, but not limited to:

• Name and job title
• Organisation name
• Contact details: postal address, email address, telephone number
• Enquiry, feedback or complaint details
• Information provided in the course of a job or work experience application

How We Use Your Information and Why

We will only use your personal data as the law allows us to. The legal basis will vary depending on why we are processing your data. Most commonly, we will process your personal information where:

• We have a contractual obligation: under our contract with you, or to take steps at your request before entering into such a contract
• We have a legal obligation: for example, to comply with employment, tax or health and safety laws
• We have a legitimate interest: provided your interests and fundamental rights do not override those interests (see Your Rights below)
• We have your consent: in limited circumstances, subject to your right to withdraw consent at any time

Specifically, we may use your personal data to:

• Respond to enquiries, complaints or other communications you submit to us
• Fulfil contractual and operational obligations relating to our data management services
• Process job or work experience applications and assess your suitability. Recruitment data may also be used to notify you of future opportunities for up to 3 years, with your consent
• Improve the functionality and user experience of our website and digital platforms
• Comply with applicable laws and regulations
• Send promotional or marketing information about our services (you may opt out at any time)
• Analyse anonymised usage data to improve our services. We will only share anonymised data with third parties for this purpose

We will only use your personal information for the purposes for which we collected it. If we need to use it for an unrelated purpose, we will notify you and explain the lawful basis for doing so.

In respect of direct marketing, you have the right at any time to object, unsubscribe, withdraw consent, or ask for your data to be deleted. Please use the contact details below.

If You Fail to Provide Personal Data

Where we need to collect personal data from you in order to comply with a legal obligation, respond to your enquiry, or perform a contract, and you do not provide that data when requested, we may not be able to respond or deliver the relevant service or fulfil our contractual obligations to you.

Who We Share Your Information With

We do not sell your personal data. We may share your information only in the following circumstances:

• Service providers and processors: organisations that provide services to us or act on our behalf, such as IT providers, platform providers or technical experts, on the strict understanding they keep information confidential and use it only for the specified purpose
• Legal or regulatory requirements: any third party to whom we have a duty to disclose information to satisfy legal or regulatory obligations, for example HMRC
• Within the TDM business: where required for legitimate operational purposes

All third-party service providers who process personal data on our behalf are required to have appropriate technical and organisational security measures in place. We do not permit them to use your data for their own purposes.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, in accordance with UK GDPR requirements.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, explaining the nature of the breach and the steps we are taking to address it.

International Transfers

Trans Data Management Ltd processes and stores personal data primarily within the United Kingdom. Where it is necessary to transfer personal data outside the UK, we will ensure it receives equivalent protection by implementing at least one of the following safeguards:

• Transferring only to countries or territories deemed by the ICO to provide an adequate level of protection, or
• Putting in place standard contractual clauses adopted or approved by the ICO between us and the recipient organisation

How Long We Hold Your Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law or regulation. As a general guide:

• Enquiries and correspondence: retained for the duration of the business relationship and a reasonable period thereafter
• Recruitment data: retained for up to 3 years after the conclusion of a recruitment process, with your consent for future opportunities
• Contractual records: retained in accordance with our contractual and statutory obligations

For details of specific retention periods, please contact us at the address below. We ensure timely and appropriate disposal of personal data that is no longer required.

Cookies

In common with many website operators, we use “cookies”, which are small text files placed on your device that allow us to recognise returning users, analyse site usage and improve functionality. Our cookies enable us to store information about the services and pages you interact with between visits.

When visiting our website you will be offered the option to accept all cookies or to adjust your cookie preferences. Please note that essential cookies cannot be declined as they are necessary for the website to function. Disabling other cookies may limit some functionality.

Cookies do not attach to your system or damage your files.

Your Rights

Under UK GDPR, you have a number of rights in respect of your personal information. You can exercise these rights at any time, free of charge, by contacting us using the details below. We will respond within one calendar month, or notify you if more time is needed due to complexity.

• Right to be Informed: to receive clear information about how and why we process your data. This notice fulfils that right.
• Right of Access: to request a copy of the personal data we hold about you, known as a Subject Access Request.
• Right to Rectification: to ask us to correct inaccurate data or complete incomplete data we hold about you.
• Right to Erasure: to request deletion of your data where it is no longer necessary, or where you have withdrawn consent. Certain legal obligations may prevent full erasure.
• Right to Restrict Processing: to ask us to pause processing of your data in certain circumstances, for example while accuracy is being established.
• Right to Object: to object to processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: to receive your data in a structured, commonly used, machine-readable format, or to ask us to transfer it to a third party where applicable.
• Rights regarding Automated Decisions: to be informed of and object to automated decision-making or profiling. We do not currently make automated decisions about individuals.

Where we process your data based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

Your Confirmation to Us

By providing personal data to us, you confirm that all information you supply is accurate and current. Please keep us informed if your personal information changes or if you believe information we hold about you is inaccurate.

Contact Us About Your Data

If you have any questions about how we use your personal data, wish to exercise your rights, or have a concern about this notice, please contact our data protection lead:

Trans Data Management Ltd Email: info@trans-data.co.uk

Making a Complaint

If you have a complaint regarding the handling of your personal data, we ask that you contact us directly in the first instance so we can work to resolve it. We will respond to complaints within 30 days of receipt.

If you remain dissatisfied after receiving our response, you have the right to complain to the Information Commissioner’s Office (ICO) at any time.

Trans Data Management Ltd