Data protection policy in accordance with the EU General Data Protection Regulation (GDPR)
Data Protection Policy
Lisa Tabor trading as ‘Tax Debts Help and Advice’ gathers and uses personal information, with consent from you ‘the client’ in order to provide the services Tax Debts Help and Advice offers. This policy describes how this personal data will be collected, handled and stored to meet the company’s data protection standards and to comply with the law.
• Data Protection Registration ref: ZB670638
Why this policy exists
This data protection policy ensures Tax Debts Help and Advice:
• Complies with data protection law and follows good practice
• Protects the rights of customers, staff and partners
• Is open about how individuals data is stored and processed
• Protects itself from the risks of a data breach
The Data Protection Act 1998 describes how organisations must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically, on paper or other materials. To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.
Policy and Responsibilities
Data protection goals are based on date protection principles and must be individually modified for every company. Personal data must:
- Be processed fairly and lawfully
- Be obtained only for specific, lawful purposes
- Be adequate, relevant and not excessive
- Be accurate and kept up to date
- Not be held for any longer than necessary
- Processed in accordance with the rights of data subjects
- Be protected in appropriate ways
- Not be transferred outside the European Economic Area (EEA), unless that country or territory ensures and adequate level of protection
This policy applies to Tax Debts Help and Advice, all staff, volunteers, contractors, suppliers and other people who may work on behalf of Tax Debts Help and Advice.
It applies to all data that Tax Debts Help and Advice holds relating to identifiable individuals, even if that information technically falls outside of the Data Protection Act 1998. Information can include:
• Names of individuals and Business Details
• Postal addresses, registered offices
• Email addresses
• Telephone numbers
• Personal ID information required for HMRC
• Plus any other information relating to the individual or business that is required with the service being provided
• Tax Debts Help and Advice has a continuous commitment to improvement of data management systems. This includes training, bespoke software and staff policies.
Date Protection Risks
This policy helps to protect Tax Debts Help and Advice from data security risks, including:
• Breaches of confidentiality. For instance, information being given out inappropriately
• Failing to offer choice. For instance, all individuals should be free to choose how the company uses data relating to them
• Reputational damage. For instance, Lisa Tabor could suffer if hackers successfully gained access to sensitive data
Responsibilities
Everyone who works at Tax Debts Help and Advice in any capacity has some responsibility for ensuring data is collected, stored and handled appropriately.
Tax Debts Help and Advice is responsible for:
• Reviewing all date protection procedures and related policies
• Arranging all relevant training specific to this policy
• Dealing with requests from individuals to any data that is held about them – Also called ‘subject access requests’
• Checking any relevant contracts or agreements with third parties that may handle sensitive data
Data Storage and Guidelines
The only people to access data covered by this policy should be those that need it in order to perform their duties for the client and company, in line with the work we are commissioned (via Terms and Conditions) to undertake on the clients behalf.
Data will not be shared informally, nor will date be shared with any third party without express prior consent from ‘the client’. This is appropriate should ‘the client’ require services not offered by Tax Debts Help and Advice and we seek external 3rd party advice in the matter. Personal data will not be disclosed to unauthorised people, either within the company or externally.
Data will be reviewed regularly and if found to be no longer required, it will be deleted.
Paper based data will be kept in a secure place where unauthorised people cannot see it. These guidelines also apply to data that is stored electronically but has been printed out.
Electronically stored data is protected from unauthorised access, accidental deletion and malicious attempts. Data is stored on designated drives and servers, is backed up frequently and not stored on removable media in any format.
Data held is only viewable via bespoke software by Tax Debts Help and Advice and those designated staff members who are required to use the data in pursuit of the work we have been requested to undertake.
The law requires that we take reasonable steps to ensure data is kept accurate and up to date; this is done via the work we undertake and the ongoing management of ‘the clients’ case.
Subject Access Requests
All individuals who are the subject of personal data held by Tax Debts Help and Advice are entitles to ask what information we hold and why, ask to gain access to this information, be informed how to keep it up to date, be informed how we are meeting data protection obligations.
Disclosing data for another reason
In certain circumstances, the Data Protection Act allows personal date to be disclosed to law enforcement agencies without the consent of the data subject. Under these circumstances, Tax Debts Help and Advice will disclose requested date. However, Tax Debts Help and Advice will ensure the request is legitimate, seeking assistance from legal advisors, if necessary.
Providing Information
Tax Debts Help and Advice aims to ensure that individuals and businesses are aware that their data is being processed in accordance with the services being provided and that they understand:
• How the data is being held
• How to exercise their rights
To these ends, Tax Debts Help and Advice has a privacy statement, setting out how data relating to individuals and businesses is used by the company.
A version of this policy is also available on the website.