General Data Protection Regulation
How Do We Handle Data?
To ensure GDPR compliance, we have set out the following information about how we use the data you provide us with a Questions and Answer form, to give you necessary insight:
No – we are not required to do so under the GDPR. This is due to our business size, not requesting Personal Sensitive-information and the way we use personal data is not particularly complex.
We may give other organisations access to data so that we can fulfil contractual obligations and offer the high standard of service our customers and clients deserve. Please find some examples of organisations we use but are not limited to:
- Couriers
- Network service providers
- Stock/Distribution providers
- Repair service providers
- Insurance providers
- Retail/Consumer finance service providers
- Retail payment processing providers
- MDM solution providers.
The third parties that we share personal data with have been carefully considered and selected based on contractual agreements, trustworthiness and compliance with legislation.
In addition, we may give access to relevant authorities as required by law.
Restriction of access to data centres and server cabinets as necessary.
Monitoring of unauthorised access.
Written procedures for employees, contractors and visitors covering confidentiality and security of information.
All our employees have received training incorporating GDPR provisions and standards to ensure compliance and confidentiality throughout the organisation.
Training is regularly reviewed to reflect new regulatory and legislative requirements.
In all circumstances, we store personal data from customer’s orders for up to 6 years before it is deleted from our systems. This is to make sure we can respond to customer service queries after an order or service has resided and handle any legal claims.
Restricting access to systems depending on the sensitivity/risk.
Multi-factored authentication where applicable and password protection for all systems, including and excluding personal information.
Ensuring prompt deployment of updates; including 3rd party services, bug-fixes and security patches for all systems.
Physical data is stored securely on our premises here in the UK.
Electronic data will be stored on our servers and/or cloud locations. Where we use international cloud locations, we only do so when they have complied with GDPR international data transfer requirements.
We have a Data Security Breach Policy and procedure in place.
In the unlikely event of any breach regarding personal data then individuals effected will be notified at the earliest possible time.
Employees receive training so a breach can not only be identified quickly, but prevented.
We also have a systematic approach to monitoring the integrity of our IT system.
Through our electronic contract agreements, personal data is automatically processed, and decisions are made with regard to applicable fraud regulations.
Aside from the above, we do not process data automatically for the purpose of automated decision making; such as profiling, or making consumer credit decisions.
Personal data is retained for the period of six years as outlined above the destruction of the digital data is done either by physically destroying the storage media e.g. drives, tapes, or by securely erasing the storage media followed by a reformat.
Where we hold the data in a physical format, the data is destroyed in Shred-it bins.
If you have a question about Think Comms compliance with GDPR or other privacy regulations, who should you contact?
Please contact our Head of Compliance for more information. This can be done by emailing compliance@think-comms.com or by writing to the following address.
GDPR Think Comms Limited 54a High Street, Fareham, Hampshire, PO16 7BG