DATA CONTROLLER (“the Company”): Inflight Peripherals Limited
DATA COMPLIANCE MANAGER: Security Manager
IFPL collects and processes personal information, or personal data, relating to employees, workers, customers, suppliers and contractors. This personal information is held by the Company in paper or electronic format.
The Company is committed to being transparent about how it handles personal information, to protecting the privacy and security of personal information and in meeting its data protection obligations under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018. The purpose of this privacy notice is to state how and why we collect and use personal information both during and after any relationship with the Company.
This privacy notice applies to all current and former employees, job applicants, workers, customers, suppliers and contractors. It is non-contractual and does not form part of any employment contract, casual worker agreement, consultancy agreement or any other contract for services.
The Company has appointed a Data Compliance Manager (DCM) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or about how we handle personal information, please contact the IFPL Security Manager.
DATA PROTECTION PRINCIPLES
Under GDPR, there are six data protection principles that the Company must comply with. The personal information held must be:
- Processed lawfully, fairly and in a transparent manner.
- Collected only for legitimate purposes that have been clearly explained and not further processed in a way that is incompatible with those purposes.
- Adequate, relevant and limited to what is necessary in relation to those purposes.
- Accurate and, where necessary, kept up to date.
- Kept in a form which permits identification for no longer than is necessary for those purposes.
- Processed in a way that ensures appropriate security of the data.
The Company is responsible for, and must be able to demonstrate compliance with, these principles. This is called accountability.
TYPES OF PERSONAL INFORMATION
Personal information is any information about an individual from which that person can be directly or indirectly identified. It does not include anonymised data, i.e. where all identifying particulars have been removed. There are also “special categories” of personal information, and personal information on criminal convictions and offences, which requires a higher level of protection because it is of a more sensitive nature. The special categories of personal information comprise information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation and genetic and biometric data.
The Company collects, uses and processes a range of personal information. This includes (as applicable):
- contact details, name, address, telephone number and personal e-mail address
- emergency contact details/next of kin information
- date of birth
- marital status and dependants
- start and end dates of your employment or engagement
- recruitment records, including personal information included in a CV, application form, covering letter, interview notes, references, copies of proof of right to work in the UK documentation, copies of qualification certificates, copy of driving licence and other background check documentation
- terms and conditions of employment or engagement (including job title and working hours), employment contract, written statement of employment particulars, casual worker agreement, consultancy agreement, pay review and bonus letters, statements of changes to employment or engagement terms and related correspondence
- details of skills, qualifications, experience and work history, both with previous employers and with the Company and professional memberships
- details of salary, entitlement to benefits and pension information
- National Insurance number
- bank account details, payroll records, tax code and tax status information
- disciplinary, grievance and capability records, investigation reports, collated evidence, minutes of hearings and appeal hearings, warning letters, performance improvement plans and related correspondence
- appraisals, including appraisal forms, performance reviews and ratings, targets and objectives set
- training records
- annual leave and other leave records, including details of the types of and reasons for leave being taken and related correspondence
- any termination of employment or engagement documentation, including resignation letters, dismissal letters, redundancy letters, minutes of meetings, settlement agreements and related correspondence
- information obtained through electronic means, such as swipe card, biometrics, CCTV or clocking-in records
- information about use of IT systems, telephones, e-mail and internet
The Company may also collect, use and process the following special categories of your personal information (as applicable):
- information about health, medical conditions, sickness absence records (including details of the reasons for sickness absence being taken), medical reports and related correspondence
- information about racial or ethnic origin, religious or philosophical beliefs and sexual orientation
- information about criminal convictions and offences
COLLECTION OF PERSONAL INFORMATION
The Company collects personal information about employees, workers and contractors in a variety of ways. It will be collected during the recruitment process either directly, indirectly or from a third party. We may collect information from external third parties, references, background check providers, credit reference agencies and criminal record checks from the Disclosure and Barring Service (DBS).
Information will be collected throughout the duration of any working or business relationship with IFPL. This will be collected in the course of work related activities. Some personal information collected is mandatory and/or is a statutory or contractual requirement, other information may be requested on a voluntary basis. You are under no statutory or contractual obligation to provide personal information to the Company during the recruitment process.
Personal Data will be collected automatically from use of the IFPL website and social media followers. The data transmitted will include IP address, date/time of visit, pages accessed, access status/HTTP status code, browser, operating system and interface, as well as the language and version of the browser software. The legal basis for collecting and processing this personal data is our legitimate interest in operating the site, providing access to the pages Users wish to access, understanding the interests of potential customers and providing relevant information about services. Personal Data received indirectly from our suppliers enables us to create, store and record a communications history. The legal basis for collecting and processing this personal data is our legitimate interest in knowing more about our customers and suppliers.
Google Analytics is a web analytics service provided by Google, Inc. (“Google”) which places cookies on a user’s computer, this enables Google to provide the Company with activity reports relating to website usage. Google uses this data only to provide information on how the website is used and does not associate IP addresses with any other data held by Google. The information generated by Google cookies about use of the platform (including IP addresses) will be transmitted to and stored by Google on servers in the United States. The user can adjust this by changing browser settings or by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout?hl=en-GB.
USE OF PERSONAL INFORMATION
Personal information will only be used when legally necessary. This is known as the legal basis for processing. Personal information will be used in the following circumstances (where applicable):
- employment contracts, casual worker agreements, consultancy agreements or contractual arrangement
- compliance with legal obligations
- Legitimate interests (or those of a third party) and where fundamental rights and freedoms of the individual do not override the interests of the Company.
Personal information is used to comply with legal obligations, to pursue the Company’s legitimate interests (or those of a third party) and to remain in contact with customers, potential customers and suppliers. Legitimate interests include: performing or exercising obligations or rights under the direct relationship that exists between the Company and its employee, worker, customer, supplier or contractor; running the business by employing (and rewarding) employees, workers and contractors; performing effective internal administration and ensuring the smooth running of the business; ensuring the security and effective operation of the Company systems and network; protecting confidential information; and conducting due diligence on employees, workers, customers, suppliers and contractors.
The purposes for which we process personal information are to:
- enable us to maintain accurate and up-to-date employee, worker, customer, supplier and contractor records and contact details (including details of whom to contact in the event of an emergency)
- run recruitment processes and assess suitability for employment, engagement or promotion
- comply with statutory and/or regulatory requirements and obligations
- comply with the duty to make reasonable adjustments for disabled employees and workers and with other disability discrimination obligations
- maintain an accurate record of employment or engagement terms
- administration of contracts
- make decisions regarding pay reviews and bonuses
- ensure compliance with statutory and contractual rights
- ensure payments are correct
- receive the correct benefits and pension entitlements, including liaising with any external benefits or pension providers or insurers
- ensure compliance with income tax requirements, e.g. deducting income tax and National Insurance contributions where applicable
- operate and maintain a record of disciplinary, grievance and capability procedures and action taken
- operate and maintain a record of performance management systems
- record and assess education, training and development needs
- plan for career development and succession
- manage, plan and organise work
- enable effective workforce management
- operate and maintain a record of annual leave procedures
- operate and maintain a record of sickness absence procedures
- ascertain fitness to work
- operate and maintain a record of maternity leave, paternity leave, adoption leave, shared parental leave, parental leave and any other type of paid or unpaid leave or time off work
- ensure payment of SSP or contractual sick pay
- ensure payment of other statutory or contractual pay entitlements, e.g. SMP, SPP, SAP and ShPP
- meet health and safety law obligations
- make decisions about continued employment or engagement
- operate and maintain a record of dismissal procedures
- provide references on request for current or former employees, workers or contractors
- prevent fraud
- monitor use of IT systems to ensure compliance with our IT-related policies
- ensure network and information security and prevent unauthorised access and modifications to systems
- ensure effective HR, personnel management and business administration, including accounting and auditing
- ensure adherence to Company rules, policies and procedures
- monitor equal opportunities
- enable the Company to establish, exercise or defend possible legal claims
- marketing and business development
- to provide bespoke website and social media content
- to gain insight into website browser preferences
- creation of bespoke marketing messages
- to market website visitors with relevant material
- to collect site statistics.
Please note that IFPL may process personal information without consent, in compliance with these rules, where it is required or permitted by law.
FAILURE TO PROVIDE PERSONAL INFORMATION
Failure to provide personal information when requested or required, could affect the necessary fulfilment of contractual arrangements or prevent the Company from complying with its legal obligations.
USE OF SENSITIVE PERSONAL INFORMATION
Special categories of personal information, i.e. health, medical conditions, trade union membership, information about criminal convictions and offences, is processed to perform or exercise obligations or rights under employment law or social security law and in line with the Data Protection Procedure.
Information about health or medical conditions may also be processed for the purposes of assessing the working capacity of an employee or medical diagnosis, provided this is done under the responsibility of a medical professional subject to the obligation of professional secrecy, e.g. a doctor and in line with the Company Data Protection Procedure.
Where the Company processes other special categories of personal information, i.e. information about racial or ethnic origin, religious or philosophical beliefs and sexual orientation, this is done only for the purpose of equal opportunities monitoring and in line with the Data Protection Procedure. Personal information the Company uses for these purposes is either anonymised or is collected with explicit written consent, which can be withdrawn at any time.
Special categories of personal information and information about any criminal convictions and offences, will be used where it is needed for the establishment, exercise or defence of legal claims.
CHANGE OF PURPOSE
IFPL will only use personal information for the purposes for which it was collected. Should personal information need to be used for a purpose other than that for which it was collected, prior to the processing, the Company will explain the legal basis which allows the Company to process it. IFPL will provide any relevant further information and amend the privacy notice if necessary.
The Company may wish to retain personal information in the case of unsuccessful job applicants or upon receipt of a speculative CV, IFPL will receive consent before any personal information is retained on file for this purpose.
Personal information may be shared internally within the Company between HR, payroll, Line Managers, other managers in the relevant department and IT staff, if access to personal information is necessary for the performance of their roles.
The Company may also share personal information with third-party service providers (and their designated agents), in the context of a potential sale or restructuring of some or all of its business. In those circumstances, personal information will be subject to confidentiality undertakings. Personal information may also be shared with a regulator or to comply with the law or where it is necessary to administer a contract.
PROTECTION OF INFORMATION
The Company has in place measures to protect the security of personal information. Policies, procedures and controls prevent personal information being lost, destroyed, altered, disclosed, used or accessed in an unauthorised way. Access to personal information is limited to employees, workers, agents, contractors and other third parties who have a business need.
Where personal information is shared with third-party service providers, the Company require all third parties to take appropriate technical and organisational security measures to protect personal information and to treat it subject to a duty of confidentiality and in accordance with data protection law. IFPL only allow access to personal information for specified purposes and in accordance with our written instructions.
The Company has in place procedures to deal with a suspected data security breach and will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) of a suspected breach where we are legally required to do so.
Personal information will be stored using a variety of technical and physical safeguards. This protects it from accidental or unauthorised access, use, alteration or disclosure to unauthorised parties. These measures include physical locks, device encryption, firewalls, password protection, access control and virus checking procedures.
Periodic reviews of security systems are in place to ensure they are effective and robust.
RETENTION OF INFORMATION
The Company retains personal information for as long as is necessary to fulfil the purposes for which it was collected and processed.
After termination of employment or engagement personal information will be held for a period of 12 months. The file of information will be thinned and only retain for a longer period when it is strictly necessary. This retained information is subject to: (a) any minimum statutory or other legal, tax, health and safety, reporting or accounting requirements for particular data or records, and (b) the retention of some types of personal information for up to six years to protect against legal risk, e.g. if they could be relevant to a possible legal claim in a tribunal, County Court or High Court. Payroll, wage and tax records (including salary, bonuses, overtime, expenses, benefits and pension information, National Insurance number, PAYE records, tax code and tax status information) for six years after the termination of employment or engagement.
Unsuccessful job applicant information will be held for a period of 6 months after the end of the relevant recruitment exercise. This is subject to: (a) minimum statutory or other legal, tax, health and safety, reporting or accounting requirements for particular data or records, and (b) the retention of some types of personal information for up to six years to protect against legal risk, e.g. if they could be relevant to a possible legal claim in a tribunal, County Court or High Court. Applicants may consent to the Company retaining personal information on file in case there are future suitable employment opportunities for a further six months after the end of the relevant recruitment exercise, or until you withdraw your consent if earlier.
On site CCTV images are retained for a period of 30 days only. Biometric information is removed as soon as access to those areas is no longer required or immediately upon contract end.
Information will be retained within our CRM system for as long as the contact:
- remains a registered subscriber to the mailing list
- has completed a purchase with IFPL in the last 36 months
- requires products, service and information
If any email communication from IFPL is unopened or there has been no interaction for a period of three years with our business contacts, any personal information on the CRM system will be identified as inactive and be deleted from records except where retention is necessary to enable us to enforce legal rights, or to protect the rights, property or safety of our employees.
The exceptions are:
- any personal information supplied as part of the recruitment process will not be retained if it has no bearing on the ongoing working relationship
- personal information about criminal convictions and offences collected in the course of the recruitment process will be deleted once it has been verified through a DBS criminal record check, unless, in exceptional circumstances, the information has been assessed by the Company as relevant to the ongoing working relationship
- it will only be recorded whether a DBS criminal record check has yielded a satisfactory or unsatisfactory result, unless, in exceptional circumstances, the information in the criminal record check has been assessed by the Company as relevant to the ongoing working relationship
- if it has been assessed as relevant to the ongoing working relationship, a DBS criminal record check will nevertheless be deleted after 12 months or once the conviction is “spent” if earlier (unless information about spent convictions may be retained because the role is an excluded occupation or profession)
- disciplinary, grievance and capability records will only be retained until the expiry of any warning given (but a summary disciplinary, grievance or performance management record will still be maintained for the duration of your employment).
Personal information which no longer needs to be retained will be securely and effectively destroyed or permanently erased and third parties will be instructed to destroy or erase any such personal information where applicable.
RIGHTS IN CONNECTION WITH PERSONAL INFORMATION
It is important that personal information held is accurate and up to date. Staff must notify the relevant department if personal information changes, e.g. change of address to HR so that records can be updated. The Company cannot be held responsible for any errors in personal information in this regard unless the Company has been notified of the relevant change.
RIGHTS IN CONNECTION WITH PERSONAL INFORMATION
Data subjects have a number of statutory rights. Subject to certain conditions, and in certain circumstances, they have the right to:
- request access to personal information – this is known as making a Data Subject Access Request (DSAR) and it grants access to a copy of any personal information held on file and checks that it is being processed lawfully
- request rectification of personal information – this enables any inaccurate or incomplete personal information to be corrected
- request the erasure of personal information – this enables the deletion or removal of any personal information where there is no compelling reason for its continued processing, e.g. it is no longer necessary in relation to the purpose for which it was originally collected
- restrict the processing of personal information – suspension of processing of personal information, e.g. if its accuracy is contested and needs to be verified
- object to the processing of personal information – this stops the processing of personal information where IFPL are relying on the legitimate interests of the business as the legal basis for processing and there is something relating to a particular situation which causes objection to processing on this ground
- data portability – this grants the right to request the transfer of personal information to another party so that it can be reused across different services for individual purposes
- update your subscription preferences or unsubscribe from our marketing communications at any time
To exercise any of these rights, use the relevant form or email the DCM on email@example.com. Specific information may be required in order to verify identity and check the right to access the personal information. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Where consent has been provided to process personal information for a specific purpose, consent may be withdrawn at any time. Once notification has been received that consent has been withdrawn, the processing of personal information will cease for the purpose for which it was originally agreed, unless we have a legal basis for processing.
Individuals have the right to make a complaint to the Information Commissioner’s Office (ICO) at any time. The ICO is the UK supervisory authority for data protection issues.
TRANSFERRING PERSONAL INFORMATION OUTSIDE THE EUROPEAN ECONOMIC AREA
The Company may transfer personal information to other countries outside the European Economic Area (EEA). The Company will only do so after taking such steps to ensure that any data processed on behalf of IFPL receives protection equivalent to that provided in the EEA.
Processors will either be certified as compliant with the EU-U.S. Privacy Shield Framework where they are located in the USA or have entered into an agreement with us containing the model clauses approved by the European Commission as providing contractual protection equivalent to that provided by the data protection regulations applicable in the EEA.
AUTOMATED DECISION MAKING
Automated decision making occurs when an electronic system uses personal information to make a decision without human intervention. We do not envisage that any decisions will be made about individuals based solely on automated decision making, including profiling. Any changes to this position will be notified in writing to those applicable.
CHANGES TO THIS PRIVACY NOTICE
The Company reserves the right to update or amend this privacy notice at any time, including where the Company intends to further process personal information for a purpose other than that for which the personal information was collected or the intention is to process new types of personal information. The Company will issue a new privacy notice when significant updates or amendments occur.
OBLIGATIONS IN RELATION TO PERSONAL DATA
Staff must comply with this notice and the data protection principles at all times during any personal data processing activities where they are acting on behalf of the Company in the performance of their duties and responsibilities. IFPL rely on staff to help meet data protection obligations to data subjects.
Under the data protection legislation, staff should also be aware that they are personally accountable for their actions and can be held criminally liable. It is a criminal offence to knowingly or recklessly obtain or disclose personal data (or to procure disclosure to a third party) without the consent of the Company.
This would include, for example, taking clients’ or customers’ contact details or other personal data without the Company’s consent on the termination of employment, accessing another employee’s personal data without authority or otherwise misusing or stealing personal data held by the Company.
It is a criminal offence to knowingly or recklessly re-identify personal data that has been anonymised without the consent of the Company, it is a criminal offence to alter, block, erase, destroy or conceal personal data with the intention of preventing disclosure to a data subject following a data subject access request. Where unlawful activity is suspected, the Company will report the matter to the Information Commissioner’s Office for investigation into the alleged breach of the data protection legislation and this may result in criminal proceedings being instigated against the individual concerned.
The Company will also report the alleged breach to a regulatory body. This conduct will amount to a gross misconduct offence under the Company’s disciplinary procedure and could lead to summary dismissal.
Staff must also comply with the following guidelines at all times:
- only access personal data they have the authority to access and only for authorised purposes
- only allow other members of staff to access personal data if they have the appropriate authorisation and never share personal data informally
- do not disclose personal data to anyone except the data subject. In particular, data should not be given to someone from the same family, passed to any other unauthorised third party, placed on the Company’s website or posted on the Internet in any form, unless the data subject has given their explicit consent to do so
- be aware that those seeking personal data sometimes use deception to gain access, so always verify the identity of the data subject and the legitimacy of the request
- only transmit personal data between locations by e-mail if a secure network is in place, e.g. encryption
- if a request is received for personal data about another member of staff or data subject, this should be forwarded to the Company’s DCM
- ensure any personal data is kept securely, either in a locked non-portable filing cabinet or drawer if in hard copy, or password protected or encrypted if in electronic format, and comply with Company rules on computer access and secure file storage
- do not access another member of staff’s personal data, e.g. their personnel records, without authority as this will be treated as gross misconduct and it is a criminal offence
- do not obtain or disclose personal data (or procure their disclosure to a third party) without authority or without the Company’s consent as this will be treated as gross misconduct and is a criminal offence
- do not write down (in electronic or hard copy form) opinions or facts concerning a data subject which would be inappropriate to share with that data subject
- do not remove personal data, or devices containing personal data, from the workplace with the intention of processing them elsewhere unless this is necessary to enable the completion of job duties or responsibilities, unless appropriate security measures (such as password protection, encryption or pseudonymisation is in place) to secure the data and the device and has been authorised by a manager
- ensure that, when working on personal data as part of job duties and responsibilities away from the workplace and with the authorisation of a manager, that the data protection procedure and data protection legislation is adhered to, in particular in matters of data security
- do not store personal data on local computer drives, personal computers or other personal devices
- do not make unnecessary copies of personal data and keep and dispose of any copies securely
- refer any questions about the data protection legislation or compliance to the DCM
- remember that compliance with the data protection legislation and the terms of this notice are every individual’s responsibility.
If staff have any concerns or are unsure of any data processing activity they should discuss these with the DCM before taking any action.
Staff must seek further advice in the following circumstances:
- any doubt regarding what can or cannot be disclosed and to whom
- uncertainty about the lawful basis regarding the processing of personal data
- whether consent needs to be obtained to process personal data
- whether privacy notices need to be obtained or issued
- lack of clarity about the retention period for the personal data being processed
- uncertainty about which appropriate security measures need to be implemented to protect personal data
- assistance in dealing with any rights invoked by a data subject
- suspicion there has been a personal data breach
- where personal data may be used for purposes other than that for which it was collected
- when a significant new or amended data processing activity is about to take place
- when undertaking any activities involving automated decision-making, including profiling
- advice in relation to sharing personal data with third-party service providers
- queries around personal data are not being kept or deleted securely or being accessed without the proper authorisation
- suspicion there has been any other breach of the data protection principles
Concerns that any data processing procedure is not being or has not been followed, can be raised using the Company’s formal grievance procedure.
WITHDRAWAL OF CONSENT
Consent can be withdrawn at any time by completing a Data Subject Processing Cancellation Form. This form is available internally on SharePoint or by emailing firstname.lastname@example.org.
DATA SUBJECT ACCESS REQUEST (DSAR)
You can request a copy of the data we hold on you at any time by completing a Data Access Request Form. This form is available internally on SharePoint or by emailing email@example.com.
If you have any questions about this privacy notice or how we handle your personal information, please contact our DCM on firstname.lastname@example.org.