Data Protection Policy

ENVIRONMENTAL & GAS MONITORING LTD

1. INTRODUCTION

Environmental & Gas Monitoring Ltd (“EGM”) is a privately owned company with over 80 years of experience in the gas detection and environmental monitoring market.

The personal data that EGM processes relates to its staff, clients, suppliers and contractors.

This policy sets out EGM’s commitment to ensuring that any personal data, including special category personal data, which EGM processes is carried out in compliance with Data Protection Law. EGM is committed to ensuring that good data protection practice is imbedded in the culture of our staff and our organisation.

‘Data Protection Law’ includes the General Data Protection Regulation 2016/679; the UK Data Protection Act 2018 and all relevant EU and UK data protection legislation.

EGM is committed to ensuring that its complies with the GDPR Data Protection Principles when processing any personal data and that it meets its legal obligations as laid down in Data Protection Law.

2. SCOPE

This policy applies to all personal data processed by EGM and is part of EGM’s approach to compliance with Data Protection Law. All EGM staff are expected to comply with this policy.

3. DATA PROTECTION PRINCIPLES

EGM confirms that it complies with the following data protection principles and undertakes to ensure that when it processes personal data:

it is processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
it is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; (‘purpose limitation’)
it is all adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; (‘data minimisation’)
it is all accurate and, where necessary, kept up to date and that reasonable steps will be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’)
it is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; (‘storage limitation’)
it is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

EGM is committed to facilitating and complying with any request from a data subject who wishes to exercise their rights under Data Protection Law in a transparent manner and without undue delay.

EGM does not transfer personal data to countries outwith the EU.

4. PROCESS/PROCEDURES/GUIDANCE

EGM will:

only collect and process the personal data that it is necessary for the purpose or purposes that it has identified in advance.
ensure that the legal basis for processing the personal data is identified in advance, including any special category data.
ensure that as far as possible the personal data it holds is accurate.
only process your data for as long as it is required for its purposes and then it will be securely disposed of, or deleted. EGM’s Data Retention Policy sets out the appropriate period of time.
will provide anyone they collect personal data from with a privacy notice which provides more detail on why it is asking for that data and what it intends to do with it.
not do anything with personal data that is unexpected given the content of this policy and the privacy notice provided at the time it is provided.
ensure that appropriate security is in place in relation to personal data held in paper and digital formats.

EGM will ensure that all staff who handle personal data are aware of their responsibilities under this policy and other relevant data protection and information security policies and that they are adequately trained and supervised.

Proceedings under EGM’s disciplinary policy may be taken in respect of those employees who breach this policy. Staff will also be aware that processing personal data in breach of this policy and in breach of Data Protection Law can be a criminal offence.

5. DATA SUBJECT RIGHTS

EGM will ensure that it has procedures in place to allow data subjects to exercise the following data subject rights under the GDPR:

Subject access: the right to request information about how personal data is being processed including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

the purpose of the processing;
the categories of personal data;
the recipients to whom data has been disclosed or which will be disclosed;
the retention period;
the right to lodge a complaint with the ICO;
the source of the information if not collected direct from the subject; and
the existence of any automated decision making.

Rectification: the right to rectification of inaccurate personal data concerning you without undue delay.

Erasure: the right to have data erased in certain circumstances, and to have confirmation of erasure, but only where:

the data is no longer necessary in relation to the purpose for which it was collected;
where consent is withdrawn;
where there is no legal basis for the processing; or
there is a legal obligation to delete data.

Restriction of processing: the right to ask for certain processing to be restricted in the following circumstances:

if you contest the accuracy of your personal data;
if our processing is unlawful and you do not want it to be erased;
if we no longer need the data for the purpose of the processing but it is required by you
for the establishment, exercise or defence of legal claims; or
if you have objected to the processing, pending verification of that objection.

Data portability: you have the right to receive a copy of the personal data you have provided to us and certain information generated by us, if our processing is carried by automated means, which will allow you to transfer it to another data controller. This only applies if our legal basis for processing is consent or under a contract.

Object to processing: you have the right to object, on grounds relating to your particular situation, to the following:

processing carried out in the public interest or in the exercise of official authority; or
processing relying on the legitimate interests processing condition unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You have an absolute right to object to any direct marketing that we are sending to you and there are no exemptions to this which would allow you to refuse to comply.

Object to automated decision making: if we are making decisions about you based on automated processing which have a legal or similar effect on you, then in some circumstances you have the right to object to this decision being made solely on the basis of automated processing. This includes any profiling of you that we carry out.

You cannot exercise this right in the following circumstances when the processing is:

necessary for entering into or the performance of a contract;
authorised by law; or
based on explicit consent.

6. SPECIAL CATEGORY PERSONAL DATA

This includes the following personal data revealing:

Racial or ethnic origin,
Political opinions,
Religious or philosophical beliefs,
Trade union membership,
The processing of genetic data, biometric data for the purpose of uniquely identifying a natural person,
Data concerning health,
Data concerning a natural person's sex life or sexual orientation,
Data about criminal convictions and offences.

This policy sets out the safeguards we believe are appropriate to ensure that we comply with the Data Protection Principles set out above. We only process special category data when we have a legal basis to do so; access to this data is restricted; extra security measures are in place and we will only retain it as long as it strictly necessary in line with our Data Retention Policy.

7. RESPONSIBILITY FOR THE PROCESSING OF PERSONAL DATA

If you have any concerns or wish to exercise any of your rights under the GDPR then you can contact the Data Protection Lead in the following ways:

Data Protection Officer
Environmental & Gas Monitoring Limited
Unit 5 Barrmill Road
Galston
Ayrshire
KA4 8HH
United Kingdom

Email: [email protected]
Tel: +44 (0)1563 820444
Fax:+44 (0)1563 820163

8. MONITORING AND REVIEW

This policy was last updated in July 2018 and shall be regularly monitored and reviewed, at regular intervals.