I CAN is committed to being transparent about how it collects and uses Personal Data and to meeting its data protection obligations. This policy sets out I CAN’s commitment and your obligations in relation to data protection, and individual rights and obligations in relation to Personal Data.
This Policy sets out how I CAN handles the Personal Data of our customers, suppliers, employees, workers, pupils and parents, and other third parties. This Policy applies to all Personal Data we process regardless of the media on which Personal Data is stored or whether it relates to past or present employees, workers, customers, clients or supplier contacts, shareholders, website users or any other Data Subject.
This Policy applies to all employees, workers, contractors, agency workers, consultants, directors and any others who process Personal Data on behalf of I CAN. Each employee must read, understand and comply with this Policy when processing Personal Data on our behalf and attend training on its requirements.
All directors, individual business areas, units, departments, manager, supervisors and other responsible parties are responsible for ensuring compliance with this Policy and need to implement appropriate practices, processes, controls and training to ensure such compliance.
I CAN has appointed Satswana as its data protection officer with responsibility to inform and advise I CAN on its data protection obligations. Questions about this policy, or requests for further information, should be directed to our data protection officer Satswana Limited, Pembroke House, St. Christopher’s Place, Farnborough, Hampshire, GU14 0NH, Tel 01252 516898 or email firstname.lastname@example.org
Failure to comply with this Policy will be regarded as serious misconduct and will be dealt with in accordance with I CAN’s disciplinary procedure.
Personal Data: any information that relates to an individual who can be directly or indirectly identified from that information. Personal Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person's actions or behaviour, or an identification number, online identifier or location data.
Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Personal Data is a Personal Data Breach.
Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding/storing the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
Sensitive Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convictions.
Data protection principles
I CAN processes personal data in accordance with the following data protection principles which require personal data to be:
I CAN tells individuals the reasons for processing their Personal Data, how it uses such data and the legal basis for processing in its privacy notices. It will not process Personal Data for other reasons.
I CAN will update Personal Data promptly if an individual advises that his/her information has changed or is inaccurate.
I CAN keeps full and accurate records of its processing activities in respect of personal data in accordance with the requirements of data protection legislation.
Protecting Personal Data
Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
I CAN has developed, implemented and maintains safeguards appropriate to our size, scope and business, our available resources, the amount of personal data that we own or maintain on behalf of others and identified risks (including use of encryption and pseudonymisation where applicable). In particular we have devised specific processes to ensure the safeguarding of data relating to children (Please refer to the Safeguarding Policy for I CAN and/or the schools, as appropriate.
We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our processing of personal data.
All employees are responsible for protecting the personal data we hold and must implement reasonable and appropriate security measures against unlawful or unauthorised processing of personal data and against the accidental loss of, or damage to, personal data. All employees must exercise particular care in protecting sensitive personal data from loss and unauthorised access, use or disclosure. All employees must comply with all security arrangements in place including information technology, such as password-protected files and screen savers, as set out in our IT Policy and other organisational arrangements including locks for drawers and filing cabinets and restricted access arrangements.
When personal data is destroyed this must be in accordance with secure destruction arrangements. Personal data must not be thrown into general rubbish bins. Particular care must be taken where it is necessary to take information away from I CAN’s premises. You should protect against accidental disclosure such as, for example, someone near to you being able to read information over your shoulder.
Never disclose personal data to other employees or a third party either orally or in writing without the prior consent of your Manager and until all appropriate checks and contractual arrangements have been made.
Individuals who have access to personal data are required:
Reporting a Personal Data Breach
Data protection law requires I CAN to notify any personal data breach to the applicable regulator within 72 hours and, in certain instances, the individual.
If you know or suspect that a personal data breach has occurred, do not attempt to investigate the matter yourself. Immediately contact the Director of Corporate Services. If you are in a school, you must copy this to the School Principal or the Director of Education. You should preserve all evidence relating to the potential personal data breach. Failure to do this may result in disciplinary action.
Individuals have a number of rights in relation to their Personal Data.
Subject access requests
Individuals have the right to make a subject access request. If an individual makes a subject access request, I CAN will tell him/her:
I CAN will also provide the individual with a copy of the personal data undergoing processing. This will normally be in electronic form if the individual has made a request electronically, unless he/she agrees otherwise.
If the individual wants additional copies, I CAN will charge a fee, which will be based on the administrative cost to I CAN of providing the additional copies.
To make a subject access request, the individual should send the request to our data protection officer Satswana Limited, Pembroke House, St. Christopher’s Place, Farnborough, Hampshire, GU14 0NH, Tel 01252 516898 or email email@example.com. In some cases, I CAN may need to ask for proof of identification before the request can be processed. I CAN will inform the individual if it needs to verify his/her identity and the documents it requires.
I CAN will normally respond to a request within a period of one month from the date it is received. In some cases, such as where I CAN processes large amounts of the individual's data, it may respond within three months of the date the request is received. I CAN will write to the individual within one month of receiving the original request to tell him/her if this is the case.
If a subject access request is manifestly unfounded or excessive, I CAN is not obliged to comply with it. Alternatively, I CAN can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which I CAN has already responded. If an individual submits a request that is unfounded or excessive, I CAN will notify him/her that this is the case and whether or not it will respond to it.
Individuals have a number of other rights in relation to their Personal Data. Under certain circumstances they can require I CAN to:
To find out more about these rights, to exercise any of these rights, or if there are any questions or concerns about data protection at I CAN, individuals should contact our data protection officer Satswana Limited, Pembroke House, St. Christopher’s Place, Farnborough, Hampshire, GU14 0NH, Tel 01252 516898 or email firstname.lastname@example.org
Training and audit
I CAN will provide training to all individuals about their data protection responsibilities as part of the induction process and at regular intervals thereafter.
Individuals whose roles require regular access to personal data, or who are responsible for implementing this policy or responding to subject access requests under this policy, will receive additional training to help them understand their duties and how to comply with them.
We will regularly review all the systems and processes in place to ensure proper use and protection of personal data.
There are no items in your basket - why not visit our shop?