DATA PRIVACY NOTICE
Introduction
This Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
The rules on processing of personal data are set out in the General Data Protection Regulation (EU 2016/679 (the “GDPR”).
- Definitions
Data controller – A controller determines the purposes and means of processing personal data.
Data processor – A processor is responsible for processing personal data on behalf of a controller.
Data subject – Natural person.
Categories of date: Personal data and special categories of personal data
Personal data – The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person (as explained in Article 6 of GDPR). For example, name, passport number, National Insurance number, home address, or private email address. Online identifiers include IP addresses and cookies.
Special categories personal data – The GDPR refers to sensitive personal data as ‘special categories of personal data’ (as explained in Article 9 of GDPR). The special categories specifically include genetic date and biometric data where processed to uniquely identify an individual. Other examples include racial and ethnic origin, sexual orientation, health data, trade union membership, political opinions, religious, or philosophical beliefs.
Processing – means any operation or set operations, which is performed on personal data, or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction.
Third party – means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
- Who are we?
Rushtons Insolvency Limited, trading as Rushtons, company number 08905570, registered office at 6 Festival Building, Ashley Lane, Saltaire, Shipley, West Yorkshire, BD17 7DQ is a data controller. This means we decide how your personal data is processed and for what purposes.
Nicola Baker is licensed to act as an Insolvency Practitioner in the UK by the Institute of Chartered Accountants in England and Wales, number 15852 and is a data controller and a data processor.
Nicola baker can be contacted at: -
Address: Rushtons Insolvency Limited
6 Festival Building
Ashley Lane
Saltaire
BD17 7DQ
Telephone: 01274 598585
Email: enquiries@rushtonsifs.co.uk
- The purpose(s) of processing your personal data
We use your personal data for the following purposes: -
Nature of Work
Insolvency Practitioners.
Description of processing
The following is a broad description of the way Rushtons Insolvency Limited and Nicola Baker processes personal information. To understand how your own personal information is processed you may need to refer to any personal communications you have received, check any privacy notices published, or contact us directly to ask about your personal circumstances.
Reasons/purposes for processing information
Your personal information is processed to enable us to carry out marketing activities and our work as insolvency practitioners, which includes processing company data and practitioner data.
Type/classes of information processed
We process information relevant to the above reasons/purposes. This may include: -
- Personal details;
- Education and employment details;
- Goods or services;
- Financial details;
- Records of company data, which include all types of data necessary for the administration of the affairs of insolvent companies, partnerships and individuals;
- Records of practitioner date, which include details of appointments;
- Records under the Company Directors Disqualification Act 1986;
- Employees’ claims under the Employment Rights Act 1996 and associated legislation;
- Details of dividends distributed to creditors.
We also process sensitive classes of information that may include offences and alleged offences, criminal proceedings, outcomes and sentences.
Who the information is processed about
We process personal information about: -
- Clients;
- Employees/staff of our clients
- Complainants;
- Enquiries;
- Professional advisers and consultants;
- Creditors;
- Company directors;
- Other individuals, or organisation belonging to the insolvent company, partnership or individual;
- Individuals necessary for the administration of the affairs of insolvent companies, partnerships and individuals.
Providing financial services and advice
Personal information is also processed in order to provide financial services and advice. For this reason, the information processed may include name, contact details, family details, lifestyle and social circumstances, financial details, goods and services and sensitive classes of information that may include physical or mental health details. This information may be about clients, family and associates of clients, suppliers and enquirers. Where necessary or required this information may be shared as detailed in this policy.
Undertaking research
Personal information is also processed in order to undertake research. For this reason, the information processed may include name, contact details, family details, lifestyle and social circumstances, financial details, goods and services. The sensitive types of information may include physical or mental health details, racial or ethnic origin and religious or other beliefs. This information is about survey respondents. Where necessary or required this information may be shared as detailed in this policy.
Consulting and advisory services
Information is processed for consultancy and advisory services that are offered. For this reason, the information processed may include name, contact details, family details, financial details and the goods and services provided. Where necessary this information may be shared as detailed in this policy.
- The categories of personal data concerned
We have obtained your personal data from the records of the insolvent companies, partnerships and individuals which you have provided to them. We may have also obtained your personal information from publicly accessible sources such as social media or a personal or business-related website.
With reference to the categories of personal data described in the definitions section, we process the following categories of your data: -
Personal data
The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person, who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number(s), location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.
Personal data that has been pseudonymised – e.g. key coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.
Sensitive personal data
The GDPR refers to sensitive personal data as ‘special categories of personal data’.
The special categories specifically include genetic data and biometric data where processed to uniquely identify an individual. Personal data relating to criminal convictions and civil, or other offences are not included, but we consider this data to be ‘sensitive’ and similar extra safeguards will be applied by us to its processing.
- What is our legal basis for processing personal data?
Personal data (article 6 of GDPR)
Our lawful basis for processing your general personal data:
Basis |
Reason for Processing |
Consent of the data subject |
As provided for by past or present consent arrangements. Such consent can be withdrawn by the data subject at any time. |
Processing related to personal data manifestly made public by the data subject |
Including information made publicly available through social media, personal or business-related websites or similar medium. |
Processing necessary for the performance of a contract with the data subject or to take steps to enter a contract |
In accordance with the terms of a Letter of Engagement issued by Rushtons Insolvency Limited. |
Processing necessary for compliance with a legal obligation |
In accordance with Nicola Baker’s role and duties as an Office Holder appointed under the provisions of The Insolvency Act 1986. |
Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller |
In accordance with Nicola Baker’s role and duties as an Office Holder appointed under the provisions of The Insolvency Act 1986. |
Processing necessary for the purposes of the legitimate interest, of the data controller or a third party, except where such interest is overridden by the interests or fundamental rights or freedom of the data subject |
1. In accordance with any ancillary activities relating to Nicola Baker’s role and duties as an Office Holder appointed under the provisions of The Insolvency Act 1986; 2. In accordance with legitimate business activities relating to Rushtons Insolvency Limited including but not limited to the promotion of services provided by Rushtons Insolvency Limited. |
Special categories of personal data (article 9 of GDPR)
Our lawful basis for processing your special categories of data:
Basis |
Reason for Processing |
Processing necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement |
In accordance with Rushtons Insolvency Limited’s role and duties as an Office Holder appointed under the provision of the Insolvency Act 1986. |
Processing necessary to protect the vital interests of a data subject or another individual where the data subject is physically or legally incapable of giving consent |
1. In accordance with Nicola Baker’s role and duties as an Office Holder appointed under the provisions of The Insolvency Act 1986. 2. In accordance with the terms of a Letter of Engagement issued by Rushtons Insolvency Limited. |
Processing relates to personal data manifestly made public by the data subject |
Including information made publicly available through social media, personal or business-related websites or similar medium. |
Processing necessary for the establishment, exercise or defence of legal claims or where courts are acting in the judicial capacity |
1. In accordance with Nicola Baker’s role and duties as an Office Holder appointed under the provisions of The Insolvency Act 1986. 2. In accordance with the terms of a Letter of Engagement issued by Rushtons Insolvency Limited. |
Processing necessary for reasons of substantial public interest on the basis of EU or Member State Law |
In accordance with Nicola Baker’s role and duties as an Office Holder appointed under the provisions of The Insolvency Act 1986. |
……………………………………………………………………………………………………………………………………………………………………………………………..
- Sharing your personal data
Your personal data will be treated as strictly confidential and will be shared only with the parties detailed in this policy.
There is sometimes a need to share the personal information processed with the individual themselves and also with other organisations. Where this is necessary, we are required to comply with all aspects of the provisions of GDPR. What follows is a description of the common types of organisations where we may need to share some of the personal information, we process with for one or more reasons: -
Where necessary or required personal information is shared with: -
- Our clients;
- Business associates;
- Suppliers;
- Service providers;
- Enquirers;
- Professional advisers;
- Financial organisations;
- Debt collection and tracing agencies;
- Credit reference agencies;
- Creditors;
- Current, past or prospective employers;
- Local and central government;
- Anyone else where we have your consent.
We will never share your personal information with any third party where it does not relate to the nature of our work. Where your data is shared on a non-work-related basis this is only done when we are required to do so by law.
- How long do we keep your personal data?
We keep your personal data for no longer than reasonably necessary for the purposes of our work.
- Providing us with your personal data
You are under no statutory or contractual requirement or obligation to provide us with your personal data for our marketing purposes.
However, we do require your personal data in respect of our work as it is a legal, statutory or contractual requirement, or a requirement necessary to enter into a contract.
- Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -
- The right to request a copy of the personal data which we hold about you, subject to any fee specified by law;
- The right to request that we correct any personal data if it found to be inaccurate or out of date free of charge;
- The right to request your personal data is erased where it is no longer necessary to retain such data;
- The right to withdraw your consent to the processing at any time, where consent was the lawful basis for processing the data;
- The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), where applicable i.e. where the processing is based on consent or is necessary for the performance of a contract with the date subject and where the data controller processes the data by automated means;
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data, (where applicable i.e. where processing is based on legitimate interest (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics).
- Transfer of Data Abroad
It may sometimes be necessary to transfer personal information overseas. When this is needed, information is shared within the European Economic Area (EEA) or internationally, as required by law. Any transfers made will be in a full compliance with all aspects of the provisions of GDPR.
- Automated Decision Making
We do not use any form of automated decision making in our business, which utilises your personal data.
- Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then a new notice explaining the new use will be published on our website prior to commencing the processing and setting out the relevant purposes and processing conditions.
- Changes to our privacy policy
Any changes we make to our privacy policy in the future will be forwarded by email. Please check back frequently to see any updates or changes to our Privacy Policy.
- How to make a complaint
To exercise all relevant rights, queries or complaints, please in the first instance contact our data processing officer Ivan Mckenzie at imckenzie@rushtonsifs.co.uk.
If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office on 0303 123 1113, or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.