Access Anyone Ltd

Privacy Notice Policy

Version Control

Document Title:	Privacy notice policy	
Version Number:	4	
Date:	July 22	
Author:	J Milligan	
Review Date:	Oct 28	

Record of Change:

Version	Date	Change	Authorisation	
1	Feb 20	No	im	
2	Mar 21	Yes	cm	
3	July 22	TYL privacy notice added	cm	
4	March 24	Cyber essentials	cm	

				

Access Anyone Ltd. Privacy Notice

This legislation replaced current data privacy law, giving more rights to you as an individual and more obligations to organisations holding your personal data.

One of the rights is a right to be informed, which means we have to give you even more information than we do now about the way in which we use, share and store your personal information.

This means that we will be publishing a new privacy notice so you can access this information, along with information about the increased rights you have in relation to the information we hold on you and the legal basis on which we are using it.

This new privacy notice will be published on our website, www.accessanyone.co.uk after 25 May 2018.

Overview
Access Anyone Ltd respects your right to privacy. This privacy policy has been developed to inform you about the privacy practices followed by Access Anyone Ltd in connection with its websites, products and services. This privacy policy does not apply to Access Anyone Ltd services offered by or through our partners, or other third parties, or other third-party services or websites, and we encourage you to read the privacy policies of those parties. This privacy policy will inform you about what data is collected, how we use such data, where data is processed, how you may opt out of your data being used, the security provisions around storing your data and how to correct or update your data.

What is Personal Data
Personal data is defined as data relating to a living individual who can be identified from that data and other information which is in the possession of, or is likely to come into the possession of the data controller and includes an expression of opinion about the individual and any indication of the intentions of the data controller, or any other person in respect of the individual. GDPR's definition is more detailed and makes it clear that information such as an online identifier- e.g. an IP address, email address - can be personal data. The more expansive definition provides for a wide range of personal identifiers to constitute personal data, reflecting changes in technology and the way organisations collect information about people.

The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This is wider than the DPA's definition and could include chronologically ordered sets of manual records containing personal data.

Collection of Personal Information
We collect and store information from you when you:

•	Contract with Access Anyone Ltd to fulfil various transport services
•	Transact between the two companies via email, post or telephone
•	Call into our office

Use of Personal Information
Access Anyone Ltd treats personal information as confidential. Your information, whether public or private, will not be sold, exchanged, transferred outside of our company, or given to any other company for any reason without your consent.

Processing of Data and Consent
We will process your data for the purpose of performance of our contract or service with you or the legitimate interest of our businesses. In other cases, we will request your consent for the processing of the personal data you may submit.

Your refusal to provide personal data to us for certain services may hinder us from fulfilling your need for those services.

Also, if you deny or withdraw your consent to use personal data or opt out of receiving information about Access Anyone Ltd services this may result in you not being made aware of related service information, special events or service availability.

We will gain additional consent to:
•	To register further services on your behalf.
•	Register personal information with 3rd parties so to assist the company in gaining services from those 3rd parties.
•	During the course of duties, if we need to pass information to a third party, we will obtain consent that the data can be shared, AND record this in our records. However, if we need to share information for legitimate business reasons, or for emergency medical reasons, we reserve the right to do so.
Data Retention
We retain all accounting data for a period including seven complete financial years, this may include some personal data such as names and addresses. All other legitimate business data may be retained for a maximum of six years from completion of any services to a client.

Data relating to employees is retained during employment and for a period of six years after termination of employment.

How we protect your information
Data stored on paper is kept in a secure place that people cannot see or access it. Data print outs are removed immediately, if not required the data is shredded.
Electronically stored data;

o	Removable devices which are locked away, this data is encrypted
o	Data stored to cloud based service; office 365
o	Data backed up on the company servers, the data is encrypted
o	All servers and computers containing data are protected by approved Anti Virus and firewalls. These are kept up to date with patches.
o	Access Anyone Limited complies with the requirements of the Cyber Essentials Scheme and DSP toolkit.
All Data is destroyed after the correct retention period.

Any photographs taken are not to include faces, if ID photos need to be taken the photograph will be deleted immediately from the device.
Passwords must be changed every six months and contain at least 9 alphanumeric characters, contain both upper and lower case letters, contain one number, and at least one special character.
Access Anyone Ltd will ensure a forced password change schedule for computer user login details and run scans at regular intervals through out the year to assess password compliance.

Access to your personal information
Access Anyone Ltd tries to be as open as it can be in terms of giving people access to their personal information. Individuals (not companies) can find out if we hold any personal information by making a 'subject access request' under the Data Protection Act 1998. If we do hold information about you we will:

•	give you a description of it;
•	tell you why we are holding it;
•	tell you who it could be disclosed to; and
•	let you have a copy of the information in an intelligible form.

To make a request to Access Anyone Ltd for any personal information we may hold you need to put the request in writing. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting Access Anyone Ltd in writing.

We will require you to provide identification in order to verify the authenticity as the data subject. We will make reasonable effort to respond to and process your request in a timely manner.

Opting out; withdrawing consent
If at any time you would like to unsubscribe from receiving future emails, you may ask us in writing, or by email, to remove you name from our mailing list.

If Access Anyone Ltd is processing your personal data based on your consent, you may withdraw your consent at any time by contacting Access Anyone Ltd in writing, or by email.

Links to other websites and services
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Where we send information, or resell services which relates to 3rd party organisations, weather this is sold via Access Anyone Ltd or you contract directly with the 3rd party. We encourage you to read the privacy statements of the other parties. Relevant subject requests will need to be made directly to each 3rd party.

People who make a complaint to us
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide.

We usually have to disclose the complainant's identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person's record is in dispute. If a complainant doesn't want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the 'need to know' principle.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

Your rights
In compliance with the European Union rules on privacy, you have the following rights established by law:

•	We use the data you submit only for purposes identified in the section of this privacy policy.
•	You have the right to review your personal data and check it for accuracy.
•	You have the right to correct data in the case that errors may be found in our records.
•	You have the right to request that any of your personal data be erased. i.e. right to be forgotten.
•	You have the right to obtain and reuse use your personal data for your own purposes
•	You have the right to request that Access Anyone Ltd restrict the processing of your personal data under certain circumstances.
•	You have the right to object to our processing of your personal data.

Changes to our Privacy Policy
If we make material changes to our privacy policy, we will inform customers by emailing a notice of the availability of a new version with a link to the new version on our web site.

TYL Card Machine Privacy Notice

This privacy notice sets out how we use and protect any personal information that you share with us when you make a transaction with us, and sets out the basis, under applicable data protection law (including the General Data Protection Regulation (EU 2016/679), on which we will process any personal data we collect from you.

We are the "controller" of any personal information that you share with us as we make decisions on what information we hold and what we do with it. We are committed to ensuring that your privacy is protected, in line with current applicable data privacy laws. Should we ask you to provide certain information by which you can be identified when using this website and our services, then you can be assured that it will only be used in accordance with this privacy notice. We may change this Notice in the future, if we do we will notify you".

Should you have a concern regarding our management of your personal data or need further information, please do not hesitate to contact us, you will find our contact details on your electronic transaction receipt.

The Personal Data We Collect

When you make a payment in our store, we collect information about the transaction, which may include personal data and preferences. Information about transactions includes the payment card used, name associated with the payment card, the fact that the purchase was made at our store and the address of our store, date and time of the transaction, transaction amount, and information about the goods or services purchased in the transaction.

For the purposes set out in this Notice, information including personal information detailed below relating to you ("Personal Data") may be collected and processed by us.

Personal data

•	Transaction based information as mentioned above.
•	The goods or services purchased, which may include data relating to health products or health services though this data is not used to profile or identify you and only is used for statistical purposes to provide insight to us as to what products or services were purchased where and when but not by whom.
•	Your email address, mobile phone number (if you want an electronic receipt).
•	Your marketing preferences, such as whether you wish to receive marketing communications or newsletters.
•	Information about your participation in our loyalty program, if you choose to participate
•	Other information you provide, such as your birthdate, interests or preferences, reviews, and feedback
•	Sensitive personal data

We process your Personal Data you in accordance with this Privacy Notice, a copy of which can be provided on request.

How and Why We Process Your Personal Data

The following tables detail how ("Legal Basis") and why ("Purposes") we process your Personal Data. These tables also detail the third-party service providers with whom we share your Personal Data ("Recipients") and the period that your Personal Data will be stored ("Retention"). We encourage you to read this section.

Legal basis for processing

1.	Purposes

We obtain, collect and process your Personal Data to:

•	To process your transaction for the goods and services you are buying from us including returns/refund.
•	Provide you with an electronic receipt.
•	Checking for fraud and/or managing our risk.
•	Administering our business.
•	To help us improve the service we provide to you
-	managing our relationship with you
-	personalising the way we provide our products and services
-	Maintaining records of customers' purchase history and activity.
-	Providing support and maintenance for our products and services.

2.	Legal basis

It is necessary to process your Personal Data in order to provide these services to you as follows:

•	Contract - to process your transaction for the goods and services you are buying from us.
•	Consent - to provide you with an electronic receipt.
•	Legitimate Interest - checking for fraud and/or managing our risk
•	Legitimate Interest - administering our business.
•	Consent - to help us improve the service we provide to you.

3.	Recipients

Personal Data will be disclosed for these purposes to our third-party service providers. These Recipients may include:

•	Clover Network Inc, a member of the First Data group of companies.
•	The Royal Bank of Scotland Group and its service providers.

4.	Retention

We retain your personal information for as long as necessary to (a) provide our products and services; (b) comply with legal obligations; (c) resolve disputes; and (d) enforce the terms of any agreement we may have with you. You may contact us for additional information about our data retention practices in connection with the Service.

Important

You may choose not to provide your personal data to us. If you decide not to provide information that we request, in some circumstances we may

Cross-Border Transfers of Your Personal Data
Your data is not transferred outside of Europe.

Your Acknowledgment of this Notice and Your Rights

You have rights which allow you to address any concerns or queries with us regarding our processing of your Personal Data:

Right to Withdraw Consent

You have a right to withdraw your consent, at any time, to our processing of your Personal Data which is based on your consent. Where you exercise this right, our processing of your Personal Data prior to your withdrawal of consent will remain valid.

If you withdraw your consent, we may not be able to provide certain products or services to you.

Right to Object to Processing

In certain circumstances, you have a right to object to our processing of your Personal Data where we process it on the legal bases of: a) our legitimate business interest, including profiling based on our legitimate business interests; orb) your consent to marketing. We may not be able to comply with such a request where we can demonstrate that there are compelling legitimate grounds for us to process your Personal Data which override your interests, rights and freedoms or where the processing of your Personal Data is required for compliance with a legal obligation or in connection
with legal proceedings.

Right of Access
You have the right to access and obtain a copy of the Personal Data that we hold about you. We will only charge you for making such an access request where we feel your request is unjustified or excessive.

Written access requests can be made to caroline@accessanyone.co.uk
  IG Manager gives access rights to systems under organisations control. 
  
Right to Rectification
You have the right to request that we correct any inaccuracies in the Personal Data stored about you.

Right to Erasure

In certain circumstances, you have the right to request that we erase your Personal Data. For example, you may exercise this right in the following circumstances:

•	your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by us;
•	where you withdraw consent and no other legal ground permits the processing;
•	where you object to the processing and there are no overriding legitimate grounds for the processing;
•	your Personal Data have been unlawfully processed; or
•	your Personal Data must be erased for compliance with a legal obligation.

Where we store your Personal Data for statistical purposes, we may not be able to comply with such a request where it would likely impair such statistical purposes or where we require your Personal Data for compliance with a legal obligation or in connection with legal proceedings.

Right to Restriction

You have the right to restrict our processing of your Personal Data where any of the following circumstances apply:

•	where you feel that the Personal Data which we hold about you are not accurate. This restriction will be in place for a period to enable us to verify the accuracy of your Personal Data;
•	where the processing is unlawful and you do not want your Personal Data be erased and request the restriction of its use instead;
•	where we no longer need to process your Personal Data (e.g. any of the Purposes outlined above have been completed or expire), but we require it in connection with legal proceedings;
•	where you have objected to our processing of your Personal Data pending the verification of whether or not our legitimate business interests override your interests, rights and freedoms.

Where you exercise your right to restrict our processing of your Personal Data, we will only continue to process it with your consent or in connection with legal proceedings or for the protection of the rights of other people or for reasons of important public interest.

Right to Data Portability

You have a right to receive and transfer the Personal Data that you provide to us in a structured, commonly used and machine-readable format where we process your Personal Data on the legal bases of: a) your consent; orb) where it is necessary to perform our contract with you. Where you make such a request, we will directly transfer your Personal Data on your behalf to another controller of your choice (where it is feasible for us to do so).

Right to Object to Automated Decision-Making, including profiling

You have a right not to be subjected to decisions based solely on automated decision-making, including profiling, which produce legal effects concerning you or similarly significantly affects you. We may not be able to comply with such a request where we rely on the legal bases of: a) your explicit consent; orb) where it is necessary to enter and perform our contract with you (as detailed in section 2 above). You will however be entitled to have a person from our team review the decision so that you can query it and set out your point of view and circumstances to us.

If you would like to exercise any of your rights detailed above, please contact using the contact details found on your electronic receipt.

New Purpose/ New Use of your Data

We may use your personal data for reasons not described in this Privacy Notice where permitted by law and the reason is compatible with the purpose for which we collected it. If this is the case we will provide you prior to that further processing with information on that other purpose and with any relevant further information.

Marketing

We may also contact you with marketing communications using the personal data that you provide to us when you make a purchase if you agree to receive them. You can ask us to stop sending you marketing messages at any time by clicking on the opt-out link included in each marketing message or by contacting us.

Compliance, fraud prevention and safety

We use your personal data as we believe necessary or appropriate to (a) enforce the terms and conditions that govern our products and services; (b) protect our rights, privacy, safety or property,

and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Changes to this Notice

We may amend this notice on occasion, in whole or part, at our sole discretion. Any changes to notice will be effective immediately upon sending the revised notice to you by e-mail or SMS.

If at any time we decide to use your Personal Data in a manner significantly different from that stated in this notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail or SMS, and you will have a choice as to whether or not we use your information in the new manner.

Complaints and Concerns

If you have a complaint about our handling of your personal data, you may contact us via the information provided on your electronic receipt.

You may raise any concerns about our processing of your Personal Data with the Information Commissioner Office on https://ico.org.uk/.

Our Contact Details

For questions on how we use your data or to exercise your rights under the legislation you can contact us using the information provided on your electronic receipt.