iD-Company Ltd

 

GDPR: General Data Protection Regulation Policy

 

Statement:

GDPR stands for General Data Protection Regulation, replacing the previous Data Protection, coming into effect on 25th May 2018 in order to comply with new EU regulations. 

 

GDPR states that personal data should be ‘processed fairly and lawfully’ and collected for specified, explicit and legitimate purposes’ and that individual’s data is not processed without their knowledge and are only processed with their ‘explicit’ consent. GDPR covers personal data relating to individuals.  iD-Company Ltd is committed to protecting the rights and freedoms of individuals with respect to the processing of children’s, parents, visitors, examiners, teachers, volunteers and staff personal data.

 

The Data Protection Act gives individuals the right to know what information is held about them.  It provides a framework to ensure that personal information is handled properly.

 

iD-Company Ltd is registered with the ICO (Information Commissioners Office) under registration reference: ZA393548

 

GDPR includes 7 rights for individuals:

 

  1. The right to be informed

iD-Company Ltd only stores information that is absolutely necessary for us to perform our duties as a company. All information is held under strict confidential conditions protected by both password and high-end software and security.  We need to know information regarding students’ name, date of birth, address, contact number, email address, medical history and allergies – if the student does not have a phone number or email address – we ask for a Parent/Guardian’s details on this.  We also request for an emergency contact name and phone number.  At times throughout the year, this information may be requested by performing council areas; this information is sent to the Local Authority via a secure electronic file transfer system.

 

We are required to collect certain details of visitors to our company.  We need to know visitors’ names, telephone numbers, and where appropriate; company name. This is in respect of our Safeguarding Policy and the event of a fire or injury.

 

When employing staff, iD-Company Ltd is required to hold the following data; name, address, email address, telephone number, date of birth, National Insurance number, photographic ID, passport or driver’s license, bank details, an up to date Disclosure and Barring Service check (DBS – formally known as a CRB), a copy of teaching qualifications, public liability insurance and first aid training.  DBS UTR numbers and date of issue are also held on a central staffing record.

​

  2.The right of access

An individual is able to make a request relating to their personal information and data that iD-Company Ltd holds for a fee, that is considered reasonable by ICO regarding GDPR.  iD-Company will then provide a response within 4 weeks.  iD-Company can refuse a request, if we have a lawful obligation to retain the data but we will inform the individual of the reasons for the rejection. 

 

  3. The right to rectification

An individual can make a request relating to their data held by iD-Company at any time.  iD-Company will follow all instructions to make sure all information held is accurate and check annually that the information is still correct.  If an individual’s data, held by iD-Company is requested and the individual notices a discrepancy with their information, iD-Company will alter the data and re-send it back to the individual (within 1 week) to check thoroughly that all information is correct and accurate.  We do request that any updated information that an individual has must be submitted to us as and when it happens.  

 

  4. The right to erasure

Individuals have the right to request your personal information and data being deleted where there is no compelling reason for its continued use, however in doing so, you may risk your membership/role in the company being cancelled.  iD-Company Ltd has a legal duty to keep data records of our students, parents and guardians’ details for a reasonable time, accidental and injury records kept for 19 years (or until the student reaches 21 years), and 22 years (or until the student reaches 24 years) for Child Protection records. Staff records must be kept for 6 years after terminating their contract before they can be erased.  This data is archived securely onsite and shredded after the legal retention period.

 

  5. The right to restrict processing

Parents, visitors and staff can object to iD-Company Ltd processing their data.  This means that records can be stored but must not be used in any way, for example for reports, communications or publicity/promotion etc.

 

  6. The right to data portability

iD-Company Ltd may require for data to be transferred from one IT system to another; such as from iD-Company Ltd to the Local Authority, for performance licenses and dance associations for examinations.  These recipients use secure file transfer systems and have their own policy procedures in place in relation to GDPR.

 

  7. The right to object

Parents, visitors, volunteers and staff have the right to object to their data being used for certain activities like marketing or research.

 

  8. The right not to be subject to automated decision-making including profiling

Automated decisions and profiling are used for marketing based organisations.  iD-Company Ltd does not use personal data for such purposes.

 

 

Use of Personal Information and Storage:

 

As a professional examination board, iD-Company Ltd has a legal duty to store the following information on you as a member;

​

Name, address, email address, telephone and mobile numbers, membership number, qualifications, enhanced DBS, enhanced DBS certificates information and previous business trading with iD-Company Ltd such as examination sessions, purchase of Syllabi, "Programmes of Study" and merchandise etc.  As well as information regarding your CPD (Continuing Professional Development) attendance and any courses that you may attend.

​

We also store information on candidates that take iD examinations with us and attend our courses (either amateur or professional), such as:

​

Medal Test Exams:

Name, subject taken and mark achieved

​

Graded Exams:

Name, address, email address.

​

Summer and Easter school:

Name, address, email address.

​

Payments made online:

...

​

Who we share your information with:

We share your information with the following organisations to be able to run an efficient and professional service:

Royal Mail - name and address

Courier Companies - name and address

​

iD Examiners and teachers;

...

​

iD-Company Ltd keeps all paper copies of students, examination students, staff and teaching records in a locked filling cabinet.  All records are completely confidential.  These records remain on site at all times.  Paper records are shredded after the retention period.

 

Access to company computers are all password protected.  Passwords are changed every six months.  When a member of staff leaves iD-Company Ltd, all passwords associated with the company are changed in line with this policy and our safeguarding policy.  All external hard drives are also password protected for extra protection.

 

Information regarding individual students for weekly registers, medical information and emergency contact details are kept on a password protected external hard drive.  These documents include data such as student’s names, date of birth and sometimes phone numbers and email addresses.  These records are deleted after the relevant retention period.

iD-Company Ltd stores personal data held visually in photographs and video clips; unless written consent has been obtained via the Photography Release Form.  Video footage will be kept as archives for choreographic purposes. In the event that an individual requests for the Right to Erasure, iD-Company Ltd will keep video footage but not expose to anyone as the choreography remains the property of iD-Company Ltd and the Choreographer.  The files will not be passed on, or shown to anyone other than iD-Company Ltd and the choreographer.  

 

If you wish to remain an active member of iD-Company Ltd you do not have to do anything.  If you do not agree for us to store information enclosed in this document, please contact us at info@id-company.co.uk expressing your termination with iD-Company Ltd and to not contact you in the future.

​

Policy Review Date: May 2019

 

 

 

​