Derroll Tozer
T/A Derroll Tozer Upholstery
Privacy Policy
When I process your personal data from 25 May 2018 I am required to comply with the General Data Protection Regulation 2016 (“GDPR”)
As a sole trader, I am the DATA CONTROLLER, the person who controls and is responsible for any data I hold, which identifies you.
Your personal data includes all the information I hold that identifies you or is about you, including but not limited to your name, email address, postal address and phone number.
Everything I do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it. I am therefore required to comply with the Data Protection Legislation to make sure that your information is properly protected and used appropriately. This privacy policy provides information about the personal data I process about you, why I process it and how I process it.
My Responsibilities
Derroll Tozer upholstery is the data controller of the personal data you provide. It is my responsibility to ensure I comply with the Data Protection Legislation and dealing with any requests I receive from individuals exercising their rights under the Data Protection Legislation. If you would like to contact me about my compliance with the Data Protection Legislation, you can do so via email at tozerchairs@aol.con or by mail to Derroll Tozer Upholstery 127 Camden road, Tunbridge Wells, Kent Tn1 2qy
Why do I need to process your personal data?
I process your personal data in order to fulfil the contract I have entered into with you, to provide the services you have requested from me or to receive services or goods from you. I may also process your personal data to respond to any queries or comments you submit to me, to send you marketing information where I have your consent or where I am otherwise entitled to send marketing to you in accordance with the Data Protection Legislation. I may need personal data from you to be able to enter into a contract with you and provide you with all the information you need. If I do not receive that personal data from you, I may be unable to fulfil my obligations to you. I process most of your information on the grounds of our legitimate interests (i.e. processing that is necessary to continue my relationship with you and to provide you with or receive from you (as applicable) services or products), fulfilment of my contract with you or to comply with a legal obligation. You can withdraw your consent at any time. This won’t affect the lawfulness of any processing we carried out prior to you withdrawing your consent.
Who will receive your personal data?
I only transfer your personal data to the extent I need to. Recipients of your personal data may include Quickbooks Online (Accountancy and invoicing), suppliers & delivery companies when requests are made for samples or fabric only deliveries.
I may transfer your personal data outside of the EEA to Quickbooks Online located in the United States of America. Quickbooks is a member of the Privacy Shield Scheme which means it offers adequate protection in respect of the personal data I transfer to it.
How long will we keep your personal data?
I will retain your personal data for a minimum of 7 years from the date I last provided services or products to you. I may increase this period if I have legitimate reasons or Legal obligations to retain your personal data for a longer period of time
I will retain your personal data as follows:
(a) Paper accounting records will be retained for a period of seven years.
(b) Personal data for enquiries that did not proceed will be retained for a minimum period of one year and a maximum period of seven years following initial contact.
(c) Contract details and contact information for customers of my services will be retained indefinitely so I maintain archived records of all services provided.
What are your rights?
You benefit from a number of rights in respect of the personal data I hold about you. I have summarised your rights below.
Your principal rights under data protection law are:
1. Access to your data - You have the right to ask me to confirm the personal data that I hold for you as well as access to / copies of your personal data. I will provide the information free of charge unless your request is excessive or repetitive, in which case I am entitled to charge a reasonable fee. I may also charge you if you request more than one copy of the same information. I will provide the information you request as soon as possible and in any event within one month of receiving your request
2. The right to rectification - If you believe personal data I hold about you is inaccurate or incomplete; you can ask me to rectify that information. I will comply with your request within one month of receiving it, unless I don’t feel it’s appropriate in which case I’ll let you know why. I will also let you know if I need more time to comply with your request.
3. The right to erasure - In some circumstances, you have the right to ask me to delete personal data I hold about you. This right is available to you where I no longer need your personal data for the purpose for which I collected it. Where I have collected your personal data on the grounds of consent and you withdraw that consent. Where you object to the processing and I don’t have any overriding legitimate interests to continuing processing the data. Where I have unlawfully processed your personal data (i.e. I have failed to comply with GDPR); and where the personal data has to be deleted to comply with a legal obligation.
There are certain scenarios in which I am entitled to refuse to comply with a request. If any of those apply, I’ll let you know.
4. The right to restrict processing - In some circumstances you are entitled to ask to suppress processing of your personal data. This means I will stop actively processing your personal data but I don’t have to delete it. This right is available to you if you believe the personal data I hold isn’t accurate – I’ll cease processing it until I can verify its accuracy. If you have objected to me processing the data – I’ll cease processing it until I have determined whether my legitimate interests override your objection or if the processing is unlawful or if I no longer need the data but you would like us to keep it because you need it to establish, exercise or defend a legal claim.
5. The right to data portability - You have the right to ask us me provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller. This right only applies to personal data you provide to me where processing is based on your consent or for performance of a contract (i.e. the right does not apply if I process your personal data on the grounds of legitimate interests); and where I carry out the processing by automated means. I’ll respond to your request as soon as possible and in any event within one month from the date I receive it. If I need more time, I’ll let you know.
6. The right to complain - You have the right to complain to a supervisory authority; and you are entitled to object to me processing your personal data if you think I have processed your personal data unlawfully or that I have not complied with GDPR, you can report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website - https://ico.org.uk/concerns/.
T/A Derroll Tozer Upholstery
Privacy Policy
When I process your personal data from 25 May 2018 I am required to comply with the General Data Protection Regulation 2016 (“GDPR”)
As a sole trader, I am the DATA CONTROLLER, the person who controls and is responsible for any data I hold, which identifies you.
Your personal data includes all the information I hold that identifies you or is about you, including but not limited to your name, email address, postal address and phone number.
Everything I do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it. I am therefore required to comply with the Data Protection Legislation to make sure that your information is properly protected and used appropriately. This privacy policy provides information about the personal data I process about you, why I process it and how I process it.
My Responsibilities
Derroll Tozer upholstery is the data controller of the personal data you provide. It is my responsibility to ensure I comply with the Data Protection Legislation and dealing with any requests I receive from individuals exercising their rights under the Data Protection Legislation. If you would like to contact me about my compliance with the Data Protection Legislation, you can do so via email at tozerchairs@aol.con or by mail to Derroll Tozer Upholstery 127 Camden road, Tunbridge Wells, Kent Tn1 2qy
Why do I need to process your personal data?
I process your personal data in order to fulfil the contract I have entered into with you, to provide the services you have requested from me or to receive services or goods from you. I may also process your personal data to respond to any queries or comments you submit to me, to send you marketing information where I have your consent or where I am otherwise entitled to send marketing to you in accordance with the Data Protection Legislation. I may need personal data from you to be able to enter into a contract with you and provide you with all the information you need. If I do not receive that personal data from you, I may be unable to fulfil my obligations to you. I process most of your information on the grounds of our legitimate interests (i.e. processing that is necessary to continue my relationship with you and to provide you with or receive from you (as applicable) services or products), fulfilment of my contract with you or to comply with a legal obligation. You can withdraw your consent at any time. This won’t affect the lawfulness of any processing we carried out prior to you withdrawing your consent.
Who will receive your personal data?
I only transfer your personal data to the extent I need to. Recipients of your personal data may include Quickbooks Online (Accountancy and invoicing), suppliers & delivery companies when requests are made for samples or fabric only deliveries.
I may transfer your personal data outside of the EEA to Quickbooks Online located in the United States of America. Quickbooks is a member of the Privacy Shield Scheme which means it offers adequate protection in respect of the personal data I transfer to it.
How long will we keep your personal data?
I will retain your personal data for a minimum of 7 years from the date I last provided services or products to you. I may increase this period if I have legitimate reasons or Legal obligations to retain your personal data for a longer period of time
I will retain your personal data as follows:
(a) Paper accounting records will be retained for a period of seven years.
(b) Personal data for enquiries that did not proceed will be retained for a minimum period of one year and a maximum period of seven years following initial contact.
(c) Contract details and contact information for customers of my services will be retained indefinitely so I maintain archived records of all services provided.
What are your rights?
You benefit from a number of rights in respect of the personal data I hold about you. I have summarised your rights below.
Your principal rights under data protection law are:
1. Access to your data - You have the right to ask me to confirm the personal data that I hold for you as well as access to / copies of your personal data. I will provide the information free of charge unless your request is excessive or repetitive, in which case I am entitled to charge a reasonable fee. I may also charge you if you request more than one copy of the same information. I will provide the information you request as soon as possible and in any event within one month of receiving your request
2. The right to rectification - If you believe personal data I hold about you is inaccurate or incomplete; you can ask me to rectify that information. I will comply with your request within one month of receiving it, unless I don’t feel it’s appropriate in which case I’ll let you know why. I will also let you know if I need more time to comply with your request.
3. The right to erasure - In some circumstances, you have the right to ask me to delete personal data I hold about you. This right is available to you where I no longer need your personal data for the purpose for which I collected it. Where I have collected your personal data on the grounds of consent and you withdraw that consent. Where you object to the processing and I don’t have any overriding legitimate interests to continuing processing the data. Where I have unlawfully processed your personal data (i.e. I have failed to comply with GDPR); and where the personal data has to be deleted to comply with a legal obligation.
There are certain scenarios in which I am entitled to refuse to comply with a request. If any of those apply, I’ll let you know.
4. The right to restrict processing - In some circumstances you are entitled to ask to suppress processing of your personal data. This means I will stop actively processing your personal data but I don’t have to delete it. This right is available to you if you believe the personal data I hold isn’t accurate – I’ll cease processing it until I can verify its accuracy. If you have objected to me processing the data – I’ll cease processing it until I have determined whether my legitimate interests override your objection or if the processing is unlawful or if I no longer need the data but you would like us to keep it because you need it to establish, exercise or defend a legal claim.
5. The right to data portability - You have the right to ask us me provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller. This right only applies to personal data you provide to me where processing is based on your consent or for performance of a contract (i.e. the right does not apply if I process your personal data on the grounds of legitimate interests); and where I carry out the processing by automated means. I’ll respond to your request as soon as possible and in any event within one month from the date I receive it. If I need more time, I’ll let you know.
6. The right to complain - You have the right to complain to a supervisory authority; and you are entitled to object to me processing your personal data if you think I have processed your personal data unlawfully or that I have not complied with GDPR, you can report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website - https://ico.org.uk/concerns/.