GDPR PRIVACY NOTICE

At Spencer and Arlington, we take privacy very seriously and are currently updating all our records and processes to ensure that we are fully meeting the data protection standards introduced by the General Data Protection Regulation (GDPR) on 25 May 2018.

We are registered as data processors with the Information Commissioner’s Office (ICO).

The categories of information that we collect, hold and may share include:

personal information (such as name, address, date of birth)
characteristics (such as ethnicity, language, nationality, country of birth).

The lawful basis on which we use this information

We collect and use information under the following lawful bases established by the GDPR.

Legitimate interests: the processing involves using your data in ways you would reasonably expect and which have a minimal privacy impact.
Legal obligation: the processing is necessary for us to comply with the law (submitting data to Government Departments for example).

Who we share information with

We routinely share information with:

local authorities *

suppliers and contractors *

government departments *

other companies within the group *

Why we share information

We do not share information with anyone without your consent unless the law and our policies allow us to do so.

We are required to share certain data with official bodies (such as HMRC or the Department for Work and Pensions (DWP)) on a statutory basis.

Data collection requirements

To be granted access to any information we hold, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

We do not keep data for any longer than necessary and do not allow its use for any purpose other than that for which it has been collected. Should new processes be introduced into the organisation or innovative uses of the data we hold, you will be kept informed at each stage.

Requesting access to your personal data

Under the GDPR, you have the right to request access to information about you that is held by this organisation. To make a request for your personal information, contact Matilda Stevens who will deal with the request within 30 days.

You also have the right to :

object to the processing of personal data that is likely to cause, or is causing, damage or distress

prevent processing for the purpose of direct marketing

object to decisions being taken by automated means and

in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with Matilda Stevens in the first instance. This does not affect your right to complain to the Information Commissioner’s Office (ICO) (ico.org.uk).

Direct marketing

As detailed above, Spencer and Arlington will only use your personal information to administer your account and to provide the products and services you have requested from us.