At Spencer and Arlington, we take privacy very seriously and are currently updating all our records and processes to ensure that we are fully meeting the data protection standards introduced by the General Data Protection Regulation (GDPR) on 25 May 2018.
We are registered as data processors with the Information Commissioner’s Office (ICO).
The categories of information that we collect, hold and may share include:
personal information (such as name, address, date of birth)
characteristics (such as ethnicity, language, nationality, country of birth).
The lawful basis on which we use this information
We collect and use information under the following lawful bases established by the GDPR.
Legitimate interests: the processing involves using your data in ways you would reasonably expect and which have a minimal privacy impact.
Legal obligation: the processing is necessary for us to comply with the law (submitting data to Government Departments for example).
Who we share information with
We routinely share information with:
local authorities *
suppliers and contractors *
government departments *
other companies within the group *
Why we share information
We do not share information with anyone without your consent unless the law and our policies allow us to do so.
We are required to share certain data with official bodies (such as HMRC or the Department for Work and Pensions (DWP)) on a statutory basis.
Data collection requirements
To be granted access to any information we hold, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
We do not keep data for any longer than necessary and do not allow its use for any purpose other than that for which it has been collected. Should new processes be introduced into the organisation or innovative uses of the data we hold, you will be kept informed at each stage.
Requesting access to your personal data
Under the GDPR, you have the right to request access to information about you that is held by this organisation. To make a request for your personal information, contact Matilda Stevens who will deal with the request within 30 days.
You also have the right to :
object to the processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means and
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with Matilda Stevens in the first instance. This does not affect your right to complain to the Information Commissioner’s Office (ICO) (ico.org.uk).
As detailed above, Spencer and Arlington will only use your personal information to administer your account and to provide the products and services you have requested from us.