Your Privacy: Our General Data Protection Regulation compliance statement
This is a statement of the General Data Protection Regulation compliance policy that is adopted by HCEOA Ltd for delivering our services. HCEOA Ltd will, when delivering these services, collect and use personal information only which is relevant to the work that we are undertaking and which will be controlled, stored and processed in accordance with the General Data Protection Regulations (GDPR), howsoever it is collected, recorded and used; whether it be on paper, in electronic media form (e.g. in a computer system), or recorded by other means. We consider the lawful and correct treatment of personal information by the company as critical in maintaining the confidence of our members; we therefore manage and process personal information lawfully and correctly.
Information is defined under the GDPR as being Personal Information if any of the following criteria are met:
- Can a living individual be identified from the data, or, from the data and other information in the possession of, or likely to come into the possession of, the data controller?
- Does the data “relate to” the identifiable living individual, whether in their personal or family life, business or profession?
- Is the data “obviously about” a particular individual?
- Is the data “linked to” an individual so that it provides particular information about that individual?
- Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?
- Does the data have any biographical significance in relation to the individual?
- Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction, or event?
- Does the data impact or have the potential to impact on an individual, whether in a personal, family, business, or professional capacity?
We adhere to the Principles of Data Protection, as set out in The Data Protection Act 1998 and the General Data Protection Regulations (GDPR), which came into force on 25th May 2018.
Specifically, these Principles require that personal information:
- Shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met.
- Shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with that purpose or those purposes.
- Shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
- Shall be accurate and, where necessary, kept up to date.
- Shall not be kept for longer than is necessary for that purpose or those purposes.
- Shall be processed in accordance with the rights of data subjects under the Act.
- Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
- Shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
HCEOA Ltd will, through appropriate management and by strict application of criteria and controls:
- Observe fully the conditions regarding fair collection and use of information.
- Meet its legal obligations to specify the purposes for which information is used.
- Collect and process appropriate information and only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements.
- Ensure that the quality and accuracy of information used is adequate and is maintained.
- Apply strict checks to determine the length of time information is held and that it is stored for no longer than is necessary.
- Ensure that the rights of people about whom information is held are able to be fully exercised under the Act and Regulations.
- These include: the right to be informed that processing is being undertaken, the right of access to one’s personal information, the right to prevent processing in certain circumstances and the right to correct, rectify, block or erase information.
- Take appropriate technical and organisational security measures to safeguard personal information.
- Ensure that personal information is not transferred abroad to countries to which transfers are not permitted under the GDPR.
The information storage and processing systems used by HCEOA Ltd are designed and operated in accordance with International standards for information security management systems . This is designed to ensure that:
- There is an officer appointed with specific responsibility for data protection within the organisation: You may contact our Data Protection Officer by e-mail using the Contact Us form on our web site or by letter addressed to The DPO, HCEOA Ltd, Suite S31, Northwich Business Centre, meadow Street, Northwich, Cheshire CW9 5BF. Everyone handling, managing and working with personal information understands that they are contractually and legally responsible for following the GDPR and good data protection practice.
- Everyone handling, managing and working with personal information is appropriately trained to do so.
- Everyone handling, managing and working with personal information is appropriately supervised.
- Anyone wanting to make enquiries about personal information knows how to do so.
- Queries about personal information are promptly and courteously dealt with, in accordance with the GDPR.
- Methods of handling, managing and working with personal information are clearly described.
- A regular review and audit is made of the way personal information is managed.
- Methods of handling, managing and working with personal information are regularly reviewed, assessed and evaluated.
- The performance of the methods and process is regularly reviewed, assessed and evaluated.
Information processing - general
We do not undertake automated decision making about, or profiling of personal data. Data subjects have a right, as set out in the GDPR, to obtain the personal information which is stored and used by us and can obtain this information by contacting the Data Protection Officer whose details are given in this document. The data comprising the personal information will be delivered to the data subject in a secure manner and in a format which is readily accessible using common proprietary data access tools (such as word processor document or spreadsheet viewer programs).
GDPR compliant policy for membership information
What information do we obtain, process and/or store:
- We receive basic personal information relating to members and prospective members of the Association from the members themselves when applying.
- The personal information which is obtained consists of name, address(es), date of birth and details of relevant qualifications and career information.
We do not hold information relating to the data subjects’ health or financial status.
What we use the data we collect for:
- The information which we obtain, store and process is necessary and is used to enable us to manage the admission to and membership of the Association. We are further required under the Tribunal Courts and Enforcement Act 2007 (TCE Act 2007) to maintain a register of Authorised High Court Enforcement Officers appointed by the Lord Chancellor.
- Due to the duty to maintain the register, we are required to retain the detailed information recording the Authorised High Court Enforcement Officer for 6 years in accordance with The Limitation Act 1980. Because we are required under The TCE Act 2007 and related legislation to maintain a register, we are not able to delete personal data stored for this purpose. At no stage will we divulge to a third party any personal data unless specifically ordered to do so by the Court.
- No information concerning the data subject given to us by our clients or obtained during the course of our enforcement actions will be used for any other purpose.
- At all stages of this process we act as a data controller and as such we will fully comply with the GDPR and with the Data Protection Act and its guiding principles.
GDPR compliant policy for complaint information
What information do we obtain, process and/or store:
- We receive basic personal information from the complainant when submitting a complaint.
- The personal information which is obtained consists of name, address(es), and details of the complaint, the data specific to the complaint and the officer about whom the complaint is made.
We do not process or hold information relating to any of the data subjects’ health or financial status.
What we use the data we collect for:
- The information which we obtain, store and process is necessary and is used to enable us to investigate the complaint, to enable our review and to manage our actions in response
- Due to the potential for subsequent litigation, we will retain the detailed information recorded for 6 years from the completion of the complaint review and resolution, in accordance with The Limitation Act 1980. At no stage will we divulge to a third party any personal data unless specifically ordered to do so by the Court.
- No information concerning the data subjects given to us by our clients or obtained during the course of our complaint management actions will be used for any other purpose.
- At all stages of this process we act as a data controller and as such we will fully comply with the GDPR and with the Data Protection Act and its guiding principles.”
Service Delivery.
We use information which we collect to provide and to improve the services which we offer and to undertake essential business operations. This includes service delivery and monitoring, maintaining and improving the quality standards, security and performance of our services, developing new services, conducting research and providing advice to our members.
Examples of such uses include the following:
Communications.
We use information which we collect to communicate with our members, and thus to personalise our communications. We may contact or members by telephone or by e-mail or other means to inform them when a publication or presentation which may be of professional interest is available or to enquire or to advise about a service enquiry that they have made, or to invite them to participate in a survey or to attend a commercial event.
For information about how to manage, edit or to delete contact data which contains your personal information, please use the contact and access section of this privacy statement.
Our Use of Cookies and Similar Technologies
We use cookies and similar technologies for several purposes, including:
- Sign-in and Authentication. When you sign into a website using your account credentials, we store a unique ID number, and the time you signed in, in an encrypted cookie on your device. This cookie allows you to move from page to page within the site without having to sign in again on each page. You can also save your sign-in information so you do not have to sign in each time you return to the site.
- Security. We use cookies to detect fraud and abuse of our websites and services.
- Storing Information You Provide to a Website. When you provide information on our website, we store the data in a cookie to remember the information you have added.
- Feedback. We may use cookies to enable you to provide feedback on a website.
- Analytics. In order to provide our products, we may use cookies and other identifiers to gather usage and performance data. For example, we use cookies to count the number of unique visitors to a web page or service and to develop other statistics about the operations of our services. This includes cookies from us and from third-party analytics providers.
- Performance. We may use cookies for load balancing to ensure that our website remains up and running.
Third-party cookies
In addition to the cookies we set when you visit our website, third parties may also set cookies when you visit our site. In some cases, that is because we have hired the third party to provide services on our behalf, such as site analytics. In other cases, it may be because our web pages contain content from third parties. Because your browser connects to those third parties’ web servers to retrieve that content, those third parties are able to set or read their own cookies on your device and may collect information about your online activities across websites or online services.
How to Control Cookies
Most web browsers automatically accept cookies but provide controls that allow you to block or delete them. Most browsers allow you to refuse to accept cookies, however, blocking cookies will have a negative impact upon the usability of some websites. Certain features of our websites may depend upon cookies. Please be aware that if you choose to block cookies, you may not be able to sign in or use those features, and preferences that are dependent on cookies may be lost. If you choose to delete cookies, the settings and preferences controlled by those cookies will be deleted and may need to be recreated.
You can opt out of data collection or use by some of these analytics providers by clicking the following links:
- AppsFlyer: www.appsflyer.com/optout /
- Google Analytics: tools.google.com/dlpage/gaoptout (requires you to install a browser add-on)
- Omniture (Adobe): www.d1.sc.omtrdc.net/optout.html
- WebTrends: ondemand.webtrends.com/support/optout.asp
Disclaimer
The information provided on this website is for general informational purposes only. It is not intended as legal, financial, or professional advice, and should not be relied on as such. The HCEOA makes no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, or services, contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Changes to This Privacy Statement
We will update this privacy statement when necessary to reflect legislative changes, feedback from our members and changes to our services. When we post changes to this statement, we will revise the "last updated" date at the foot of the statement. If there are material changes to the statement or in how we will use your personal data, we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this privacy statement to learn how we are protecting your information.
How to Contact Us
If you have a privacy concern, complaint or a question for the Data Protection Officer, please contact us by using our online Contact Us form. We will respond to questions or concerns within 30 days. Unless otherwise stated, HCEOA Ltd is a data controller for personal data we collect through the products subject to this statement. Our address is Suite S31, Northwich Business Centre, Meadow Street, Northwich, Cheshire, CW9 5BF
