Our Data Policy

1. Introduction

The purpose of this policy is to set out the principles that must be observed by anyone who works for Blossom Vehicle Leasing Limited and has access to person or firm identifiable information.

2. Responsibility for confidentiality, data protection and security

The Directors shall be responsible for:

• Oversight of compliance with this policy
• Advising staff on the application of this policy
• Approving unusual or controversial requests for disclosure of data
• Handling subject access requests
• Arranging for data security risk assessment
• Reviewing this policy

3. Duty of confidentiality

All employees working within Blossom Leasing Limited owe a duty of confidentiality to protect all personal and firm information they come into contact with during the course of their work.

4. Data protection

4.1 Introduction

The Data Protection Act 2018 regulates data use. Unlike with the duty of confidentiality referred to above, the Data Protection Act is only concerned with how firms use personal data of individuals. This includes customers, non-customers and employees. It governs not only information held on computer but also information held in manual form (e.g. on file).

4.2 The Data Protection Information Commissioner

The Data Protection Information Commissioner enforces and oversees the Data Protection Act 2018. The Commissioner has a range of duties including the promotion of good information handling and the encouragement of Codes of Practice for the data controllers, that is, anyone who decides how and why personal data are processed.

The Commissioner is a UK independent supervisory authority reporting directly to the UK Parliament.

The information provided within this procedural manual is drawn from the requirements laid down by the Office of the Information Commissioner.

Further information is available from visiting the Information Commissioner's website at https://ico.org.uk

4.3 Why data is important

It is therefore essential that those that collect and use personal data to maintain the confidence of those who are asked to provide it by complying with the requirements of the Data Protection Act.

All Data Controllers must comply with the eight principles that are at the heart of the Act, including the requirement to obtain and process data fairly.

4.4 Individual rights

Under the Act any individual concerned has a right to see almost all personal information held about them, whether it is stored on computer or in manual form. Information held by Blossom Leasing Limited must not be amended/deleted following a request to use it. In the event of receiving a so-called ‘subject access request’ please refer to ‘Subject Access Procedures’.

4.5 Accuracy

The Act places an obligation to ensure the accuracy of an individual's personal data. Such information should not be misleading as to any matter of fact.

4.5.1 Personal obligations of all staff

• All staff who deal with personal information are required to handle that information confidentially and sensitively
• Staff undertake to process personal data supplied by the firm only in accordance with the firm's instructions
• Staff obligations in respect of the Data Protection Act form part of their contract of employment

4.6 The data protection principles

The 2018 Act sets out 7 principles, which define the obligations of the firm as a registered data user of personal data. These principles are as follows:

Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the Data Controller towards the individual.

4.7 Processing personal data

Processing of personal data can be broadly defined when any operation is carried out on personal data. The Act requires that personal data be processed ‘fairly and lawfully’. Personal data will not be considered to be processed fairly unless certain conditions have been met.

Processing may only be carried out where one of the following conditions has been met:

• The individual has given his or her consent to the processing
• The processing is necessary for the performance of a contract with the individual
• The processing is necessary to protect the vital interests of the individual
• The process is necessary to carry out public functions

4.8 Collecting personal data

When collecting personal data it is essential that people know:

• Who you / we are
• What the data will be used for
• To whom it will be disclosed

This information can often be provided on an application form or similar document.

Data Protection wording is included within the firm's application package, which when signed by the customer provides necessary comments for processing the customer's data.

When handling, collecting, processing or storing personal data staff must ensure that:

• All personal data is both accurate and up to date
• Errors are corrected effectively and promptly
• The data is deleted/destroyed when it is no longer needed
• The personal data is kept secure at all times (protecting from unauthorised disclosure or access)

The Data Protection Act is considered when setting up new systems or when considering use of the data for a new purpose. Any changes could affect the company's existing registration with the Data Protection Registrar and an amendment to the registration sought.

It is equally important not to:

• Access personal data that you do not need for your work
• Use the data for any purpose it was not explicitly obtained for
• Keep data that would embarrass or damage the firm if disclosed (e.g. via a subject access request)
• Transfer personal data outside of the European Economic Area unless you are certain you are entitled to or consent from the individual concerned has been obtained
• Store / process / handle sensitive data unless you are certain you are entitled to or consent from the individual concerned has been obtained.

4.9 Rights of individuals ‘Subject Access’ and ‘Subject Rights’

The Data Protection Act enables individuals who are the subject of personal data a general right of access to the personal data, which relates to them.

Personal data may take the form of computerised or, in some cases, paper records. These rights are known as ‘subject access rights’.

4.9.1 Individuals, who the data relates to, have various rights:

• To receive a request (a ‘subject access request’) details of the processing relating to them. This includes any information about themselves including information regarding the source of the data
• To have any inaccurate data corrected or removed
• In certain circumstances to stop processing likely to cause ‘substantial damage or substantial distress’
• To prevent their data being used for advertising or marketing
• Not to be subject to certain ‘fully automated decisions’ if they significantly affect him / her

When a subject access request is received, it is important to:

• Treat the requester with courtesy and try to understand what exactly is being sought
• Act promptly and effectively as certain timescales are imposed regarding response

What is a subject access request?

Often a customer will not have heard of the term ‘Subject Access Request’. Staff should be able to distinguish between a casual enquiry and a ‘Subject Access Request’.

A Subject Access Request is not, for example, where:

• A customer wishes to know something specific about their bank account, such as their balance or transaction details
• A customer wishes to raise a complaint. In these circumstances the normal complaints procedure should be followed

A Subject Access Request is where:

• A customer wishes to be provided with personal data that the firm holds about them

Subject access requests

It is important that subject access requests are recognised and dealt with quickly.

A subject access request may be as simple as a letter from one the firm's customers asking what information we hold about them.

If a request is received the enquirer must be sent:

• A copy of the information held on them, this includes both computer and relevant written paper records
• A description provided as to why that information is processed
• Anyone it may be seen by or passed to
• The logic involved in any automated decisions

Before any request is actioned the Data Controller should verify the identity of the person making the request.

Subject access requests must be dealt with within 40 days from the date of receipt. If further details are needed from the person making the request to assist with finding the data the 40 days will begin when the extra information is received.

A maximum fee of £10 can be imposed and the 40 days will not commence until the fee has been received.

All information sent in response to a subject access request should be easy to understand and therefore the sending of computer printouts may not be acceptable without a covering explanation on codes used.

4.9.2 Identifying the customer

Firms are not obliged to comply with a subject access request until sufficient information to clearly identify the individual requesting the file has been given. Before releasing data staff should satisfy themselves as to the identity of the customer. This is important to firms, as releasing information to the wrong person is likely to amount to a breach of security.

Any of the documents listed below may be used to identify the customer(s):

• A bank, building society or credit card statement
• A store card or catalogue statement
• A utility bill

All documents must be original, not photocopies, and dated within the last three months. It must show the customer's full name or first initial, surname and current address.

It is important that all documentation is returned to the customer once identity has been verified.

In the rare circumstances where the customer is unable to provide any of the above items, they must provide a letter confirming their identity. This must be an original, typed or headed paper, dated within the last three months and authenticated with an official stamp if applicable. This should be from an employer, solicitor or other professional body or person.

Telephone requests for information

It is important not to release any personal information to customers before you have established their identity. Requests should be treated with great care, particularly as the issues of proof of identity are difficult to manage.

The steps that need to be taken to verify the identity of the customer will depend upon the type of information, and possibly the customer.

Although wherever possible access to a data subject's personal information should be provided ‘without excessive constraints or delay’. This needs to be balanced against the responsibilities of the data controller to safeguard personal information and to avoid giving personal data to another individual.

Therefore, depending on the circumstances, staff should be asking customers to confirm selective information to verify identity from the following:

• Confirmation of their date of birth and postal address
• Confirmation of their employment record
• Confirmation of their National Insurance number

If the customer requests a Subject Access report then the customer needs to be reminded that the request needs to be put in writing, and will be dealt with in accordance with the procedures as detailed in section 4.

4.10 Credit reference agencies

There are two major credit reference agencies in the UK at present. They are Experian and Equifax. Their main purpose is to supply factual information to providers of financial services in order to establish peoples credit histories.

Customers have a legal right to have access to the data held by credit reference agencies. Customers also have a right to request that the agency remove/amend incorrect data. Customers can write to the agency to obtain a copy of their credit file. Generally a small fee is payable.

4.11 Consent to obtain credit search

Credit searches on an individual must not be conducted without the consent of that individual. The firm's policy is to obtain this consent in writing, normally as part of the application process, however, verbal consent of the customer will be considered in certain circumstances. Staff should contact Compliance Department if they are unsure if adequate consents have been obtained.

4.12 Processing for direct marketing purposes

To comply with the requirements of the Data Protection Act all customers both new and existing have to be given the right to opt out from receiving advertising and marketing material from the firm.

Likewise customers have to be informed if the firm intends to pass information to a third party for marketing purposes.

Customer's personal data is collected on application forms and the election for customers not to receive marketing material is covered through the inclusion of an ‘opt-out’ box.

4.13 Preference services

There are a number of marketing preference services available to customers:

• The Mail Preference Service (MPS)
• The Telephone Preference Service (TPS)
• The Fax Preference Service (FPS)
• The E-mail Preference Service (EPS)

The MPS is funded by the direct mail industry to enable customers to have their names and home addresses in the UK removed from or added to lists used by the direct mail industry.

Firms must ensure that customers that have registered with the MPS do not receive any marketing material.

4.14 Third parties and data processors

General guidelines:

• Always read the contract carefully before signing
• Check that you understand what each clause means and the effect of that clause
• Remember – a contact is an agreement enforceable in law
• Ensure that you receive a signed original of the document
• Once the contract is in force, then it is the firm's responsibility to ensure that it complies with the term of the contract

In the event of a query reference should be made to senior management.

5. Data security

5.1 Data security obligations

Firms have a responsibility under FCA Regulations to put in place systems and controls that keep the data of customers secure whilst also minimising the risks of data loss. The nature of the steps that firms will be expected to take will depend on the size, complexity and nature of the services that the firm provides. We recommend that firms seek expert advice about both assessing their data security risks and formulating appropriate policies, as these will be unique to individual firms.

Example of policies that firms could be expected to implement in order to comply with the above include but are not limited to requirements that:

• Customer data cannot be taken off site by staff, salespeople, suppliers, IT consultants or contractors where laptops and other devices (USB sticks, CDs, hard disks etc.) are not encrypted
• Where data is taken off on site there is automatic encryption of devices or other appropriate measures
• Where customer data is transferred electronically firms use secure internet links
• Access to sensitive areas (call centres, server rooms, filing rooms) is restricted
• Staff will not be able to access data that they do not need for their roles
• Staff handling large volumes of data do not have access to internet e-mail
• Super users/staff with large amounts of access to data are monitored
• Staff data access rights are reviewed to ensure that they remain appropriate
• When staff members leave their user accounts are permanently deleted
• Paper files are locked away
• Staff dispose of hard data securely through physically destroying data e.g. by using shredders or using confidential waste bins
• There are robust password standards and that passwords are not shared
• That there are individual user accounts requiring passwords for all systems containing customer data
• Systems operate in such a way as to prohibit the setting of passwords which do not comply with password policy
• Data is wiped before computers are disposed or transferred to new users
• There is some mechanism to check that hard and electronic data is being destroyed competently
• Firms understand what checks are done by employment agencies it uses
• There are enhanced vetting procedures for staff with large amounts of access to customer data
• Customers' identities are authenticated using, for example, touch-tone telephone before a conversation with a call centre adviser takes place
• There are clear & consistent procedures for backing up data
• Backed up data is limited to appropriate staff
• Backup tapes are held securely
• An accurate register of laptops issued to staff is maintained
• That there is wiping of shared laptops' hard drives between uses
• Firms have security measures in place to protect data e.g. alarm systems, grilles on windows & keypad entry doors
• There is a robust policy for logging visitors in and out

5.2 Dealing with data security incidents

Where data loss has been encountered the Managing Director shall write to customers within 24 hours after the incident to advise them that data has been lost, and the manner in which it was lost. Blossom Leasing Limited shall also ensure that following data loss it conducts a review of the systems that led to the loss.