Contents

1.    Introduction

2.    Data Controller

3.    Disclosure

4.    Data Collection

5.    Data Storage

6.    Data Access and Accuracy

Introduction

DesignLife App Limited needs to collect and use certain types of information about certain individuals in order to carry out its work.

This personal information must be collected and dealt with appropriately whether collected on paper, stored in a computer database, or recorded on other material and there are safeguards to ensure this under the general data protection regulation 2018 (GDPR), to which this policy adheres.

The parties who designLife App Limited may hold data on include:

-users of our mobile application

-individuals who contact us via our website

-suppliers (manufacturers and distributors of products) including:

  • accounting information

  • contact information

  • pricing

  • products

Data Controller

DesignLife App Limited is the identified Data Controller under the GDPR, which means that we determine the purposes for which personal information is held and used. We are therefore also responsible for ensuring that this data is controlled in full compliance with the GDPR.

Disclosure

DesignLife App Limited regards the lawful and correct treatment of personal information to be of the utmost importance in creating successful working relationships, and to maintaining the confidence of those with whom we deal.

The data subject will be made aware in all circumstances of how and with whom their information will be shared. Designlife App Limited will never share data with other organisations, (such as local authorities, funding bodies and voluntary agencies), unless at least one of the following circumstances apply:

  • The data subject has given explicit verifiable consent.

  • The sharing of data is seen to be in the legitimate interest of the data subject.

  • The law mandates the disclosure of personal data.

There are circumstances where the law mandates that Designlife App Limiteddisclose data, (including sensitive data), without the data subject’s consent. These include:

  • A) Carrying out a legal duty or as authorised by the Secretary of State.

  • B) Protecting vital interests of an Individual/Service User or other person.

  • C) The Individual/Service User has already made the information public.

  • D) Conducting any legal proceedings, obtaining legal advice or defending any legal rights.

Personal data will never be sold to a third-party.

Designlife App Limitedwill adhere to the Principles of Data Protection, as detailed in the EU General Data Protection Regulation.

Specifically, these Principles require that:

  • a) Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.

  • b) Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

  • c) Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

  • d) Personal data shall be accurate and, where necessary, kept up to date.

  • e) Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

  • f) Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

  • g) The controller shall be responsible for and be able to demonstrate compliance with the GDPR.

Designlife App Limited will, through appropriate management and strict application of criteria and controls:

  • Observe fully conditions regarding the fair collection and use of information.

  • Meet its legal obligations to specify the legitimate purposes for which information is used.

  • Collect and process appropriate information, and only to the extent that it is needed to fulfill its operational needs or to comply with any legal requirements

  • Ensure the quality of information used.

  • Ensure that the rights, (as defined by the Information Commissioners Office), of people about whom information is held, can be fully exercised under the GDPR. These include:

  • The right to be informed.

  • The right of access.

  • The right to rectification.

  • The right to erasure.

  • The right to restrict processing.

  • The right to data portability.

  • The right to object.

  • Rights in relation to automated decision making and profiling.

  • Take appropriate technical and organisational security measures to safeguard personal information.

  • Ensure that personal information is not transferred to a third-party without suitable consent or legal obligation.

  • Treat people justly and fairly whatever their age, religion, disability, gender, sexual orientation or ethnicity when dealing with requests for information.

  • Set out clear procedures for responding to requests for information, erasure of information and cessation of processing.

Data Collection

Consent is defined:

  • As offering individuals real choice and control. Genuine consent puts individuals in charge, building customer trust and engagement.

  • Consent requires a positive opt-in. We regard the sending of a message through our website’s contact form as consent that the data owner understands that we will contact them in response to this message.

Where consent is not required or realistically available, the legitimate interest of the data subject can be used as a lawful basis for data processing.

To determine legitimate interest, we make sure to:

  • identify a justifiable legitimate interest of the data subject;

  • show that the processing is necessary to achieve it; and

  • balance it against the individual’s interests, rights and freedoms.

DesignLife App Limited will ensure that data is collected within the boundaries defined in this policy. This applies to data that is collected in person, or by completing a form on our website or application.

When collecting data, Designlife App Limitedwill ensure that the data subject:

  • a) clearly understands why the information is needed;

  • b) understands what it will be used for and what the consequences are should the data subject decide not to give consent to processing;

  • c) is, as far as reasonably practicable, competent enough to give consent and has given so freely without any duress; and

  • d) has received sufficient information on why their data is needed and how it will be used.

Data Storage

Information and records relating to service users will be stored securely and will only be accessible to authorised staff and volunteers. Designation of authorisation and responsibility for this authorisation sits with the Data Protection Officer.

Information will be stored for only as long as it is needed or required by statute and will be disposed of appropriately.

It is DesignLife App Limited’s responsibility to ensure all personal and company data is non-recoverable from any computer system previously used within the organisation, which has been passed on/sold to a third-party.

If Designlife App Limited is requested to delete personal data. This will be seen to immediately.

Our website may contain links to external, third-party websites. While every measure is taken to ensure that we only ever link to trusted and reputable sources, we cannot guarantee the security of data outside of our own website.

6. Data Access and Accuracy

All Individuals/Service Users have the right to access the information Designlife App Limitedholds about them. Designlife App Limitedwill also take reasonable steps ensure that this information is kept up to date by asking data subjects whether there have been any changes.

In addition, Designlife App Limitedwill ensure that:

  • It has a Data Protection Officer with specific responsibility for ensuring compliance with Data Protection.

  • Everyone processing personal information understands that they are legally responsible for following the GDPR.

  • Everyone processing personal information is appropriately trained to do so.

  • Everyone processing personal information is appropriately supervised.

  • Anybody wanting to make enquiries about handling personal information knows what to do.

  • It deals promptly and courteously with any enquiries about handling personal information.

  • It describes clearly how it handles personal information.

  • It will regularly review and audit the ways it holds, manages and uses personal information.

  • It regularly assesses and evaluates its methods and performance in relation to handling personal information.

  • All staff are aware that a breach of the rules and procedures identified in this policy may lead to disciplinary or legal action being taken against them.

This policy will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with any changes or amendments made to the GDPR.

In case of any queries or questions in relation to this policy please contact the DesignLife App Limited Data Protection Officer:

Justin Kandiah

Office Address: C/o White and Company Ltd, The Matrix Complex, London, SW6 3BU

Email: justin@designlifeapp.com

Tel:07776232704

Justin Kandiah

Position: Director and Data Protection Officer

Date: 30/07/2018

Review Date: 30/11/2018

Glossary of Terms

Data Controller – The person who (either alone or with others) decides what personal information Designlife App Limited will hold and how it will be held or used.

Data Protection Officer – The person(s) responsible for ensuring that Designlife App Limited follows its data protection policy and complies with the GDPR.

Individual/Service User/Data Subject – The person whose personal information is being held or processed by Designlife App Limited for example: a client, an employee, or supporter.

Explicit Consent – is a freely given, specific and informed agreement by an Individual/Service User in the processing of personal information about her/him. Explicit consent is needed for processing sensitive data.

Processing – means collecting, amending, handling, storing or disclosing personal information.

Personal Information – Information about living individuals that enables them to be identified – e.g. name and address. It does not apply to information about organisations, companies and agencies but applies to named persons, such as individual volunteers or employees.

Sensitive data – refers to data about:

  • Racial or ethnic origin

  • Political affiliations

  • Religion or similar beliefs

  • Trade union membership

  • Physical or mental health

  • Sexuality

  • Criminal record or proceedings