1. Who we are
Ergotherapy Ltd (“us”, “we”, “our”) provides ergonomics advice, support, training and research to organisations and employees to help prevent and manage discomfort associated with work activities.
This document informs you of our policies regarding the collection, use, storage, disposal and disclosure of any Personal Information in line with the General Data Protection Regulation (GDPR).
We use your personal information only for providing advice to you and your manager on the ergonomics issues of your work and workstation(s). By participating in an assessment you agree to the collection and use of information in accordance with this policy.
3. What is GDPR?
“General Data Protection Regulation (GDPR) is, essentially, an upgraded version of the existing Data Protection Act legislation”
The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU).
The GDPR sets out the principles for data management and the rights of the individual. The General Data Protection Regulation covers all companies that deal with data of EU citizens and came into effect across the EU on May 25, 2018.
4. What personal information we hold
As an organisation, Ergotherapy Ltd holds minimal identifiable personal information. Under GDPR, personal information is defined as “any information relating to an identified or identifiable natural person.”
We hold the following information:
• Names, company name, business email addresses, business addresses and business telephone numbers of our clients, suppliers and people who work with us.
• For ergonomics assessment we may hold:
• Data consisting of individuals’ names, job title, company, self-disclosed health condition and how it affects their ability to work, and body dimensions.
• Photos or video of individuals at work.
• On occasion, this data may include contact details such as work email address, work phone number and/or work address for the purposes of arranging a consultation visit.
• We will only collect what is relevant and necessary for an assessment or the service you require.
• Ergotherapy Ltd do not sell or broker any data.
5. How we acquire this information
• Organisations requiring assessments: Provided to us at the time of an enquiry or during the course of our work with them.
• Individuals requiring assessment: Supplied to us either directly by the individual or (with their consent) via their manager, or an organisation that subcontracts work to us.
• Suppliers: directly from our Suppliers.
6. Legal basis for processing any personal data
We hold personal data as described above, to enable us to:
• Conduct assessments for individuals who require our advice.
• Conduct assessments, training or research for organisations who require our advice.
7. Legitimate interests pursued by Ergotherapy Ltd
To provide ergonomics advice related to work activities.
We understand that consent for us to hold personal data must be freely given, specific, informed and unambiguous.
We will ask individuals who will be assessed to sign a consent form, which will be kept with their assessment. Through signing a consent form you are consenting to Ergotherapy Ltd processing your personal data for the purposes outlined. You can withdraw consent at any time by using the postal or email address provided at the end of this Privacy Notice.
9. Individual’s Rights
Under GDPR, we acknowledge the following rights of the individual, in respect of any personal data that we hold:
• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• the right not to be subject to automated decision-making including profiling.
10. Data security
The security of your Personal Information is important to us, but no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.
Our IT systems are monitored and backed up daily to a safe, confidential, encrypted virtual server, which is compliant with GDPR.
11. Data retention
We hold personal data for a minimum of 5 (five) years, and a maximum of 8 (eight) years after the work is undertaken, to meet any legal obligations, after which time it will be securely deleted. After eight years all personal data will be deleted, unless basic information needs to be retained by us to meet our future obligations to you, such as erasure details.
12. Who we share this information with
In line with our ICO registration statement, we sometimes need to share the personal information we process with the individual, their employer and also with other organisations. Where this is necessary we are required to comply with all aspects of the Data Protection Act (DPA). The types of organisations we may need to share some of the personal information we process with for one or more reasons are:
• managers, associates and representatives of the person whose personal data we are processing
• suppliers and service providers involved with meeting the need of the client
• central government, police forces & security services (if applicable lawful request made).
13. Communication of Privacy Information
14. Subject Access Requests
As outlined in GDPR guidelines, we will respond to and comply with all subject access requests within one month. If we feel that the individual’s request is manifestly unfounded or excessive, we reserve the right refuse or to make a charge. If we refuse any requests on the above grounds, we will tell the individual why and inform them that they have the right to complain to the supervisory authority and to a judicial remedy. We will do this within one month of the request.
15. Registration with ICO
Ergotherapy Ltd is registered with the Information Commissioner’s Office. You can view our registration by visiting the Information Commissioner’s Website at ico.org.uk and entering our reference number: Z3113590.
In the event that you wish to make a complaint about how your personal data is being processed by Ergotherapy Ltd you have the right to complain to us. If you do not get a response within 30 days, you can complain to the ICO.
18. Contact Us
Subject access requests should be submitted in writing to: David Annett, Ergotherapy Ltd. 29 Grasmere Crescent, Harrogate, HG2 0ED.
Last updated: 24th May 2018.
© Ergotherapy Ltd – 2018