General Data Protection Regulation

 

  • As part of our operations, we need to obtain and process information. This information includes any offline or online data that makes a person identifiable such as names, addresses, email addresses Our company collects this information in a transparent way and only with the full cooperation and knowledge of our customers. Once this information is available to us, the following rules apply.

  • Accurate and kept up-to-date

    Collected fairly and for lawful purposes only

    Processed by the Hey Little Cupcake within its legal and moral boundaries

    Protected against any unauthorised or illegal access by internal or external parties

  • Communicated informally

    Stored for more than a specified amount of time

    Transferred to other organisations that do not have adequate data protection policies

    Distributed to any party other than the ones agreed upon by the data’s owner.

    In addition to ways of handling the data the Hey Little Cupcake has direct obligations towards people to whom the data belongs. Specifically we must:  Let people know which of their data is collected

    Inform people about how we’ll process their data  Inform people about who has access to their information

    Have provisions in cases of lost, corrupted or compromised data

    Allow people to request that we modify, erase, reduce or correct data contained in our databases

  • To exercise data protection we’re committed to:  Restrict and monitor access to sensitive data

    Develop transparent data collection procedures

    Train employees in online privacy and security measures

    Build secure networks to protect online data from cyberattacks

    Establish clear procedures for reporting privacy breaches or data misuse

    Include contract clauses or communicate statements on how we handle data

    Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorization etc.)

  • Email Addresses/telephone number to confirm order and contact a customer >Written down on an order form > filed away in a Diary > Taken to the kitchen to process order > File order form for a maximum of a month > Shredded at via Shredit.

     Bank Card details to take payment over the phone >Written down on an order form to take payment once a phone call has ended > order form filed for a maximum of a month > Shredded at via Shredit.

    Staff Sort code and Account numbers to process payroll > Processed all on-line using Citation, Atlas. Secure and can be deleted by user at any time.

    Staff Personal Information for Accountant > National insurance, bank details to be held by JOTFORMEU.COM

    Website Traffic Information >Volume of people visited > What pages they clicked on > What area they're from.

  • Monthly review of staff knowledge and Data Protection policy. Ensuring staff have an understanding of their rights and the rights of others.

  • All staff to inform customers and staff of where and how their personal data will be used and how long for and when it will be deleted or destroyed.

  • Ensuring all data breaches are reported to the Information Commissioner’s Office -

    0303 123 1113

  • Employers at Hey Little Cupcake to have access to : ico.org.uk - Information Commissioner’s Office