GDPR POLICY
Fylde Holistic Therapies is committed to maintaining robust privacy protections for its users. This policy outlines how Fylde Holistic Therapies collects, uses, shares and safeguards information we receive from our clients and other organisations. We will take the necessary steps to ensure that user’s information is safeguarded and kept in accordance with applicable laws and regulations.
If you use our services, you confirm that you have the relevant authority to enter into a legal agreement with us whether as an individual or other legal entity.
If you do not wish to be bound by this Privacy Policy and our Terms of Use, you are advised not to use the Website.
ABOUT FYLDE HOLISTIC THERAPIES
This website: www.fyldeholistictherapies.com
is the property of Natalie Wilkinson. By using the website, you are agreeing to the terms contained in this policy and our Terms of Use.
WHAT INFORMATION DO WE COLLECT?
Your information will be used by us to enable us to provide our services to you. We act as a Data Controller (unless only processing data under a separate agreement) and undertake to protect personal and sensitive data in a manner that is consistent with the requirements of the UK data legislation and the GDPR. We will take reasonable measures to ensure the secure storage of your data.
Information provided to us:
FROM DATA CONTROLLER
Data is only held on the grounds that we have a contractual obligation to fulfil.
We undertake to protect all personal and sensitive data that is provided to us and in a manner that is consistent with the requirements of the General Data Protection Regulation (GDPR). We will take reasonable measures to ensure the secure storage of all data, see below.
FROM CLIENTS
Information we get from other sources:
From time to time, we may need to obtain information from third parties. This will only apply where it is essential for the provision of our services and as permitted by law. Where applicable we will seek the consent of the client or organisation providing the data.
HOW WE USE PERSONAL INFORMATION
- We only act under the documented instructions of the Data Controller
- To ensure confidentiality, assist with legal compliance of the Data Controller, and respond to requests from data subjects (as instructed by the Data Controller)
- Make available all information necessary to demonstrate compliance
- To take measures to assist the Data Controller with ensuring security of processing
- To treat personal data after processing as directed by the Data Controller.
SHARING INFORMATION
DISCLOSURE
We do not share, sell, or distribute your data to third parties.
If it is necessary to share data with a subcontractor working on our behalf, the Data Controller will be informed without delay. Any third party must adhere to all data protection laws and regulations.
We do not give them access to any of your personal data.
We may disclose personal information if we are required to do so by law, in connection with any legal proceedings, and in order to establish, exercise or defend our legal rights.
EXTERNAL LINKS
Users of our website are advised to adopt a policy of caution before clicking on any external web links. [External links are clickable text / banner / image links to other websites.] Clicking an external link will take the user away from our website. Once you leave our website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or our website’s Terms of Use.
We cannot guarantee or verify the contents of any externally linked website and users click on external links at their own risk. Fylde Holistic Therapies and its owners cannot be held liable for any damages or implications caused by visiting any external links mentioned.
DATA RETENTION
We keep all personal information in accordance with current Data Retention guidelines which reflects our needs to provide our services to you as contracted and to meet legal, statutory, and regulatory obligations. We will only retain data that is necessary, and this will include data relating to the massage therapy that we have provided to clients. The need to hold information is regularly reviewed and information/data will be disposed of when no longer required.
All disposal is carried out securely and records will be destroyed so that they are not retrievable.
DATA STORAGE
We store records such as client notes and diary appointments. All data is password protected and encrypted.
In addition, we regularly review our procedures for secure data storage to ensure that all appropriate measures are adopted. In accordance with data protection legislation, data records are stored in a locked cabinet and electronic storage is protected by a user’s password that is individual to the user.
Any information that you supply to us may be stored and processed by servers hosting our website. Data will only be transferred outside EEA countries in accordance with the relevant data protection laws.
DATA SUBJECT RIGHTS
As a data processor we understand that we have an obligation under the GDPR to comply with our obligations to the following:
SUBJECT ACCESS REQUESTS
The General Data Protection Regulation (GDPR) gives individuals (‘data subjects’), the right to access personal data that is held by organisations by a subject access request (SAR). We will endeavour to respond quickly to any such requests, which legally require us to respond within one month of receiving the request and necessary information.
RIGHT TO RECTIFICATION
Data subjects have the right to request that we amend or change personal information that we hold, that is inaccurate or incorrect. We will act on any request without delay as instructed by you as Data Controller.
RIGHT TO ERASURE
Data subjects have the right to ask us to delete personal information from our systems without giving any reason and at any time. We will act on any request without delay as instructed by you as Data Controller.
RIGHT TO RESTRICT PROCESSING
Data subjects have the right to rectification or erasure of personal data in certain circumstances. We will act on any request without delay as instructed by you as Data Controller
RIGHT TO DATA PORTABILITY
Data subjects have the right to obtain and transfer their data to different service providers. We will act on any request without delay as instructed by you as Data Controller.
RIGHT TO OBJECT
Data subjects have the right to object to the processing of data at any time based on their particular situation. This includes objecting to profiling unless it is in the ‘public interest’ or exercised lawfully by an official authority. We will only process data where we can demonstrate lawful grounds for doing so. We will act on any request without delay as instructed by you as Data Controller.
Right not to be subject to decisions based on automated processing.
We do not use any automated processing that results in any automated decision based on a data subject’s personal information.
DATA BREACHES
We will report any unlawful breach of data as required by the GDPR within 72 hours of the breach occurring, if it is considered that there is an actual, or possibility, that data within our control including the control of our data processors, has been compromised. If the breach is classified as ‘high risk’ we will notify all data subjects concerned using an appropriate means of communication. We will report any relevant breaches of data to the Information Commissioner’s Office (ICO).