Data Protection Policy

Blue Vervet's Data Protection Policy

This is a statement of the data protection policy adopted by Blue Vervet Ltd (‘Blue Vervet’). Responsibility for the updating and dissemination of the policy rests with Blue Vervet’s Information Protection Officer. The policy is subject to regular review to reflect changes to legislation and/or to the policies of Blue Vervet.

Blue Vervet is committed to fulfilling its legal obligations under the Data Protection Act 1998 and has produced his leaflet to assist staff to do the same. All staff –permanent and temporary– are expected to apply the policy and to seek advice when required.

Statement of Data Protection Policy

Blue Vervet needs to collect and use certain types of information about people with whom it deals in order to operate. These include Blue Vervet’s own employees, customers, suppliers and others with whom Blue Vervet conducts business.

Personal information supplied to Blue Vervet will not be disclosed to third parties, unless such disclosure is necessary under Blue Vervet’s remit. Such information will be dealt with properly and securely, however it is collected, recorded and used – whether on paper, in electronic format, or recorded on other material.

The Data Protection Principles

We fully endorse and adhere to the Principles of data protection, as set out in the Data Protection Act 1998. The eight Principles require that personal information:

1. shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met;
2. shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes;
3. shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed;
4. shall be accurate and, where necessary, kept up to date;
5. shall not be kept for longer than is necessary for the specified purpose(s);
6. shall be processed in accordance with the rights of data subjects under the Act;
7. should be subject to appropriate technical and organisational measures to prevent the unauthorised or unlawful processing of personal data, or the accidental loss, destruction, or damage to personal data;
8. shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

The Standards Adopted

Therefore, Blue Vervet will, through appropriate management and strict application of criteria and controls:

• observe fully conditions regarding the fair collection and use of information;
• meet its legal obligations to specify the purposes for which information is used;
• collect and process appropriate information only to the extent that it is needed to fulfil our operational needs or to comply with any legal requirements;
• ensure the quality of information used;
• ensure that the information is held for no longer than is necessary;
• ensure that the rights of people about whom information is held can be fully exercised under the Act (i.e. the right to be informed that processing is being undertaken, to access one’s personal information; to prevent processing in certain circumstances, and to correct, rectify, block or erase information that is regarded as wrong information);
• take appropriate technical and organisational security measures to safeguard personal information;
• ensure that personal information is not transferred abroad without suitable safeguards.

To assist in achieving compliance with the principles, Blue Vervet has appointed an Information Protection Officer at senior level with specific responsibility for data protection within Blue Vervet.