Privacy policy

Protecting your personal information

We know how important it is to protect and manage your personal information. We have established physical, technical and organisational security measures to assist with this. Some of the measures we have taken include:

• adopting computer safeguards such as firewalls, encryption, secure transfer protocols, penetration testing, complex security credentials, multi-factor authentication protocols, and access controls including restricting access depending on job responsibilities
• Cyber Essential certification and ongoing compliance against Government and industry recognised security frameworks
• a comprehensive framework of policies relating to data protection, information security and records management
• regular training and awareness sessions for our employees to ensure understanding and compliance across the organisation
• maintenance of a data protection register that identifies all personal information held and includes details such as lawful basis for processing, location, security measures and retention
• data sharing agreements and relevant clauses in contracts that have personal data implications
• privacy notices so that individuals are aware of what personal information we hold and why
• data protection impact assessments undertaken to identify risks and ensure compliance with data protection legislation, and
• data stored within the UK and not transferred outside the European Economic Area (EEA). If there was a requirement to transfer personal information outside of the EEA, transfer would only be permitted to countries whose data protection laws have been assessed as adequate by the European Commission, and where adequate safeguards are in place to ensure compliance with relevant data protection regulations. 

We try to be as open as we can be in terms of giving you access to your personal information. Under data protection legislation, you have certain rights which we’ve explained in the ‘Access to personal information’ section.

We also want to be clear about what is potentially covered by the personal information categories, so we have made available our personal information categories descriptions.

Privacy notice