Invitation London Limited is very conscious of how it should deal with personal data that it holds on behalf of its customers and staff. The GDPR (General Data Protection Regulations) that come into force on 25th May 2018, detail the requirements that must be met by all organisations that hold personal data. Invitation London Limited takes its responsibilities very seriously and is pleased to inform you that it has created this privacy notice to show its adherence to the GDPR.
This Notice refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the data subject) that is not already in the public domain.
The GDPR seek to protect and enhance the rights of data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU.
The privacy notice details follow below:
Client (and Guests) Personal Data
Invitation London Limited acts as a data controller and uses the information collected from you to provide quotations, make telephone contact and to email you. It also acts as a data processor in order to produce the goods that you have requested. When you make initial contact you are consenting to Invitation London Limited maintaining a dialogue with you to enable the eventual production of the goods that you require for your event or your business. When working exclusively as a data processor, Invitation London Limited will be acting on your instruction and will do its utmost to ensure that you are fully covered in the GDPR area.
The personal data we collect to enable us to deliver your completed order usually contains the following:
Client: name, address, telephone number, email address.
Guests: names and addresses
Some of your personal data will be collected from you initially as mentioned above to allow a dialogue to be set up. When guest lists are created and sent to Invitation London Limited they contain personal information relating to your guests, which is required to create your goods. We will hold this data securely until your event or your client’s event is complete and you have no further requests of us which would require the use of this data. This data will then be removed from our system.
We will remove your own personal data from our system, when we have no further lawful requirement to use it. (Such as invoicing, debt collection and dispute reconciliation). For Inland Revenue purposes we have to maintain details of invoices for six years. This means that we will be holding your name and address for that time in a secure area. Any other personal details, such as data referring to guests at your event will be removed from our System once your event is finished.
Invitation London Limited will never use your personal data or any personal data supplied relating to your clients or guests for any other reason other than that agreed, which is for the production of goods to satisfy your order.
Legal basis for processing and retaining any Personal Data
To meet Invitation London Limited contractual obligations to clients.
To address any situations where legal action may be required.
Through agreeing to this privacy notice you are consenting to Invitation London Limited processing your personal data for the purposes outlined. You can withdraw consent at any time, however that will mean that you are releasing Invitation London Limited from its contractual obligations.
Invitation London Limited may on occasions pass your personal data to third parties exclusively to process work on its behalf, in line with your requirements. Invitation London Limited requires these parties to agree to process this information based on Invitation London Limited instructions and requirements. These third parties must only act in a manner consistent with this privacy notice (and GDPR) and agreed to this when they were contracted for the work.
Invitation London Limited may disclose your personal data to meet legal obligations, regulations or valid governmental requests.
Invitation London Limited will process personal data during the duration of any contract and will continue to store the Personal Data needed for six years after the contract has expired for the sole purpose of meeting legal obligations. After six years all personal data will be deleted. If there is no legal requirement to retain the personal data, it will be deleted once the customer’s event is completed and the customer has no further requirements from Invitation London Limited which would necessitate the use of this personal data.
Data is held in the United Kingdom using different servers. Invitation London Limited does not store personal data outside the EEA. Where data is transferred to ‘cloud databases’, Invitation London Limited has made sure that it is transferred securely and is encrypted in its destination databases (by conversation and confirmation with the data processors of the destination databases).
Data Protection Officer
In line with the GDPR, Invitation London Limited has appointed a data protection officer. The responsibilities of this position include:
- Regular auditing of the actioning of all the rules of GDPR at Invitation London Limited and associated companies (data processors and controllers)
- Resolving any shortfalls from the above
- Responding to SARs from clients and staff
- Ensuring that Personal Data is protected at all times
Your rights as a Data Subject
At any point whilst Invitation London Limited is in possession of or is processing your personal data, all data subjects have the following rights:
- Right of Access – you have the right to request a copy of the information that Invitation London Limited holds about you.
- Right of Rectification – you have a right to correct data that Invitation London Limited holds about you that is inaccurate or incomplete.
- Right to be Forgotten – in certain circumstances you can ask for the data Invitation London Limited holds about you to be erased from Invitation London Limited
- Right of Use Knowledge – Invitation London Limited must confirm to you the reason why it is using the personal data and how it is processing that personal data.
Any request linked to personal data must be made in writing on a SAR (Subject Access Request). Personal Identification will be required. In the event that Invitation London Limited refuses your request, they will provide you with a reason as to why, which you have the right to legally challenge.
You can request the following information:
- Contact details of the person or organisation (Invitation London Limited and others) that has determined how and why your data will be processed
- Contact details of the data protection officer, where applicable
- The purpose of the processing as well as the legal basis for processing
- The categories of personal data collected, stored and processed
- How long the personal data will be stored
- Details of your rights to correct, erase, restrict or object to such processing
- Information about your right to withdraw consent at any time
- How to lodge a complaint with the supervisory authority (data protection regulator)
- The source of personal data if it wasn’t collected directly from you
All SARs should be emailed to firstname.lastname@example.org or by phoning 020 7117 8253 in the first instance, or by writing to us at the address below:
The Data Protection Officer
Invitation London Limited, The Hub, Elstree Aerodrome, Hogg Lane, Elstree WD6 3AR.
If you are not satisfied with Invitation London Limited response to any query you raise with them, or you believe that Invitation London Limited is processing your personal data in a way which you believe is inconsistent with the law, you can complain to the Information Commissioner’s Office.