Office of David Taylor MP customer privacy notice
This privacy notice tells you what to expect us to do with your personal information.
Contact details
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
How to complain
Contact details
Telephone
01442 816885
david.taylor.mp@parliament.uk
What information we collect, use, and why
We collect or use the following information to provide services and goods, including delivery:
Names and contact details
Addresses
Date of birth
Health information (including dietary requirements, allergies and health conditions)
Account information
Photographs or video recordings
Records of meetings and decisions
Identification documents
Information relating to compliments or complaints
Information relating to sponsorship
Everything you provide us related to casework.
We also collect or use the following information to provide services and goods, including delivery:
Racial or ethnic origin
Genetic information
Health information
We collect or use the following information for service updates or marketing purposes:
Names and contact details
Addresses
Records of consent, where appropriate
Genetic information
We collect or use the following information for research or archiving purposes:
Names and contact details
Addresses
Recorded images, such as photos or videos
Records of consent, where appropriate
We also collect or use the following information for research or archiving purposes:
Racial or ethnic origin
Genetic information
Health information
We collect or use the following information to comply with legal requirements:
Name
Contact information
Identification documents
We also collect or use the following information to comply with legal requirements:
Racial or ethnic origin
Genetic information
Health information
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Address
Payment details
Account information
Purchase or service history
Video recordings of public areas
Audio recordings of public areas
Video recordings of private or staff only areas
Audio recordings of private or staff only areas
Dashcam footage - outside vehicle
Dashcam footage - inside vehicle
Witness statements and contact details
Relevant information from previous investigations
Customer or client accounts and records
Financial transaction information
Information relating to health and safety
Correspondence
We also collect the following information for dealing with queries, complaints or claims:
Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic information
Health information
Sexual orientation information
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure - You have the right to ask us to delete your personal information.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
Your right to object to processing - You have the right to object to the processing of your personal data.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide services and goods are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Our lawful bases for collecting or using personal information for service updates or marketing purposes are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for research or archiving purposes are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for legal requirements are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Where we get personal information from
Directly from you
CCTV footage or other recordings
Debt collection agencies
Health care providers
Insurance companies
Legal and judicial sector organisations
Schools, colleges, universities or other education organisations
Councils and other public sector organisations
Publicly available sources
Previous employers
Credit reference agencies
Providers of marketing lists and other personal information
Suppliers and service providers
Third parties:
Get personal info from all relevant bodies to progress casework.
How long we keep information
DATA RETENTION POLICY AND SCHEDULE
Statement of Purpose
Office of David Taylor MP (the Organisation, we, our or us) is committed to adhering to the data protection and privacy rights of all individuals whose Personal Data it Processes in the course of its activities. To do so, we are committed to meeting the requirements imposed by UK Data Protection Laws: particularly, requirements under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Data Retention Policy is implemented to this end, with a focus on the storage limitation principle.
This Data Retention Policy is based on the UK Data Protection Laws. If this Policy is at any time inconsistent with this body of law, Office of David Taylor MP will act (including by adjusting any relevant Retention Periods) to meet the requirements imposed by up-to-date UK Data Protection Laws in priority to the requirements set out in this Policy.
Any questions in relation to this Policy should be referred to the Data Protection Officer in the first instance, via email at david.taylor.mp@parliament.uk.
Definitions, Interpretation, and Scope
Within this Policy, the following terms hold the following meanings:
‘Condition for Processing’ means the exceptions to the general prohibition on Processing Special Category Personal Data, specified by UK Data Protection Laws, at least one of which must apply to Processing of Special Category Personal Data for that Processing to be in compliance with UK Data Protection Laws;
‘Data Protection Principles’ means the 7 core principles at the heart of the UK Data Protection Laws, which these laws are constructed to uphold;
‘Data Subject’ means the individual to whom an item of Personal Data relates and who can be identified from this data;
‘Lawful Bases’ means the 6 grounds set out in Article 6 of the UK GDPR, at least one of which must apply to Processing of Personal Data for that Processing to be in compliance with UK Data Protection Laws;
‘Personal Data’ means any information relating to an individual who can be identified (either directly or indirectly) by this information. References to Personal Data within this Policy refer to all Personal Data that the Organisation Processes, including any Personal Data that the Organisation stores following use of this data in the course of its work with or via agents, consultants, sub-contractors, or similar;
‘Processing’ means any use of Personal Data outside of private personal use, including obtaining, recording, managing, using, storing, or anonymising this data;
‘Special Category Personal Data’ means the certain types of personal data that the UK Data Protection Laws identify as being more sensitive in nature than other Personal Data and, consequently, as requiring a higher level of protection; including information about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, and biometric data;
‘UK Data Protection Laws’ means any law applicable in the UK relating to the Processing of Personal Data, including but not limited to the UK GDPR and the Data Protection Act 2018.
The definitions above apply also to the singular or plural, other tense, or other form of such words when used within this Policy.
Legal Justification for Processing
Office of David Taylor MP is committed to ensuring that all Processing of Personal Data carried out by us and/or our agents, sub-contractors, consultants, employees, or others working on our behalf is carried out in compliance with UK Data Protection Laws. As such, we confirm that:
All Personal Data is Processed in reliance on one or more of the Lawful Bases;
All Special Category Personal Data is, additionally, Processed in reliance on a separate Condition for Processing; and
All Processing is carried out in accordance with the Data Protection Principles.
All necessary documentation and procedures are completed and in place to ensure that all Processing is carried out in accordance with UK Data Protection Laws and the Data Protection Principles (e.g. the transparency and accountability principles).
Access to documentation can be requested from the Data Protection Officer by emailing david.taylor.mp@parliament.uk. Access will be granted where it is appropriate to do so (e.g. with regard to other individuals’ data privacy and to business confidentiality needs).
Storage Limitation
This Data Retention Policy deals primarily with how we will uphold the Data Protection Principle of storage limitation. The storage limitation principle requires that we do not keep (e.g. store) Personal Data for any longer than we need it, with ‘need’ determined by reference to the purposes and Lawful Bases for which given Personal Data is Processed.
Adhering to the storage limitation principle is vital for:
Reducing the risks of data breaches and other security threats to data’s privacy and integrity;
Reducing the risk of Personal Data becoming irrelevant, excessive, inaccurate, out-of-date; or being used incorrectly or by accident; and
Reducing the Organisation’s legal risk by ensuring that Personal Data is not retained once the applicable Lawful Bases(s) no longer apply (i.e. once it can no longer be Processed in accordance with UK Data Protection Laws).
To uphold the storage limitation principle, Office of David Taylor MP’s commitments include (but are not limited to):
Adhering to the Retention Periods set out in the schedule to this Policy titled ‘Schedule - Retention Periods’;
No longer storing Personal Data that, despite not yet having been held for the duration of the applicable Retention Period, is inappropriate to store with regard to UK Data Protection Laws and other laws (e.g. when there is no requirement that it is retained longer for purposes such as maintaining compliant tax and employment records or dealing with legal claims);
Properly handling any individuals’ data erasure requests and, where appropriate, complying with such requests; and
Deleting or anonymising Personal Data that is no longer needed in accordance with this Policy.
Retention Periods
A Retention Period is a set time period after which the applicable type of Personal Data should be considered no longer needed and should be deleted or anonymised, unless a situation applies that requires certain Personal Data to be stored for longer and which justifies its further Processing (including storing) under UK Data Protection Laws. Justifications and decisions on extended storage periods can be identified and proposed by the Staff Member responsible for the applicable Personal Data, then should be approved by the Data Protection Officer before being implemented.
Once Personal Data has reached the end of its Retention Period, if no justification for extension or other exception applies, this data should be deleted or anonymised in accordance with the section of this Policy titled ‘Dealing with Personal Data that is No Longer Needed’.
Office of David Taylor MP’s Retention Periods are set out in the schedule to this Policy titled ‘Schedule - Retention Periods’.
The Retention Periods apply however the Personal Data is held by us (e.g. whatever its location or format).
Dealing with Personal Data that is No Longer Needed
All Personal Data that is no longer needed in any way must be either deleted (i.e. erased) or anonymised.
Deletion of Personal Data held electronically entails this data being permanently deleted as far as is technologically possible. This means that the Staff Member carrying out the deletion must ensure that, after deletion, it is beyond use (i.e. they must ensure that, if any traces remain, these traces cannot identify the Data Subject). The Staff Member carrying out the deletion should ensure that:
Any offline copies of the Personal Data are deleted, as well as published/online versions;
Any backup copies of the Personal Data are deleted, whether or not such copies are up-to-date.
Deletion of Personal Data held in hard copy entails destruction of this data to the extent that it is beyond use (e.g. so that it cannot be reassembled or read).
Anonymisation entails Personal Data being altered into a form that does not allow identification of the Data Subject in any way (i.e. so that the information no longer constitutes Personal Data and is no longer covered by UK Data Protection Laws). Anonymisation may be carried out as an alternative to deletion when useful for the Organisation and appropriate (e.g. for the purposes of carrying out statistical analysis with a large, anonymous dataset).
If a Staff Member needs to delete or anonymise Personal Data and they are uncertain as to how to appropriately do so, they should contact the Data Protection Officer via email at david.taylor.mp@parliament.uk for assistance.
Responsibility
Day-to-day responsibility for monitoring compliance with this Policy, for setting, evaluating, and adapting data retention practices and this Policy, and for setting, evaluating, and adapting Retention Periods, sits with the Data Protection Officer.
All individuals working for or acting on behalf of Office of David Taylor MP at all levels, including senior managers, officers, employees, consultants, trainees, homeworkers, part-time and fixed-term workers, casual workers, agency workers, volunteers, and interns (collectively ‘Staff Members’) should follow this Policy in relation to any Personal Data that they Process. If they have any questions or concerns related to this Policy and their data storage obligations, they should contact the Data Protection Officer via email at david.taylor.mp@parliament.uk.
Changes to the Policy and to Retention Periods
This Policy does not form part of any contract of employment or similar and Office of David Taylor MP may amend it at any time at our absolute discretion.
Any changes to the Retention Periods will be made in compliance with the law and a new justification will be provided for each new Retention Period set. Any such changes will be communicated to relevant Staff Members in a timely manner to ensure that practices are adapted accordingly.
Retention Periods will be reviewed by the Data Protection Officer (or somebody who the Data Protection Officer has assigned to review the Retention Periods on their behalf and subject to their approval) at least once every year, to ensure that these Retention Periods are still reasonable with regard to any changes to the Personal Data held and to any new laws or guidance relevant to a given Retention Period.
Schedule - Retention Periods
Type of Personal Data: Every type of data provided to carry out the casework
Description/Examples: E.g. personal contact details, email exchanges, phone call notes and attachments/documents shared with the office.
Purpose of Processing: To be able to carry out casework, contact relevant bodies and keep constituents up to date on progress.
Retention Period: 1 week after David Taylor MP loses his Hemel Hempstead seat.
Justification: In case the case needs to be reopened, a FOI or legal request, and for an update provided to the constituent.
Responsibility for this Type of Personal Data: Office Manager
Who we share information with
Others we share personal information with
Insurance companies
Health care providers
Organisations we need to share information with for safeguarding reasons
Professional or legal advisors
Financial or fraud investigation authorities
Relevant regulatory authorities
External auditors or inspectors
Warranty and guarantee providers
Professional consultants
Organisations we’re legally obliged to share personal information with
Emergency services
Debt collection agencies
Previous employers
Suppliers and service providers
Other relevant third parties:
Any relevant body to process casework.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Last updated
7 October 2024