[et_pb_section fb_built="1" fullwidth="on" _builder_version="3.19.10" background_color="#423e59" background_image="https://doqaru.com/wp-content/uploads/2019/02/Generic_Header1.png" saved_tabs="all"][et_pb_fullwidth_header title="Privacy Policy" content_max_width="60%" content_max_width_tablet="85%" content_max_width_phone="90%" content_max_width_last_edited="on|phone" module_class="doq_header_video_image" _builder_version="3.19.12" title_font="||||||||" title_font_size="9vh" title_font_size_tablet="8vh" title_font_size_phone="6vh" title_font_size_last_edited="on|phone" subhead_font="||||||||" subhead_font_size="4vh" subhead_line_height="1.2em" background_color="rgba(117,114,132,0)" background_image="https://doqaru.com/wp-content/uploads/2019/02/doqheaderimagenew.png" background_size="contain" background_position="bottom_right" custom_margin="||" custom_padding="||0px" custom_css_header_container="padding-bottom: 8%; || " global_module="426" saved_tabs="all"][/et_pb_fullwidth_header][/et_pb_section][et_pb_section fb_built="1" _builder_version="3.19.11" background_color="#423e59" background_blend="multiply" custom_padding="94px|0px|80px|0px"][et_pb_row make_equal="on" module_class_2="ds-vertical-align" _builder_version="3.0.101"][et_pb_column type="4_4" _builder_version="3.0.47"][et_pb_text _builder_version="3.19.11" header_font="||||||||" header_2_font="||||||||" header_2_text_align="left" header_2_text_color="#ffffff" header_2_font_size="40px"]
Doqaru Privacy Policy
[/et_pb_text][et_pb_toggle title="INTRODUCTION" open="on" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.19.11" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
We at Doqaru need to gather and use certain information about individuals.These include, but are not limited to:
⦁ Clients/Partners
⦁ Staff
⦁ Volunteers
⦁ Contractors
⦁ Suppliers
⦁ Other parties that the organisation has a relationship with or may need to contact.
This policy describes how this Personal Data must be collected, handled and stored (processed) to meet our Data Protection standards AND to comply with the Law.
[/et_pb_toggle][et_pb_toggle title="PURPOSE" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
This Data Protection Policy ensures that Doqaru:
⦁ Complies with Data Protection Laws and follows good practice
⦁ Protects the rights of staff, clients/patients and partners
⦁ Is open and transparent about how it processes Personal Data
⦁ Protects itself from the risks of a Data Breach
[/et_pb_toggle][et_pb_toggle title="SCOPE" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
The scope of this Policy applies to the following:
⦁ All working locations (Office & Remote)
⦁ All staff and contractors operating on behalf of Doqaru
It applies to all data that Doqaru holds relating to identifiable individuals including, but not limited to:
⦁ First Name
⦁ Last Name
⦁ Postal Address
⦁ Email Address
⦁ Telephone Numbers
⦁ And any other identifiable information relating to individuals, including Special Categories (Sensitive)
Note that Doqaru typical does not hold any sensitive data relating to individuals as we do not need to hold it to do our job.
[/et_pb_toggle][et_pb_toggle title="DATA PROTECTION LAW" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
The following key legislation and guidance informs Doqaru and the development of our procedures/controls:
⦁ European Data Protection Directive (95/46/EU)
⦁ The Data Protection Act 2018
- The General Data Protection Regulation (GDPR)
These legal requirements govern how we will collect, handle and store Personal Data. They apply regardless of whether the data is stored electronically, on paper or on other materials.To comply with the law, the following EIGHT principles must be applied and evidenced.
Personal Data must be:
⦁ Processed fairly, lawfully and transparently
⦁ Be obtained only for specific and lawful purposes
⦁ Be adequate, relevant and not excessive
⦁ Be accurate and kept up to date
⦁ Not be held for any longer than necessary
⦁ Processed in accordance with the rights of the Data Subjects (individuals)
⦁ Be protected in appropriate ways
⦁ Not be transferred out of the European Economic Area (EEA) unless that country or territory also ensures an adequate level of protection
[/et_pb_toggle][et_pb_toggle title="RISKS" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
The Policy helps to protect both Doqaru and associated individuals from very real data security risks including:
⦁ Breaches of Confidentiality. E.g. information being disclosed inappropriately
⦁ Failing to offer choice. E.g. all individuals have the right to choose how a company processes their data.
⦁ Reputational Damage. E.g. Complaints, legal proceedings, etc.
[/et_pb_toggle][et_pb_toggle title="RESPONSIBILITIES" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
Everyone who handles/processes Personal Data must ensure that it is done so in line with this Policy and all other related procedures.
[/et_pb_toggle][et_pb_toggle title="GUIDELINES" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
⦁ The only people who can access the Personal Data, covered by this Policy, are those who are required to use it for their legitimate work and who are authorised to do so.
⦁ Data must not be shared informally. Personal Data must be treated with the utmost confidence and security at all times.
⦁ Doqaru will provide training to all contractors, employees, partners, etc to ensure that they are fully aware and understand their responsibilities regarding Data Protection and Privacy
⦁ For system access, strong passwords must be used and never shared
⦁ Personal Data should never be disclosed to unauthorised persons, either within the business or externally.
⦁ Data should be regularly reviewed (by authorised personnel) and updated according. If there is no longer a legal basis or legitimate purpose for retaining/processing the Data, it must be safely deleted.
⦁ Where consent is the legal basis for processing information, regular reviews must be undertaken to ensure that the individual still (explicitly) consents to sharing their Personal Data.
⦁ Individuals reserve the right to withdraw their consent to processing their Personal Data⦁ Individuals may request information regarding the Data processed by Doqaru. This is called a Subject Access Request (SAR) and must be responded to within 1 month.
⦁ Individuals may raise a query or complaint to the Data Controller/Data Protection Officer. The contact details are at the end of this document.
[/et_pb_toggle][et_pb_toggle title="CONSENT" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
Under the new GDPR, a lawful basis must be identified and evidenced before Personal Data can be processed. If there is no other legal basis (lawful purpose) then consent must be sought and evidenced.
Consent must be:
⦁ Freely given
⦁ Specific
⦁ Informed
⦁ Unambiguous
⦁ Given by clear statement or affirmative actionConsent can no longer be implied.
Prior to obtaining consent, individuals will be provided with access to the Privacy Notice (also called a Fair Processing Notice). To manage consent and ensure that it does not degrade over time, Doqaru will conduct regular consent audits and contact the relevant individuals to establish that consent is still current and given as above
[/et_pb_toggle][et_pb_toggle title="SPECIAL CATEGORIES" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
This relates to the processing of sensitive data that must be treated with a high degree of care. Special categories of data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data and data concerning health or reveal their sex life or sexual orientation. Processing this data is prohibited unless EXPLICIT consent is obtained from the individual. There may be certain circumstances where processing is necessary, and these details can be provided by the Data Controller / Data Protection Officer on request.
[/et_pb_toggle][et_pb_toggle title="DATA STORAGE" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
The following details and rules exist for how we store client email data at Doqaru:
Purpose:
To capture client information to send relevant marketing correspondence.
Legal Basis:
Contract for clients and Legitimate Interest for prospective clients.
Storage Requirements:
We store on our server. Mailchimp is our data processor and Doqaru have a Customer EU Data Processing Addendum agreement in place. This can be cited upon request.
Retention Period:
We retain client email details for 24 months, after which we ask for consent to continue to store it. If consent is not given, we remove client's details from our database.
Questions regarding storage can be directed to the Data Controller/Data Protection Officer. When data is stored in a physical format (e.g. paper), it will be kept in a secure location where no unauthorised person cannot get access. These guidelines also apply to data that is stored electronically, but that has been printed out.
⦁ Paper files, when not being processed, will be stored in a locked drawer/cabinet.
⦁ Employees shall ensure that paper/prints that contain Personal Data shall not be left unattended, e.g. On a printer or left on a desk, where non-authorised persons can see them.
⦁ When no longer required, paper/prints shall be shredded and disposed of securely
Note that Doqaru do not store client data in paper format.
When data is stored electronically, it must be protected from unauthorised access, accidental disclosure/loss, accidental deletion or malicious hacking attempts:
⦁ Data must be protected with strong passwords, that are changed regularly and never shared
⦁ Data stored on removable media (DVD, CD, USB, etc) must be stored securely and locked away when not in use
⦁ Data should only be stored on approved drives and servers and should only be uploaded to an approved cloud computing service
⦁ Servers containing Personal Data should be sited in a secure location, away from general office space, as appropriate
⦁ Data should be backed up regularly.
⦁ Data should not be saved/stored directly on laptops (unless encrypted) or smart phones/tablets.
⦁ All services and computers containing data should be protected by approved security software and a firewall, as appropriate.
[/et_pb_toggle][et_pb_toggle title="DATA MINIMISATION" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
Data will be held in as few places as necessary and only retained in line with the data storage requirements documented in the previous section.
[/et_pb_toggle][et_pb_toggle title="DATA SUBJECTS RIGHTS" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
In line with the new Regulation, individuals have more rights to ensure the protection of their privacy and the security of their data. This section details their rights and how Doqaru will respond to them.
⦁ Subject Access Requests (SAR)
All individuals are entitled to:
⦁ Ask what information the company holds about them and why
⦁ Ask how to gain access to it
⦁ Be informed about how we keep it up to date
⦁ Be informed about how Doqaru is meeting its data protection and privacy obligations
If an individual makes a request to receive this information, it is called a Subject Access Request (SAR). Doqaru will always verify the identity of the requester and no information will be sent out until that has been undertaken. Approved identity documents will be one that is photographic (national ID card, drivers licence or passport) and one current utility bill. SARS may be requested in any medium (verbally, email, physical letter) and the Doqaru has a legal obligation to provide all information processed within 1 month of receiving the request.
Ordinarily, there is no charge for this, however, if the SAR is significant in terms of size/complexity, Doqaru does reserve the right to apply an administration fee. Please note, however, there may be certain circumstances where it is not possible to provide all SAR’s information (in line with the Law). If this is the case, the person will be fully informed.
⦁ Right to Rectification
If it is discovered that Doqaru is holding inaccurate or out of date Personal Data relating to an individual, that individual has the right to request that the Data is amended/rectified as quickly as possible.
⦁ Right to Erasure
Whilst an individual does have the right to request erasure of their data (also called the Right to be Forgotten) it is not an absolute right, as there are certain instances where their request cannot be accepted. The right can be fulfilled in the following circumstances:
⦁ The Personal Data is no longer required by Doqaru in relation to the purposes that originally applied
⦁ The individual has withdrawn their consent and there is no other legal basis for processing
⦁ The individual objects to Doqaru processing their data and there are no overriding legitimate grounds for continuing to process.
⦁ The Personal Data has been unlawfully processed
⦁ A legal obligation (e.g. a court order) requires the data to be erased
⦁ The data relates to a child and there is no parental consent If the right to erasure is accepted Doqaru must take reasonable steps to destroy all data, including any that has been made public (e.g. photographs, video clips, etc) and any data that has been forwarded/shared with other agreed 3rd parties, including processors.The right to erasure may not be accepted for legal or public safety reasons.
⦁ Right to Restriction of Processing
An individual has the right to restrict processing in the following instances:
⦁ The accuracy of the data is contested, and time is required to verify
⦁ The processing of the data is considered unlawful, but erasure isn’t an option
⦁ Doqaru no longer needs the data but it may be required to support a legal claim
⦁ The individual has objected to processing and verification is required to establish legitimate grounds
⦁ Right to Data Portability
The individual has the right to request all their Personal Data held by Doqaru receive it in a machine-readable format and request that it be transferred to another Data Controller. This is applicable when the data is processed by automated means only.
[/et_pb_toggle][et_pb_toggle title="DISCLOSURE" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
In certain circumstances, the Law allows Personal Data to be disclosed without the consent of the Data Subject. Under these circumstances, Doqaru will disclose the requested data. However, the Data Controller/Data Protection Officer will ensure that the request is legitimate, seeking assistance from Legal Advisors or Regulators, as necessary.
[/et_pb_toggle][et_pb_toggle title="TRANSPARENCY" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
Doqaru aims to ensure that individuals are aware that their Personal Data is being processed and that they understand:
⦁ What data is being processed
⦁ Why it is being processed
⦁ How the data will be used
⦁ How it will be stored
⦁ How to exercise their rights
[/et_pb_toggle][et_pb_toggle title="WHAT WE WOULD LIKE TO DO WITH YOUR DATA" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
We would like to use your name and email address to inform you of our future offers and similar products.
We will never share your Personal Data with third parties and you can unsubscribe, at any time, by contacting our Data Protection Officer
If you would like to receive details of our services and any future offers, please confirm by selected the appropriate options in the previous section on consent
[/et_pb_toggle][et_pb_toggle title="WHAT ARE YOUR RIGHTS?" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
If at any point you believe that the information we process on you is incorrect, you can request to see this information and have it corrected or deleted (if appropriate).
You are entitled to request a copy of the data that we keep on file for you, via a Subject Access Request.
If you are unhappy with our service or with how we have handled your personal data, you may complain to us at any time.
To exercise these rights, please contact our Data Protection Officer
If you are not satisfied with our response, or believe that we are not processing your personal data in accordance with the law, you can complain directly to the Information Commissioner’s Office https://ico.org.uk/
[/et_pb_toggle][et_pb_toggle title="WHY WE NEED YOUR DATA" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
We may need to know some basic personal data to communicate with persons from your organisation on services that we provide and also to keep you informed of work that we are doing on your behalf. We will not collect any personal data from you that we do not need.
[/et_pb_toggle][et_pb_toggle title="WHAT WE DO WITH YOUR DATA" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
All the personal data we process is processed by our staff in the UK.
Details of our Clients are retained in the Customer section of Xero, which is the financial system we use to enable quotes, invoices and purchase orders to be processed. This information is held securely with restricted access to authorised personnel only.
No third parties have access to your personal data, unless the law allows them to do so.
We have a Data Protection regime in place to oversee the effective and secure processing of your personal data. More information on this framework is detailed in our Data Protection Policy, which is available on request.
[/et_pb_toggle][et_pb_toggle title="HOW LONG WE KEEP YOUR DATA" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
[/et_pb_toggle][et_pb_toggle title="WHO TO CONTACT" open_toggle_text_color="#f4394b" open_toggle_background_color="#ffffff" closed_toggle_text_color="#423e59" closed_toggle_background_color="#ffffff" icon_color="#f4394b" _builder_version="3.0.106" title_level="h4" title_font="|600|||||||" title_text_color="#423e59" body_font="||||||||" body_text_color="#423e59" border_width_all="0px"]
The Data Controller/Data Protection Officer for Doqaru is Yekemi Otaru, who can be contacted at any time and who will be happy to assist.
Contact details are:
Email: info@doqaru.com
Registered Address: The Silver Fin Building, 455 Union Street, AB11 6DB, Aberdeen
Trading Address: The Silver Fin Building, 455 Union Street, AB11 6DB, Aberdeen
[/et_pb_toggle][et_pb_text _builder_version="3.0.106" text_font="||||||||" text_text_color="#ffffff" header_font="|600|||||||" header_3_font="|600|||||||" header_3_text_color="#ffffff"]
CONSENT
By providing your name and email address in our sign up form, you are consenting to the processing of your personal data based on the based on the information provided in this Privacy Notice (also called a Fair Processing Notice)
[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section]
