Source: https://ikonic.com/gdpr
Timestamp: 2018-06-23 11:49:16
Document Index: 400284027

Matched Legal Cases: ['art 17', 'art 18', 'art 18', 'art 5', 'art 18', 'arts 19', 'art 18', 'art 25', 'art 17', 'art 26']

GDPR - Ikonic
I. GDPR Statement of Readiness
II. Customer Privacy Notice
III. Data Protection Policy
V. Staff Privacy Notice
I. Ikonic Technology Ltd : GDPR Statement of Readiness
Ikonic Technology Ltd is committed to data protection and data privacy. With the General Data Protection Regulation (GDPR) becoming enforceable on the 25th May 2018, we have undertaken a GDPR readiness programme to review our entire company, the way we handle data and the way in which we use it to provide our services.
Our GDPR readiness programme is looking at the following areas:
Staff training and awareness – how GDPR, the Data Protection Bill and the ePrivacy Regulation will impact clients, employees and the supply chain
Supplier management – ensuring all appropriate security, organisational controls and governance processes meet the demands of our clients and of Ikonic Technology Ltd as it continues to grow
Development – ensuring we maintain our commitment to best practice and developing systems which meet recognised security standards and making sure we meet our commitment to privacy by design
Individuals rights – refining our approach to handling requests for data, or the handling of data, to meet the new demands of GDPR (including the right of subject access, cease processing requests and erasure of personal data)
Data mapping – a full review of all processes and systems to truly understand the customer experience, the data we hold and the way in which it is used
Data retention – confirming data retention periods meet contractual, legal and organisations requirements.
Privacy notices – reviewing all notices to inform clients and employees of the way we handle their data
HR – preparing our HR department to incorporate important aspects of GDPR for our employees
The Ikonic Technology Ltd Group has a designated Group Data Protection Officer who oversees our information governance practices and coordinates the Group’s efforts to ensure we continue to manage personal data in the way our clients expect.
Here at Ikonic Technology Ltd we are fully committed to the principles of data protection and to safeguarding our data and that of our clients – as such we confirm that all reasonable efforts will be taken to comply with the applicable GDPR rules and regulations.
Any queries should be addresses to Chris Perry (Managing Director) or GDPR@ikonic.com
II. Ikonic Technology Ltd - Customer Privacy Notice
Ikonic Technology Ltd holds personal data on its Customers, and their employees, to provide its services. This Customer Data Privacy Notice details the personal data Ikonic Technology Ltd may retain, process and share with third parties relating to your business and its employees. Ikonic Technology Ltd is committed to ensuring that your information is secure, accurate and relevant. To prevent unauthorised access or disclosure, we have implemented suitable physical, electronic, and managerial procedures to safeguard and secure personal data we hold.
This policy will be subject to periodic review and it is recommended that you review this document from time to time to ensure that you are aware of any amendments applicable to the retention, processing and sharing of personal data.
See www.ikonic.com for current version.
We respect the privacy rights of individuals and are committed to handling personal information responsibly and in accordance with applicable law. This Notice sets out the personal information that we collect and process as a data processor, the purposes of the processing and the rights connected with it. Ikonic Technology Ltd are also considered a Data Controller for some personal data, including data we store in relation to the creation and access of user accounts, administration, the methods of processing and service access.
If you are in any doubt regarding the applicable standards, or have any comments or questions about this Notice, please contact Chris Perry (Managing Director – Ikonic Technology Ltd) GDPR@ikonic.com
During your engagement with Ikonic Technology Ltd, or during negotiations with Ikonic Technology Ltd, we may process personal information about you, your employees and other individuals whose personal information has been provided to us. The data we process will depend on the services we provide your company.
The types of personal information we may process include:
Identification data – such as name, gender, photograph.
Contact details – such as home and business address, telephone/email addresses.
Employment details – such as job title/position, office location.
IT information – information required to provide access to Ikonic Technology Ltd systems and networks such as IP addresses, log files and login information.
Generally, we try not to collect or process any Sensitive Personal Data relating to Customers and their employees, unless authorised by law or where necessary to comply with applicable laws.
However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you or your employer (i.e. provision of services), or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.
We have policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed without authorisation and only accessed or used for specific legal purposes.
If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact Ikonic Technology Ltd.
We use this personal information when it is necessary for the provision of our services, in line with the purposes agreed upon between our Customer and Ikonic Technology Ltd.
We may use personal information where we consider it necessary for complying with laws and regulations, including collecting and disclosing staff member personal information as required by law or nder judicial authorization, or to exercise or defend the legal rights of the companies within the Ikonic Technology Ltd Group.
We may also collect and use personal information when it is necessary for other legitimate purposes, such as to help us conduct our business more effectively and efficiently – for example, for general IT security management when auditing access of our platforms. We may also process your personal information to investigate violations of law or breaches of our own internal policies.
We may also collect and process personal information where we consider it necessary for Ikonic Technology Ltd’s legitimate interest, including:
recording all telephone calls made to, or from, our advice centre
marketing similar services to our Customers
Transfers to third-party service providers
In addition, we make certain personal information available to third parties who provide services to us. We do so on a "need to know” basis with appropriate security measures in place – this is done in accordance with applicable data privacy law.
To comply with our legal obligations, including where necessary to abide by law, regulation or contract, but not limited to, a subpoena, government audit or search warrant
We may need to transfer personal information to countries other than the ones in which the information was originally collected. When we export your personal information to a different country, we will take steps to ensure that such data exports comply with applicable laws. For example, if we transfer personal information from the European Economic Area to a country outside it, such as the United States, we will implement an appropriate data export solution such as entering into EU standard contractual clauses with the data importer or taking other measures to provide an adequate level of data protection under EU law.
Personal information will be stored in accordance with applicable laws and kept for as long as needed to carry out the purposes described in this Notice or as otherwise required by applicable law. Generally, this means your personal information will be retained until the termination of the relationship with Ikonic Technology Ltd plus a reasonable period of time thereafter.
Access, correct, update or request deletion of personal information
Object to processing of personal information, ask us to restrict processing of personal information or request portability of personal information.
If we have collected and process personal information using a person’s consent, then this can be withdrawn at any time. Withdrawing consent will not affect the lawfulness of any processing we conducted prior to withdrawal, nor will it affect processing of personal information conducted in reliance on lawful processing grounds other than consent.
This Notice may be updated periodically to reflect any necessary changes in our privacy practices. In such cases an updated version of this notice shall be uploaded on www.ikonic.com. Any significant changes to the policy shall be publicised directly. We encourage you to check this notice periodically to be aware of the most recent version.
Please address any questions or requests relating to this Notice to Chris Perry (Managing Director – Ikonic Technology Ltd) GDPR@ikonic.com
III. Ikonic Technology Ltd : Data Protection Policy
This Policy sets out the obligations of Ikonic Technology Ltd (“the Company”) regarding data protection and the rights of employees, customers, suppliers, complainants and enquirers (“data subjects”) in respect of their personal data under EU Regulation 2016/679 General Data Protection Regulation (“GDPR”).
The Company is committed to apply all reasonable efforts to comply not only to the letter of the law, but also to the spirit of the law and places high importance on the correct, lawful, and fair handling of all personal data, respecting the legal rights, privacy, and trust of all individuals with whom it deals.
3.6 The right to object (Part 17); and
5.1 The Company collects and processes the personal data set out in Part 18 of this Policy. This includes:
5.1.1 Personal data collected directly from data subjects, for example contact details used when a data subject communicates with us.
5.1.2 Personal data obtained from third parties, for example contact details used from a 3rd party data provider for marketing purposes or sales leads provided by our product partners.
5.2 The Company only collects, processes, and holds personal data for the specific purposes set out in Part 18 of this Policy (or for other purposes expressly permitted by the GDPR).
The Company will only collect and process personal data for and to the extent necessary for the specific purpose or purposes of which data subjects have been informed (or will be informed) as under Part 5, above, and as set out in Part 18, below.
The Company shall ensure that all personal data collected, held, and processed is kept secure and protected against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Further details of the technical and organisational measures which shall be taken are provided in Parts 19 to 24 of this Data Protection Policy (GDPR) v2.1 4
10.1 The Managing Director (MD) is responsible for managing the policies and processes and can be contacted at the address above or via GPDR@ikonic.com
10.2 The MD shall be responsible for overseeing the implementation of this Policy and for monitoring compliance with this Policy, the Company’s other data protection-related policies, and with the GDPR and other applicable data protection legislation.
10.3.1 The name and details of the Company, its MD, and any applicable third-party data processors;
12.2.1 Details of the Company including, but not limited to, the identity of its MD;
12.2.2 The purpose(s) for which the personal data is being collected and will be processed (as detailed in Part 18 of this Policy) and the legal basis justifying that collection and processing;
12.2.6 Where the personal data is to be transferred to a third party that is located outside of the European Economic Area (the “EEA”), details of that transfer, including but not limited to the safeguards in place (see Part 25 of this Policy for further details);
13.2 Data subjects wishing to make a SAR may do so in writing to the Company’s MD at the above address.
13.4 All SARs received shall be handled by the Company’s MD.
15.1.3 The data subject objects to the Company holding and processing their personal data (and there is no overriding legitimate interest to allow the Company to continue doing so) (see Part 17 of this Policy for further details concerning the right to object);
18.1 Names of Individuals – Will include contact names of customers, suppliers, staff and those in our marketing database (including job titles). The names are stored and used to facilitate contact to those individuals. Names of staff are held in HR files together with other personal data required to process payroll.
18.2 Postal addresses – Personal addresses for staff are held in the HR files to facilitate contact for payroll and pension purposes. No personal addresses are held in respect of other contacts.
18.3 Email addresses – Collected and held in the course of communicating with contacts and those in our marketing database.
18.4 Telephone numbers – Collected and held in the course of communicating with contacts and those in our marketing database.
19.1 All emails containing personal data must be encrypted.
19.2 All emails containing personal data must be marked “restricted”;
19.4 Where personal data is to be sent by facsimile transmission the recipient should be informed in advance of the transmission and should be waiting by the fax machine to receive the data;
19.5 Where personal data is to be transferred in hardcopy form it should be passed directly to the recipient or sent via recorded delivery.
20.3 All personal data stored electronically should be backed up. All backups should be encrypted;
20.4 No personal data should be stored on any mobile device (including, but not limited to, laptops, tablets, and smartphones), whether such device belongs to the Company or otherwise without the formal written approval of the director responsible for the safekeeping of that information and, in the event of such approval, strictly in accordance with all instructions and limitations described at the time the approval is given, and for no longer than is absolutely necessary; and
22.1 No personal data may be shared informally and if an employee, agent, sub-contractor, or other party working on behalf of the Company requires access to any personal data that they do not already have access to, such access should be formally requested from the director responsible for the safekeeping of that information;
22.2 No personal data may be transferred to any employees, agents, contractors, or other parties, whether such parties are working on behalf of the Company or not, without the authorisation of the director responsible for the safekeeping of that information;
22.5 Where personal data held by the Company is used for marketing purposes, it shall be the responsibility of the Marketing Manager to ensure that the appropriate consent is obtained and that no data subjects have opted out, whether directly or via a third-party service such as the TPS.
23.1 Passwords are used to protect personal data, in line with our Information Security Management System.
23.2 Under no circumstances should any passwords be written down or shared between any employees, agents, contractors, or other parties working on behalf of the Company, irrespective of seniority or department. If a password is forgotten, it must be reset using the applicable method.
23.3 All software (including, but not limited to, applications and operating systems) shall be kept up-to-date. The Company’s IT staff shall be responsible for installing any and all security-related updates as soon as reasonably and practically possible, unless there are valid technical reasons not to do so.
26.3 In the event that a personal data breach is likely to result in a high risk (that is, a higher risk than that described under Part 26.2) to the rights and freedoms of data subjects, the Data Protection Officer must ensure that all affected data subjects are informed of the breach directly and without undue delay.
26.4.3 The name and contact details of the MD (or other contact point where more information can be obtained);
IV. Ikonic Technology Ltd Client Data Security Statement
All data captured by Ikonic Technology Ltd is processed to enable us to provide you with our services.
Ikonic Technology Ltd have invested heavily both the physical and virtual security. All client related data are held either securely in an onsite secure environment or offsite in enterprise-grade highly secure data centres.
Off-site data centres are protected by layers of ‘defence-in-depth’ security that include perimeter fencing, video cameras, security personnel, secure entrances, and real-time communication networks. This multi-layered security model is in use throughout every area of the facility, including each physical server unit.
Technical controls that are in place include, but are not limited, to the following:
The access to servers are restricted to Ikonic Technology Ltd network using dedicated hardware firewalls
The access lists on firewalls are based on specific open ports for applications only. All other ports are blocked
The web servers are highly secure, which have inbuilt features capable of protecting various threats
Servers and PCs are protected and regularly scanned with best available updated antivirus / spyware/ malware which are updated in line with our patching policies and processes
Servers and PCs have inbuilt features e.g. dynamic rules-based policies to protect shared folders and files and hard drive encryption to enhance data security and management
Security auditing is enabled as a risk assessment feature, which helps identify attacks (successful or not) that pose a threat to our network, or attacks against resources
Data held in is encrypted at rest and in transit; this includes files stored on our servers and the use of opportunistic TLS, at a minimum, for all email traffic.
Access to data is strictly controlled through our Role Based Access Controls, which are maintained in line with our policies.
All Ikonic Technology Ltd employees with access to either personal or client data are given appropriate data protection and information security training. This is supported with awareness campaigns to promote best practice and promote good information governance.
Information Governance and IT Security – Frequently Asked Questions
Q: Is a mechanism in place to ensure your employees and contractors receive appropriate information security awareness training upon appointment, and regular updates to organisational policies and procedures, as relevant for their job function?
A: Yes. Ikonic Technology Ltd has Data Protection and Information awareness and eLearning courses for relevant staff; this is supported with additional a variety of communications on data protection and information security. eLearning courses include assessments; poor performance is recorded and followed up on to ensure that staff responsibilities are understood.
Training is incorporated as part of induction process and bespoke training is provided for specific roles and departments.
Q: Are security operating procedures in place governing the use of your ICT systems?
A: Ikonic Technology Ltd has policies, processes and procedures to address the following areas (this is not exhaustive):
These polices are made available to all staff and are reviewed either whenever a change is required or, at a minimum, once every 12 months.
Q: Are policies and controls in place to ensure IT systems are protected from malicious and mobile code and are patched against known vulnerabilities in a timely manner?
A: Yes, Ikonic Technology Ltd has policies, processes (including patch automation) to ensure that systems are patched against known vulnerabilities and protect systems from malicious threats.
Q: Do Ikonic Technology Ltd’s policies and procedures cover the control, protection, secure usage and destruction of electronic storage media?
Q: Are policies and controls in place to manage the risks of working in non-secure environments?
Q: Does your company have a senior individual responsible for the security of our information within your custody?
A: Information Governance (including data protection and information security) are the responsibility of the Managing Director. The technical implementation of security is the responsibility of the Heads of IT.
Q: Are the security roles and responsibilities of your employees clearly defined and documented in accordance with your organisations information security policy?
A: Yes, all responsibilities are defined and documented across all policies within the Information Governance Framework, including Information Security, Data Protection and the IT Policy.
Q: Is a corporate approach to risk management in place which enables the escalation of project risks to programme and/or organisational level risk registers?
A: The running of risk management activities is conducted by the IT Management Team with all corporate risks incorporated into Ikonic Technology Ltd’s Corporate Risk Register. The Board has full oversight of risks and sufficient levels of escalation routes exist to effectively manage any risks which are above/outside of the organisation’s risk appetite.
Business Continuity / Disaster Recovery and Backups
Q: Do you have a BCP (Business Continuity Pan) and DRP (Disaster Recovery Plan) in place?
A: Yes - Ikonic Technology Ltd continually reviews these plans when updating services, processes to ensure that all aspects of our services are included within its scope. Our data is backed up both on premises and remotely.
Q: Is data backup encrypted and to what standard?
A: Backup data is encrypted.
Q: Is there a process to ensure that media is erased securely at disposal?
A: All physical hardware containing personal data is securely disposed of using approved WEEE vendors who are assessed against Ikonic Technology Ltd’s security standards.
Q: Has an owner been assigned to all information assets which require protection?
Security Assessment and Incident Management
Q: Are there regular vulnerability scans performed?
A: Vulnerability scans are conducted regularly against all key systems, to ensure that Ikonic Technology Ltd continues to protect the data it holds. This includes, but is not limited to, the following:
Any risks or vulnerabilities identified are immediately rectified by appropriate remedial actions.
Q: Are security assessments undertaken at regular intervals?
A: Both Internal and external assessments are regularly conducted as part of our information security and data protection programmes to monitor the effectiveness of our controls. Areas covered include, but are not limited to, the following:
Secure areas and/or cabinets for the storage of sensitive assets.
Q: Is there a security incident procedure?
A: Our incident management policy and process contain additional provisions for data breaches and security incidents. This includes the identification of a breach/incident, established scope, notification to third parties/data subjects and all investigative efforts and remedial actions.
Q: Has the application been developed in compliance with any structured frameworks or guidelines?
A: All software development is conducted appropriately, and incorporates the “privacy by design” principle to ensure that all aspects of the development are secure and meet legal obligations and client expectations relating to data protection and information security.
Q: Is a process in place to manage change to systems i.e. capacity management and separation of testing environments?
A: All software development is conducted in line with Ikonic Technology Ltd’s Data Protection Policy and Software Development Policy. These policies ensure that all data is processed in line with legal requirements and that test environments are separated from live environments. A Change Control Process is used to monitor and review all proposed changes to systems – any changes impacting personal data are also assessed against the requirements for data protection impact assessments.
Q: Are user passwords hashed / how are they stored?
A: Passwords are hashed and encrypted.
Access Controls & Administrator Management
Q: Are access controls in place to ensure information is only available to system users who require access?
A: Yes, Ikonic Technology Ltd follows the principle of Role Based Access Control to ensure that data is only accessible to those who require access as part of their core activities.
Q: For access via the Internet, are the administrators or privileged accesses protected appropriately.
A: A variety of authentication and technologies, including IP restrictions, are utilised to further limit access to data.
Remote Working and Mobile Device Management
Q: In relation to the ICT systems used to deliver your service, which of the following is true?
We permit remote working
We allow staff to connect their own devices to our ICT systems
A: Security controls and strict processes are in place to ensure that the risks of remote working are minimised, this includes device encryption, secure VPN traffic and the use of mobile device management software to set organisations controls on remote devices. Only approved devices, which have been supplied by Ikonic Technology Ltd, are permitted to be used on our ICT infrastructure.
Q: Are network security boundaries defined and enforced to group users, services and information that require different levels of protection?
A: Yes, permissions and access are assigned based on roles and responsibilities.
Q; Are processes and controls in place to ensure that equipment and cabling is protected and maintained to preserve the confidentiality, integrity and availability of our assets?
A: Yes, these assets are protected to meet industry best practice.
Q: Are background verification checks carried out on employees and contractors who have access to our assets?
A: All staff have routine verification checks conducted prior to employment, including checks of identification, right to work and verification of previous employment.
Q: Are non-disclosure agreements in place with all staff who have access to our assets?
A: Yes, these are built into the terms of employment and Ikonic Technology Ltd’s company policies.
Q: Is a disciplinary process in place for employees and contractors who have committed a security breach?
A: Yes, any breach of company policies and procedures may be subject to disciplinary action.
Q: Upon termination of employment is there a process in place to ensure assets are returned and rights to assets revoked?
A: Yes, this is part of the standard staff management process.
Q: If data is stored outside of the EU what provision do you provide to assure that you comply with the GDPR requirements to protect it?
A: Strict contractual obligations are placed on all third-party data processes; these also include the right for Ikonic Technology Ltd to audit compliance with the terms in question. Appropriate due diligence is conducted on all potential suppliers, including data protection and information security practices and processes.
Q: Are you registered with the Information Commissioner’s Office?
A: Yes – our Registration number: ZA286720
V. Ikonic Technology Ltd : Staff Privacy notice
We process personal data relating to those we employ to work as, or are otherwise engaged to work as, part of our workforce. We do this for employment purposes, to assist in the running of the business and/or to enable individuals to be paid.
The personal data we process may include, but may not be limited to, the following:
data relating to your identity (including name, data of birth, gender, photographs, passport, National Insurance Number, immigration status, marital status, dependants),
contact details (business and home address, telephone numbers, email addresses, emergency contact details),
employment details (position, office location, terms of employment, performance and disciplinary records, sickness and holidays),
background information (CV, previous experience, qualifications and certifications, criminal records check (for vetting purposes, where permissible and in accordance with applicable law)),
financial information (bank details, tax information, salary, benefits, expenses),
IT information – information related to your access to our systems (login details, IP addresses, log files, access/times/duration of use, location).
improving the management of workforce data across the business,
enabling development of a comprehensive picture of the workforce and how it is deployed,
informing the development of recruitment and retention policies,
allowing better financial modelling and planning,
ensuring compliance with our policies and procedures and our legal obligations,
enabling monitoring of selected protected characteristics.
We will not share information about you with third parties without your consent unless the law allows or requires us to do so.
object to processing of personal data that is likely to cause, or is causing, damage or distress,
prevent processing for the purpose of direct marketing,
object to decisions being taken by automated means,
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed,
If you would like to find out more about our data retention policy and how we use your personal data, or if you want to see a copy of the information about you that we hold, please contact Chris Perry (Managing Director : Ikonic Technology Ltd) chrisp@ikonic.com
© 2018 Ikonic Copyright. All rights reserved.