This document sets out the policy of Insolvency Support Services Ltd (“the Company”) on the provision of access to private data which should be afforded to persons whose personal data we hold (a “data subject”), and their associated rights to rectification, restricted processing and portability.
DATA SUBJECT ACCESS REQUESTS
The rights of data subjects to be informed and to have access
Whatever the basis of your dealings with the Company, where the we hold your personal data, you are legally entitled to be informed that we are holding it (by our providing you with access to a Privacy Notice) and to request details of the personal data that we hold (“data subject access”).
You may also have additional rights whish are considered in greater detail below.
How to access your personal data
Data subjects may request details of the personal information that the Company holds about them, know as a “Data Subject Access Request”. Your request should be made in writing (email is acceptable) and identify who you are. We may need to verify your identity, depending upon the nature of your relationship with the Company.
It will assist us in provide you with providing a prompt response if you address your request to the appropriate person:
Your Line Manager
Debt Advice and Personal Insolvency Clients
Your Debt Advisor or Case Administrator
Directors, shareholders and owners of insolvent businesses
Your Case Administrator or the appointed Insolvency Practitioner
Creditors, book debtors and employees of insolvent businesses
Your Case Administrator or the appointed Insolvency Practitioner
Business Contacts and Customers
If you are unsure who to contact, please contact us at: email@example.com
There is no charge for making such a request, unless it is manifestly unfounded or excessive, particularly if repetitive. We will inform you if we consider this to be the case.
Responding to your request
The Company will respond to your request within one month of receipt; earlier if at all possible. Where your request is declined, a written explanation will be provided to you.
There may be circumstances in formal insolvency proceedings where the Company may legitimately decline a request, or partially comply, for instance by redacting or removing information to which the data subject is not entitled.
OTHER RIGHTS AFFORDED TO DATA SUBJECTS
Lawful basis(es) of processing
Your rights in relation to the personal data that we process will depend upon the lawful basis or bases upon which we are holding it. This will vary depending upon where the information has come from (yourself or a third party, such as the Official Receiver or Accountant in Bankruptcy) and the nature of our relationship with you. Personal data may be held for more than one lawful basis. Details of the basis or bases we believe we have for processing your data can be found in the relevant Privacy Notice and in our Data Processing Register.
The rights you may have can be reference to the lawful basis for processing:
The right to erasure, also known as “the right to be forgotten”, relates to your ability to request that we erase or delete the information we hold about you.
The rights you have will depend upon why we are holding your information in the first place and any legal or contractual requirements upon us to retain it (against your wishes, if necessary). We have a policy which sets out our approach to data retention in respect of the different categories of people that we deal with (See our Data Retention and Destruction Policy). How long we believe it to be necessary for us to hold different types of personal information is shown in our Data Processing Register.
Any request for erasure will be considered upon its merits, however, in the case of formal insolvency appointments where a statutory retention period of 6 years applies, we are of the view that we have and overriding legitimate interest to continue this processing, even where you request erasure or object to processing.
This is the right to reuse your personal data for your own purposes across different services and it only applies to information that you have provided (so would not apply to information supplied to us by the Official Receiver, Accountant in Bankruptcy, or the people you own money to in an insolvency situation.)
It does not apply to formal insolvency cases, where our lawful basis for processing is considered to be “legal obligation”.
We will generally endeavor to supply information in a portable format when requested by advice clients, prior to a formal insolvency, or by employees, where the lawful basis for processing is the fulfilment of our contractual obligations.
Our business contacts and former customers may object to our holding their information once we have fulfilled any contractual obligation to them. Contacts for marketing purposes can withdraw their consent to our contacting them, which will have the same effect.
Right to rectification: In most cases, you will have a right for the information we hold to be kept accurate and up to date and to ask us to amend it (rectify it) if it is inaccurate. One exception to this will be information relating to the commencement of a formal insolvency, where that information will form part of the legal records of the case and we will be required to retain it, though we will make a record that you consider it to be inaccurate. We will always be grateful to receive updates to contact information etc. but will may not be able to amend historic information that is part of the formal record of an insolvency your case, such as your address at the time of your insolvency or the amounts you stated that you owed to your creditors.
Restricted processing: If you believe we are processing person a data about you other than lawfully, or that we are holding inaccurate information about you, you may have the right to request that we restrict the processing of that information whilst a request from you for erasure or rectification is considered. In the case of a formal insolvency appointment, we are unlikely to be able to restrict or erase any data that forms part of the formal record of the insolvency case, though any such request will be considered upon its merits and a full explanation will be provided to you in response to your request.
If you are in any doubt about your rights in relation to the data we hold, please contact us at firstname.lastname@example.org.
Further information is also available via the Information Commissions at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/