Data Protection Policy
14. DATA PROTECTION- PERSONAL INFORMATION AND PRIVACY
14.1 Reasons/purposes for processing information
We process personal information to enable us to provide all our services as a hotel; promote and advertise our business, maintain our own accounts and records; support and manage our employees; the use of CCTV systems for crime prevention. William's Apartment's only collects personal information necessary to process a booking and resolve potential issues relating to a booking. We do not share this information with any third-parties. All information is stored on secure servers and only accessible by trained staff.
14.2 Types of information processed
Personal Information relating to all bookings are always stored on an encrypted secure server, We process information relevant to the above reasons/purposes. This may include:
· personal details
· family details
· lifestyle and social circumstances
· education and employment details
· financial details
· goods and services
We also process sensitive classes of information that may include:
· racial or ethnic origin
· religious or other beliefs
· trade union membership
· physical or mental health details
· offences and suspected offences
· criminal proceedings, sentences and outcomes
· visual images; personal appearance and behaviour
14.3 Who the information is processed about
We process personal information about:
· guests, clients
· complainants, enquirers
· offenders and suspected offenders
· individuals captured by CCTV images
14.4 Who the information may be shared with
We sometimes need to share the personal information we process with the individual themself and also with other organisations. Where this is necessary we are required to comply with all aspects of the Data Protection Act (DPA). What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons.
Where necessary or required we share information with:
· Guests and clients
· family, associates and representatives of the person whose personal data we are processing
· central government
· police forces and crime prevention organisation
Subject access requests from individuals should be made by email, addressed to the data controller at firstname.lastname@example.org. The data controller can supply a standard request form, although individuals do not have to use this.
Individuals will be charged £10 per subject access request. The data controller will aim to provide the relevant data within 40 days.
The data controller will always verify the identity of anyone making a subject access request before handing over any information.