GDPR Data and Information Policy
We are transparent about how we hold and use data.
The information we hold is:
- Information enabling us to run their digital marketing campaign. Including names, phone numbers, email addresses, business address (or home business address)
- Website logins (where supplied)
- Social media logins (where supplied)
- Domain and hosting logins (where supplied)
- Advertising account logins (where supplied)
- Analytics logins (where supplied)
- Bank details (where supplied)
Leads and Contacts
If you submit our contact form, we will retain some or all of the following data:
- Email address
- Phone number
- Declared contact form information,
This information is collected through:
- Our website:
- The contact form asks visitors for the information
We always make clear on email capture forms that the data we collect may be used.
The basis for processing client data is Contract. The basis for processing lead/contact data is Consent and/or Legitimate Interest.
Data and Privacy Notice
We store the data you submit to us in our website. If you would like to have your data erased, simply reply to any email from us requesting this and we will handle this for you within 1 month.
Gudereit-uk only collects and stores information from clients necessary for us to carry out the work that we are required to carry out. This information is available to the team who might need it for the purposes of administration.
The information we store about each client or contact is available to that client or contact on request, and we will remove any data when requested by them.
All client or contact information is held only in the designated cloud software applications (Google Drive, Dropbox, Gmail, Outlook, Microsoft 365). Information and data is never stored locally on computers in documents not controlled by these cloud apps.
Risks and Impact Assessment
- Risk: Staff computer or account hacked, and contact information accessed
- Impact: client data leaked and shared online. Potentially websites hacked and personal data leaked.
- Mitigation: where possible, data is stored in cloud services like Google Drive and Dropbox which have login protection and two-step verification when accessed from new locations or IP addresses. Passwords changed every 3 months.
A data breach can be something which leads to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
If any staff notice that this has happened they are required to immediately notify their manager. Following notification of a breach, we will:
- Assess the impact of the breach
- Notify the relevant parties immediately
- Investigate the cause of the breach
- Rectify any security vulnerabilities or processes to minimise the chance of this happening again
Right of Access
If an individual requests access to their personal data, this request is to be immediately passed to the Data Protection Officer (Duncan) who will:
- Confirm the data being processed
- Provide full access to their data stored in our various softwares, via email.
We will respond to all such requests within 1 month.
Individuals have the right to be deleted and can request that their data is erased. We will erase all records held for that individual/company.
Information Security Policy
Every staff member is required to adhere to this policy and to abide by our data guidelines:
- Personal data must not be stored on your personal devices
- Passwords must be changed on the three-monthly cycle and at any other time when management requests
- No data should be collected and retained other than what is necessary to carry out the work that has been requested of us
- Any requests for access to data, requests to be forgotten, reports of a breach, or any other matter relating to management of or access to personal data should be immediately passed to Duncan Harrop at firstname.lastname@example.org.