GDPR
Data Protection Officer : Barry Thomas
Mobile Contact : 07913 238 821
Office Contact : 029 2019 6026
Mobile Contact : 07913 238 821
Office Contact : 029 2019 6026
In order to respond to enquiries from this site, we ask for your name, plus email address and / or phone number. This gives us the opportunity to personalise your reply and contact you using your prefered contact method.
This information is kept solely for the purpose of answering your original enquiry. Once the enquiry has been satisfactorily dealt with, your personal data are deleted permanently from the online database.
If we are unable to contact you and your enquiry remains incomplete for 180 days, the information is deleted, regardless of there having been no satisfactory conclusion to the enquiry.
In order to book driving lessons through cf14 School of Motoring, it is necessary to retain the students name, address, email and any contact numbers together with their driving licence number. If you are booking on behalf of a friend or family member, we will also need to retain your details as above. This, along with any other contact data that you have provided will be deleted on successful completion of the student / friend or family member passing their driving test, or at the end of our specified data retention period.
When candidates pass their driving test, they will be asked for a photograph for promotional purposes. If verbal or written permission is given, the image will be displayed on our web site and in other promotional material such as Facebook, Twitter & Free Index, or until such permission is withdrawn.
Contact information is held for the purpose of:
• Responding to your enquiry
• Estimating costs
• Reminding of lessons
• Advising of any changes or cancellations
• Informing of test dates etc.
• Reviewing & replying to student reflective logs
This information is kept solely for the purpose of answering your original enquiry. Once the enquiry has been satisfactorily dealt with, your personal data are deleted permanently from the online database.
If we are unable to contact you and your enquiry remains incomplete for 180 days, the information is deleted, regardless of there having been no satisfactory conclusion to the enquiry.
Additional Data Held for Pupils
In order to book driving lessons through cf14 School of Motoring, it is necessary to retain the students name, address, email and any contact numbers together with their driving licence number. If you are booking on behalf of a friend or family member, we will also need to retain your details as above. This, along with any other contact data that you have provided will be deleted on successful completion of the student / friend or family member passing their driving test, or at the end of our specified data retention period.
Successful Candidate Photographs
When candidates pass their driving test, they will be asked for a photograph for promotional purposes. If verbal or written permission is given, the image will be displayed on our web site and in other promotional material such as Facebook, Twitter & Free Index, or until such permission is withdrawn.
Data Held Relating To Customers
Contact information is held for the purpose of:
• Responding to your enquiry
• Estimating costs
• Reminding of lessons
• Advising of any changes or cancellations
• Informing of test dates etc.
• Reviewing & replying to student reflective logs
Making the reasonable assumption that having asked a question via our web site enquiry page, that you are entitled to and expect an answer, we claim your consent to reply by your chosen means, e.g. email or phone. Once your enquiry has been dealt with, we assume no further consent to use your personal data, which are then removed from the online database.
Invoice details will be retained in accordance with our legal obligation in respect of tax regulations.
This section defines the policy for managing data throughout Barry Thomas of cf14 School Of Motoring (cf14som.co.uk web site), hosted on a dedicated server located in the data centre belonging to Names Co Ltd.
Data held by the organisation for the purposes of carrying on its day to day business may be at risk of leakage or loss through the following means:
• Data Theft through hacking (Cyber Crime)
• Data Theft from the Cloud
• Data Theft through embezzlement
• Data Theft through hardware loss
• Fire
• Flood
• Physical damage to equipment
• End of equipment life risks
Invoice details will be retained in accordance with our legal obligation in respect of tax regulations.
Scope
This section defines the policy for managing data throughout Barry Thomas of cf14 School Of Motoring (cf14som.co.uk web site), hosted on a dedicated server located in the data centre belonging to Names Co Ltd.
Risks
Data held by the organisation for the purposes of carrying on its day to day business may be at risk of leakage or loss through the following means:
• Data Theft through hacking (Cyber Crime)
• Data Theft from the Cloud
• Data Theft through embezzlement
• Data Theft through hardware loss
• Fire
• Flood
• Physical damage to equipment
• End of equipment life risks
In order to minimise risks, the number of copies of data held is minimised, commensurate with protection against data loss. In this case, this means that no portable device is ever used as a data repository. All data relating to customers, prospects and enquirers is held on one of the dedicated web servers in the Names Co data centre. For day to day use, this is accessed via a single account that does not have root privileges. Only one person has the login credentials for this account. Only one person has login credentials for the root account on any of our servers.
Our database is held on servers used are all protected by firewalls, and all security patches or updates are applied as soon as they become available by the one person responsible for security.
Data Theft Through Hacking
All personally identifiable data is held on a dedicated web server located in the UK and maintained by Names Co. This is protected by a firewall which is updated regularly.
Access to the database that holds such data is also restricted by a separate login with different credentials to the root user, connection being made via https web pages. See General Considerations for the policy regarding password generation, which is applied to all systems used by Barry Thomas of cf14 School Of Motoring, both on line and internally.
For disaster recovery purposes, the contents of the web server are backed up to a NAS unit in the main office. The backup is a snapshot of only the latest data and only the most recent backup file is retained in between weekly backup sessions, so that no obsolete data can be accessed or restored once removed from the main database (allowing a week of latency added to our regular data review cycle, as laid out in our Data Retention Term document).
Data access for employees is granted at a level where they can carry out the necessary procedures for their work through https web pages. These pages do not allow download of the database contents and nobody other than the responsible person has access to the database as root user.
Data Theft Through Equipment Loss
To prevent loss of data with equipment, no unlocked device that is used outside the office carries any sensitive data relating to the business or to the people that it deals with.
Damaged and End of Life Equipment
In the event of damage to equipment rendering it no longer serviceable, the hard drive will be removed and physically destroyed before disposal of the remaining hardware.
Where equipment has reached the end of its service life and is to be sold as used, the internal hard drive will either be replaced or completely erased and the OS replaced before sale.
Our database is held on servers used are all protected by firewalls, and all security patches or updates are applied as soon as they become available by the one person responsible for security.
Data Theft Through Hacking
All personally identifiable data is held on a dedicated web server located in the UK and maintained by Names Co. This is protected by a firewall which is updated regularly.
Access to the database that holds such data is also restricted by a separate login with different credentials to the root user, connection being made via https web pages. See General Considerations for the policy regarding password generation, which is applied to all systems used by Barry Thomas of cf14 School Of Motoring, both on line and internally.
For disaster recovery purposes, the contents of the web server are backed up to a NAS unit in the main office. The backup is a snapshot of only the latest data and only the most recent backup file is retained in between weekly backup sessions, so that no obsolete data can be accessed or restored once removed from the main database (allowing a week of latency added to our regular data review cycle, as laid out in our Data Retention Term document).
Data access for employees is granted at a level where they can carry out the necessary procedures for their work through https web pages. These pages do not allow download of the database contents and nobody other than the responsible person has access to the database as root user.
Data Theft Through Equipment Loss
To prevent loss of data with equipment, no unlocked device that is used outside the office carries any sensitive data relating to the business or to the people that it deals with.
Damaged and End of Life Equipment
In the event of damage to equipment rendering it no longer serviceable, the hard drive will be removed and physically destroyed before disposal of the remaining hardware.
Where equipment has reached the end of its service life and is to be sold as used, the internal hard drive will either be replaced or completely erased and the OS replaced before sale.
Under the provision of the General Data Protection Regulation, you have the right to request to view, or have removed any data held relating to you as a natural person.
This can be requested direct to the DPO.
This can be requested direct to the DPO.
Under the provisions of the General Data Protection Regulation, you have the right for all data held relating to yourself to be completely and permanently erased.
Note : Removal of all data may impact on our ability to provide a service to you.
The Regulation also provides for this information being removed from all backup copies and other repositories in the organisation. To ensure that this requirement is followed, Barry Thomas of cf14 School Of Motoring adopts the following practices:
• Only one copy of the database exists for each day over the past 7 days. This is held on a remote server in a secure data centre
• For disaster recovery
• The backup is a snapshot of the most recent data for each day of the week.
• Every week that backup file is overwritten with the latest data
• In case of a backup being restored, the responsible individual is required to manually reconcile any RTBF requests that may have been overridden by the restoration
Please note that the database is backed up daily with each days backup held for one week so there will be a latency of seven days between removal from the active database and removal from all backup copies.
Note : Removal of all data may impact on our ability to provide a service to you.
The Regulation also provides for this information being removed from all backup copies and other repositories in the organisation. To ensure that this requirement is followed, Barry Thomas of cf14 School Of Motoring adopts the following practices:
• Only one copy of the database exists for each day over the past 7 days. This is held on a remote server in a secure data centre
• For disaster recovery
• The backup is a snapshot of the most recent data for each day of the week.
• Every week that backup file is overwritten with the latest data
• In case of a backup being restored, the responsible individual is required to manually reconcile any RTBF requests that may have been overridden by the restoration
Please note that the database is backed up daily with each days backup held for one week so there will be a latency of seven days between removal from the active database and removal from all backup copies.
Your data is held until satisfactory conclusion of your enquiry or until you are no longer using our services.
Enquiry info is held in the database for no more than 3 days. This is to ensure we can respond to them even if there is an issue with email delivery. No automated processing of data is carried out on the database holding your information, other than a regular check for expired data. To ensure compliance with our policies, every day, the database is queried for entries that are greater in age than the number of days laid out in our Data Retention Terms Policy.
If found, the record and all associated data are automatically deleted from the active database. The active database is backed up daily, overwriting the previous copy from the same day the week before, so there will be a latency between deleting from the active database and the backup version. This will mean a possible delay of a maximum of seven days before final eradication of over-age data.
Automated Processes
Enquiry info is held in the database for no more than 3 days. This is to ensure we can respond to them even if there is an issue with email delivery. No automated processing of data is carried out on the database holding your information, other than a regular check for expired data. To ensure compliance with our policies, every day, the database is queried for entries that are greater in age than the number of days laid out in our Data Retention Terms Policy.
If found, the record and all associated data are automatically deleted from the active database. The active database is backed up daily, overwriting the previous copy from the same day the week before, so there will be a latency between deleting from the active database and the backup version. This will mean a possible delay of a maximum of seven days before final eradication of over-age data.
