Our data protection policy
Speech and Language UK is committed to being transparent about how it collects and uses Personal Data and to meeting its data protection obligations.
This policy sets out Speech and Language UK’s commitment and your obligations in relation to data protection, and individual rights and obligations in relation to Personal Data. This Policy sets out how Speech and Language UK handles the Personal Data of our customers, suppliers, employees, workers, pupils and parents, and other third parties.
This Policy applies to all Personal Data we process regardless of the media on which Personal Data is stored or whether it relates to past or present employees, workers, customers, clients or supplier contacts, shareholders, website users or any other Data Subject. This Policy applies to all employees, workers, contractors, agency workers, consultants, directors and any others who process Personal Data on behalf of Speech and Language UK. Each employee must read, understand and comply with this Policy when processing Personal Data on our behalf and attend training on its requirements.
All directors, individual business areas, units, departments, managers, supervisors and other responsible parties are responsible for ensuring compliance with this Policy and need to implement appropriate practices, processes, controls and training to ensure such compliance.
Speech and Language UK has appointed Satswana as its data protection officer with responsibility to inform and advise Speech and Language UK on its data protection obligations. Questions about this policy, or requests for further information, should be directed to our data protection officer Satswana Limited, Ferneberga House Suite G12, Alexandra Road, Farnborough, Hampshire, United Kingdom, GU14 6DQ, Tel 01252 516898 or email info@satswana.com
Failure to comply with this Policy will be regarded as serious misconduct and will be dealt
with in accordance with Speech and Language UK’s Disciplinary Procedure.
Definitions:
Personal Data: any information that relates to an individual who can be directly or indirectly identified from that information. Personal Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour, or an identification number, online identifier or location data.
Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Personal Data is a Personal Data Breach.
Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding/storing the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
Sensitive Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convictions.
Data protection principles
Speech and Language UK processes personal data in accordance with the following data
protection principles which require personal data to be:
- Processed lawfully, fairly and in a transparent manner
- Collected only for specified, explicit and legitimate purposes
- Processed only where it is adequate, relevant and limited to what is necessary for the purposes of processing
- Accurate and for Speech and Language UK to take all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay
- Kept only for the period necessary for the purposes of processing
- Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage
Speech and Language UK tells individuals the reasons for processing their Personal Data, how it uses such data and the legal basis for processing in its privacy notices. It will not process Personal Data for other reasons.
Speech and Language UK will update Personal Data promptly if an individual advises that their information has changed or is inaccurate.
Speech and Language UK keeps full and accurate records of its processing activities in respect of personal data in accordance with the requirements of data protection legislation.
Protecting Personal Data
Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
Speech and Language UK has developed, implemented and maintains safeguards appropriate to our size, scope and business, our available resources, the amount of personal data that we own or maintain on behalf of others and identified risks (including use of encryption and pseudonymisation where applicable). In particular we have devised specific processes to ensure the safeguarding of data relating to children. Please refer to the Safeguarding Policy for Speech and Language UK and/or the schools, as appropriate.
We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our processing of personal data. All employees are responsible for protecting the personal data we hold and must implement reasonable and appropriate security measures against unlawful or unauthorised
processing of personal data and against the accidental loss of, or damage to, personal data. All employees must exercise particular care in protecting sensitive personal data from loss and unauthorised access, use or disclosure. All employees must comply with all security arrangements in place including information technology, such as password-protected files and screen savers, as set out in our IT Acceptable Use Policy and other organisational arrangements including locks for drawers and filing cabinets and restricted access arrangements.
When personal data is destroyed this must be in accordance with secure destruction arrangements. Personal data must not be thrown into general rubbish bins. Particular care must be taken where it is necessary to take information away from Speech and Language UK’s premises. You should protect against accidental disclosure such as, for example, someone near to you being able to read information over your shoulder.
Never disclose personal data to other employees or a third party either orally or in writing without the prior consent of your Manager and until all appropriate checks and contractual arrangements have been made.
Individuals who have access to personal data are required:
- to access only personal data that they have authority to access and only for
authorised purposes necessary for the performance of their role - not to disclose personal data except to individuals (whether inside or outside
Speech and Language UK) who have appropriate authorisation - to keep personal data secure (for example by complying with rules on access to
premises, computer access, including password protection, and secure file storage
and destruction) - not to remove personal data, or devices containing or that can be used to access personal data, from Speech and Language UK ‘s premises without adopting appropriate security measures (such as encryption or password protection) to secure the personal data and the device
- not to store personal data on local drives or on personal devices that are used for work purposes
Reporting a Personal Data Breach
Data protection law requires Speech and Language UK to notify any personal data breach to the applicable regulator within 72 hours and, in certain instances, the individual. If you know or suspect that a personal data breach has occurred, do not attempt to investigate the matter yourself.
Immediately:
- contact our IT Service desk using the dedicated contact number: 020 3846 4073,
- then inform the Head of IT and Data.
- If you are in a school, you must copy this to the School Principal or the Director of Education. You should preserve all evidence relating to the potential personal data breach. Failure to do this may result in disciplinary action.
Individual rights
Individuals have a number of rights in relation to their Personal Data.
Subject access requests
Individuals have the right to make a subject access request. If an individual makes a subject access request, Speech and Language UK will tell him/her:
- whether or not his/her personal data is processed and if so why, the categories of Personal Data concerned and the source of the personal data if it is not collected from the individual;
- to whom his/her personal data is or may be disclosed, including to recipients located outside the European Economic Area (EEA) and the safeguards that apply to such transfers;
- for how long his/her personal data is stored (or how that period is decided);
- his/her rights to rectification or erasure of personal data, or to restrict or object to processing;
- his/her right to complain to the Information Commissioner if he/she thinks Speech and Language UK has failed to comply with his/her data protection rights; and
- whether or not Speech and Language UK carries out automated decision-making and the logic involved in any such decision-making.
Speech and Language UK will also provide the individual with a copy of the personal data undergoing processing. This will normally be in electronic form if the individual has made a request electronically, unless he/she agrees otherwise.
If the individual wants additional copies, Speech and Language UK will charge a fee, which will be based on the administrative cost to Speech and Language UK of providing the additional copies.
To make a subject access request, the individual should send the request to our data protection officer Satswana Limited, Ferneberga House Suite G12, Alexandra Road, Farnborough, Hampshire, United Kingdom, GU14 6DQ, Tel 01252 516898 or email info@satswana.com. In some cases, Speech and Language UK may need to ask for proof of identification before the request can be processed. Speech and Language UK will inform the individual if it needs to verify their identity and the documents it requires.
Speech and Language UK will normally respond to a request within a period of one month from the date it is received. In some cases, such as where Speech and Language UK processes large amounts of the individual’s data, it may respond within three months of the date the request is received. Speech and Language UK will write to the individual within one month of receiving the original request to tell them if this is the case.
If a subject access request is manifestly unfounded or excessive, Speech and Language UK is not obliged to comply with it. Alternatively, Speech and Language UK can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which Speech and Language UK has already responded. If an individual submits a request that is unfounded or excessive, Speech and Language UK will notify them that this is the case and whether or not it will respond to it.
Other rights
Individuals have a number of other rights in relation to their Personal Data. Under certain
circumstances they can require Speech and Language UK to:
- rectify inaccurate data;
- stop processing or erase data that is no longer necessary for the purposes of processing;
- stop processing or erase data if the individual’s interests override Speech and Language UK’s legitimate grounds for processing data (where Speech and Language UK relies on its legitimate interests as a reason for processing data);
- stop processing or erase data if processing is unlawful; and
- stop processing data for a period if data is inaccurate or if there is a dispute about whether or not the individual’s interests override Speech and Language UK’s legitimate grounds for processing data
- transfer personal data to another party where processing is carried out by automated means.
To find out more about these rights, to exercise any of these rights, or if there are any questions or concerns about data protection at Speech and Language UK, individuals should contact our data protection officer Satswana Limited, Ferneberga House Suite G12, Alexandra Road, Farnborough, Hampshire, United Kingdom, GU14 6DQ, Tel 01252 516898 or email info@satswana.com
Training and audit
Speech and Language UK will provide training to all individuals about their data protection responsibilities as part of the induction process and at regular intervals thereafter. Individuals whose roles require regular access to personal data, or who are responsible for implementing this policy or responding to subject access requests under this policy, will receive additional training to help them understand their duties and how to comply with them.
We will regularly review all the systems and processes in place to ensure proper use and
protection of personal data.
Data Protection Policy
Reviewer: Head of IT and Data
Review Date: July 2023
Next Review: July 2025
