Roughliving Furniture Limited may be required to collect and use information about the individuals and businesses we work with. Whether information is collected on paper, in computer records or by any other means, we will always handle the information with care.
We recognise that the lawful treatment of personal information is integral to our operations and in maintaining trust between us and those we work with. Roughliving will always treat information in the lawful and correct way. As such, we fully endorse and adhere to the principles of the GDPR.
This policy, in its entirety, applies to all Roughliving employees, operatives, sub-contracted labour, clients and suppliers.
“Data” – Information that you submit to Roughliving Furniture Limited. Where applicable, this incorporates the definitions provided in the Data Protection Act 1998.
“Personal Data” – Information that relates to an identifiable person who can be directly or indirectly identified from that information.
“Data Processing” – Any operation that is performed on personal data including: collection, recording, organisation, storage, adaption, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment, restriction or destruction.
“Roughliving Furniture Limited” “We” “Us” “Company” – Roughliving Furniture Limited, a company incorporated in England and Wales with registered number 10744987 and registered at 167 Turners Hill, Cheshunt, Waltham Cross, EN8 9BH.
In line with GDPR, all personal data collected and stored by us must be processed according to a set of core principles. Therefore, we will ensure that:
1. Processing will be fair, lawful and transparent.
2. Data will be collected for specific, explicit and legitimate purposes.
3. Data collected will be adequate, relevant and limited to what is necessary for the purposes of processing.
4. Data will be kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay.
5. Data is not kept for longer than is necessary for its given purpose.
6. Data will be processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures.
7. We will comply with the relevant GDPR procedures for international transferring of personal data.
As a Company, it is necessary for us to collect certain information in order to carry out functions such as making payment, receiving payment, writing contracts, producing purchase orders and so on. The data we collect includes (but is not limited to):
1. Company Name
2. Individual’s Name
3. Job Titles
4. Email Address
5. Company and/or Personal Phone Numbers including Mobiles
6. Financial Information including Bank Name, Account Number, Sort Code, Credit Card information
Our Company website automatically collects IP addresses. Our website does not automatically collect any other data. If an individual uses one of the contact forms based on our website or purchases goods on the website, then we will collect:
2. Company Name
3. Email Address
4. Telephone Number
5. Payment Information
6. Invoice & Delivery Address details for Order Processing
7. IP Address of Sender
1. For purposes of the Data Protection Act 1998, Roughliving Furniture Limited is the “data controller.”
2. Unless we are obliged or permitted by law to do so, personal data will not be disclosed to third parties.
3. All personal data is stored securely in accordance with the principles of the Data Protection Act 1998.
To protect the personal data of relevant individuals, all employees within our business who process data as part of their role have been inducted and trained in our policy on Data Protection & Privacy.
All individuals have a right to access the personal data that we hold on them. To exercise this request, individuals should make a Subject Access Request. We will fulfil the request without delay (within one month) unless, in accordance with legislation we decide an extension is required. If an extension is required, we will inform the individual.
There is no charge for a Subject Access Request unless the request is manifestly unfounded, excessive or repetitive or unless a request is made for duplicate copies to be provided to the individual. In these circumstances, a reasonable charge will be applied.
The Company may be required to disclose certain data to any person. Disclosures will only be made when strictly necessary for the purpose. The circumstances leading to such disclosures include:
1. To assist law enforcement or a relevant authority to prevent or detect crime or prosecute offenders or to assess or collect any tax or duty.
All employees of the company are instructed to store files or written information of a confidential nature in a secure manner so they are only available to be accessed by people who have a specific need and right to access them.
Screen locks and passwords are implemented on all PCs, laptops, tablets etc and all employees are instructed to ‘lock’ their devices when unattended.
Employees are instructed to ensure that no files or written information of a confidential nature are left where they can be accessed by unauthorised individuals.
All data held digitally is password protected both on our local hard drive and company network drive that is regularly backed up. We limit the use of ‘removable storage media’ such as USBs.
All employees are issued with passwords, which cannot be altered without our notice. All employees are instructed that they are not permitted to disclose these passwords.
Failure to follow the Company’s standards on Data Security may be dealt with via the Company’s Disciplinary Policy & Procedure.
If we are required to engage with third parties to process data on our behalf, we will implement a data processing agreement with the third party, which will dictate the measures we expect the third party to carry out in order to maintain our commitment to protecting data.
Third Party Websites and Services
We employ the services of a third party to deal with certain technical processes necessary for the operation of our Company website. As such, this third-party provider has access to certain personal data provided by users of our Company website.
Any data used by this third party is used only to the extent required by them to perform services upon our request. Any use for other purposes is strictly prohibited.
If any data breaches occur, we will record them on our Data Breach Register. Where legally required, we will report the breach to the Information Commissioner within 72 hours of discovery. Additionally, we will inform the individual whose data was subject to breach, where legally required.
This Agreement is governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement are subject to the exclusive jurisdiction of the English and Welsh courts.