Privacy Policy

GDPR (General Data Protection Regulation) is a regulation by the European Parliament which adds to the UK’s data protection laws, and gives people more rights over their own information (or data).

• Organisations that hold data (information) about people need to handle it in a fair and lawful manner.
• You can only keep personal data if people know it is being held and why, if it is for lawful purposes, and when informed consent is gained. You cannot just gather lists of people’s personal information for no particular reason.
• Any personal data stored must be for the reason people are given; in other words you can’t collect email addresses to send out eNewsletters and then use the same list to send out something quite different.
• Personal data must be accurate and kept up to date.
• Personal data must not be stored for longer than necessary. Keeping details of people that you no longer need or use is against the law.
• Personal data must be kept securely.
• Personal data can only be handled in a way that respects the rights of individuals.
• GDPR gives people more rights to know how their personal data is being used.
• The right to be ‘forgotten’ and their personal data deleted if they wish.
• To be able to see what personal data is being held about them, and to make sure their personal data is correct.
• Increased importance for the protection of children.
• Increased importance for not allowing people without permission to see or use others’ personal data.
• If someone’s personal data has been used by people without permission, they have to be told what happened.

At least one of these must apply whenever you process personal data:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life.
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

According to Government legislation, The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union.

To comply with this legislation, this policy outlines what data I will hold about your dog and their family and how long I am required to hold it for.

Policy:
Under the GDPR, companies are required to ensure transparency on the way they collate, store and use any personal data. Owners have the right to ask that personal data is destroyed or deleted once they have left a setting, providing that deleting the material will not impact on legal regulations. Please refer to my GDPR Guidelines in this document.

Procedure:
Data required by me to ensure I follow all GDPR and legal requirements, are as follows:

• • Personal Information
  • Owner’s names
  • Dog’s names
  • Address
  • Contact details
  • Medical information
  • Signatures
  • Permissions

Collation, Storage and Usage of Data:
Any hand-written data documents are stored in a secure filing cabinet within the premises, with no unauthorised access given.

Initial contact information: When discussing potential future dog training will involve my noting down owner’s contact information. This will be stored either on paper (as above) or on my mobile telephone / business email (as below), depending upon the contact method.

Personal laptop; to create, send, and store computer-generated documents. This laptop is password protected and files are stored on a password protected cloud-based platform. Documents will be sent to owners using my business email account, which is also password protected. These passwords will never be shared with anyone else.

Mobile telephone; to take photographs/videos of the dog(s) during training (and these may be used in each dog’s Training Plan or Behaviour Modification Plan). These files will be stored as above and deleted from the laptop/mobile as soon as they are no longer needed.

I also use my mobile telephone to store owner’s contact information; for emergencies and quick contact during the day. I use Whatsapp/SMS text/voice call/email to communicate at the owner’s request. My mobile phone is password protected.

Retention Timescales:
Personal Information – Kept for 6 years

• • Permission Forms
  • Accounts
  • Attendance Registers

Sensitive Information – Kept for up to 10 years

• • Accident Records
  • Incident Records
  • First Aid Records
  • Existing Injuries Records
  • Safeguarding/ Welfare Records

Other Data:

• • Photographs/ videos – Deleted as soon as dog leaves the training program, unless written permission is obtained from owners, in which case they will be kept securely and only used for agreed use.
  • Training Records – Deleted or kept with owner’s permission.

Article 17 of the GDPR states that data subjects have the right to have their personal data removed from the systems of controllers and processors under a number of circumstances, such as by removing their consent for its processing.

Data Subjects have the right to obtain erasure from the data controller, without undue delay, if one of the following applies:

• The controller doesn’t need the data anymore.
• The subject withdraws consent for the processing with which they previously. agreed to (and the controller doesn’t need to legally keep it [N.B. Many will, e.g. banks, for 7 years.]).
• The subject uses their right to object (Article 21) to the data processing.
• The controller and/or its processor is processing the data unlawfully.
• There is a legal requirement for the data to be erased.
• The data subject was a child at the time of collection (See Article 8 for more details on a child’s ability to consent).

Exceptions:
Data might not have to be erased if any of the following apply:

• The “right of freedom and expression”
• The need to adhere to legal compliance, e.g. a bank keeping data for 7 years.
• Reasons of public interest in the area of public health
• Scientific, historical research or public interest archiving purposes
• For supporting legal claims, e.g. PPI offerings.

Out of Scope:

• Non-electronic documents which are not (to be) filed, (i.e. it’s data you can’t search for), e.g. a random piece of microfiche, or a paper notepad, are not classed as personal data in the GDPR and are therefore not subject to the right to erasure.