GDPR Compliance
Last updated: January 2024
disimpolk is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet our obligations under these regulations.
Our Commitment
We handle sensitive personal information as part of our advisory services, including details about health conditions, financial circumstances, and family situations. We take our responsibility to protect this information seriously and have implemented comprehensive data protection measures.
Data Controller
disimpolk acts as the data controller for personal information collected through our website and services. This means we are responsible for deciding how your personal data is processed and for what purposes.
Contact:
disimpolk
47 Colmore Row
Birmingham, B3 2BS
Email: [email protected]
Lawful Basis for Processing
We process personal data only when we have a lawful basis to do so. The bases we rely on include:
Contractual Necessity
Most of our data processing is necessary to provide the advisory services you have requested. Without this information, we cannot assess your situation or prepare benefit applications on your behalf.
Legitimate Interests
We process some data based on our legitimate interests, such as improving our services, preventing fraud, and maintaining records for professional standards. We always balance our interests against your rights and freedoms.
Legal Obligation
We may need to process your data to comply with legal requirements, such as maintaining financial records for tax purposes or responding to court orders.
Explicit Consent
For special category data (such as health information), we obtain your explicit consent before processing. You may withdraw this consent at any time.
Your Rights Under UK GDPR
Right of Access
You can request a copy of all personal data we hold about you. We will respond within one month of receiving your request.
Right to Rectification
If any information we hold is inaccurate or incomplete, you can request that we correct it.
Right to Erasure
You can request deletion of your personal data in certain circumstances, such as when the data is no longer needed for the purpose it was collected, or if you withdraw consent.
Right to Restrict Processing
You can ask us to limit how we use your data while we address any concerns you have raised.
Right to Data Portability
You can request your data in a structured, commonly used format that can be transferred to another service provider.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Special Category Data
Our services often require processing of special category data, particularly health information relevant to disability benefits. We process this data only with your explicit consent and in accordance with additional safeguards required by UK GDPR.
Data Security Measures
We implement appropriate technical and organisational measures to ensure data security, including:
- Encrypted storage and transmission of personal data
- Role-based access controls limiting who can view client information
- Regular security training for all staff
- Secure disposal of physical and electronic records
- Regular security assessments and updates
Data Breach Procedures
In the event of a personal data breach, we will:
- Assess the risk to individuals' rights and freedoms
- Report to the ICO within 72 hours if required
- Notify affected individuals without undue delay if there is a high risk
- Document the breach and our response
Exercising Your Rights
To exercise any of your data protection rights, please contact us by email at [email protected] or by post at the address above. We may need to verify your identity before processing your request.
We respond to all data protection requests within one month. If your request is complex, we may extend this by a further two months, in which case we will inform you.
Complaints
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
We encourage you to contact us first so we can try to resolve any concerns directly.