The security and privacy of your data is taken seriously by us, but we need to gather and use information or ‘data’ about you as part of our business and to manage our relationship with you. We are committed to complying with all the Data Protection legal obligations.

This policy applies to current and former team members, workers, volunteers, interns, apprentices, and consultants.  If you fall into one of these categories, then you are a ‘data subject’ for the purposes of this policy. You should read this policy alongside your Contract of Employment (or contract for services) and any other notice we issue to you from time to time in relation to your data, this does not form part of your Contract of Employment (or contract for services if relevant) and can be amended by Copy Club at any time.

We have a general policy and privacy notice in place for job applicants, customers, suppliers, and other categories of data subject. A copy of these can be obtained from the person responsible for data at Copy Club.

Copy Club’s ‘Data Protection Officer’ is Lottie Unwin, CEO. They are responsible for reviewing this policy on Copy Club’s data protection responsibilities and any risks in relation to the processing of data. You should direct any questions in relation to this policy or data protection to this person and address any written requests to them.

We have taken steps to protect the security of your data in accordance with our Data Security Policy and will train staff about their data protection responsibilities as part of the induction process. We will only hold data for as long as necessary for the purposes for which we collected it.

Copy Club is a ‘data controller’ for the purposes of your personal data. This means that we determine the purpose and means of the processing of your personal data.

Data Protection Principles

Personal data must be processed in accordance with the ‘Data Protection Principles.’ It must:

• be processed fairly, lawfully and transparently;
• be collected and processed only for specified, explicit and legitimate purposes;
• be adequate, relevant and limited to what is necessary for the purposes for which it is processed;
• be accurate and kept up to date. Any inaccurate data must be deleted or rectified without delay;
• not be kept for longer than is necessary for the purposes for which it is processed; and
• be processed securely.

We are accountable for these principles and must be able to show that we are compliant.

How we Define Personal Data

‘Personal data’ means information which relates to a living person who can be identified from that data (a ‘data subject’) on its own, or when taken together with other information which is likely to come into our possession.

This policy applies to all personal data whether it is stored electronically, on paper or on other materials.