All staff in our organisation have been made aware that the
law has changed with regard to an individual’s rights to have their personal
data protected. These changes are set out in the General Data Protection
Regulations which came into effect on the 25th May 2018. The GDPR is similar to the existing UK Data Protection Act 1998 (DPA) but updated with additional legal requirements. The UK agency that is responsible for enforcing the GDPR is the Information Commission’s Office
(ICO). Now GDPR is in effect, there are significant financial
penalties that can be enforced for a data breach or a failure to follow the
stipulations under GDPR or a failure to obtain formal consent.
We may collect, store and use the following kinds of
information about your computer and about your visits to and
use of this website (including your IP address, geographical location, browser
type and version, operating system, referral source, length of visit, page
views, and website navigation details.
information relating to any transactions carried out between
you and us on or in relation to this website. We do not, however, sell anything
directly through our website and direct purchases cannot be made via the
information that you provide to us for the purpose of
registering with us (including your email address, telephone number, address,
information that you provide to us for the
purpose of subscribing to our website services, email notifications and/or
any other information that you choose to send to us.
A cookie consists of information sent by a web server to a
web browser, and stored by the browser. The information is then sent back to
the server each time the browser requests a page from the server. This enables
the web server to identify and track the web browser. We may use both “session”
cookies and “persistent” cookies on the website. We will use the session
cookies to: keep track of you whilst you navigate the website.
We will use the persistent cookies to: enable our website to
recognise you when you visit. Session cookies will be deleted from your
computer when you close your browser. Persistent cookies will remain stored on
your computer until deleted, or until they reach a specified expiry date.
We use Google Analytics to analyse the use of this website.
Google Analytics generates statistical and other information about website use
by means of cookies, which are stored on users’ computers. The information
generated relating to our website is used to create reports about the use of
is available at: http://www.google.com/privacypolicy.html. Most browsers allow
you to reject all cookies, whilst some browsers allow you to reject just third
party cookies. For example, in Internet Explorer you can refuse all cookies by
clicking “Tools”, “Internet Options”, “Privacy”, and selecting “Block all
cookies” using the sliding selector. Blocking all cookies will, however, have a
negative impact upon the usability of many websites, including this one.
Google’s advertising requirements can be summed up by
Google’s Advertising Principles. They are put in place to provide a positive
experience for users. https://support.google.com/adwordspolicy/answer/1316548?hl=en
on our site. Google’s use of the DART cookie enables it to serve ads to our
users based on previous visits to our site and other sites on the Internet.
Users may opt-out of the use of the DART cookie by visiting the Google Ad and
We may use your personal information to:
administer the website; improve your browsing experience by personalising the
enable you use of the services available on the website;
send you general (non-marketing) commercial communications;
send you by post or email marketing notifications which you
have specifically agreed to and have been also unambiguously and properly opted
in. For example, loan calculator used on our website; send you our newsletter and other marketing
communications relating to our business, where you have specifically agreed to
this and they have also been unambiguously and properly opted in, by post, by
email or similar technology. You can inform us at any time if you no longer
require marketing communications.
Provide third parties with statistical information about our users – but this information will not be used to identify any individual user; for example as used by google analytics deals with enquiries and complaints made by or about you relating to the website; We will not provide your personal information to any third parties for the purpose of direct marketing.
Merchant cardholder receipt data is stored for the required minimum accounting period of 7 years and also to respond to providing copy receipts and chargebacks.
Our Lawful basis for processing personal data:
Asking for consent - We consider that consent is the most appropriate lawful basis for processing personal data. The request for consent is prominent and separate from our terms and conditions. We ask people to positively opt in. We don’t use pre-ticked boxes or any other type of default consent. We use clear, plain language that is easy to understand. We specify why we want the data and what we’re going to do with it. We give individual detailed options to consent separately to different purposes and types of processing. We name our organisation and any third party controllers who will be relying on the consent. We tell individuals they can withdraw their consent. We ensure that individuals can refuse to consent without detriment. We avoid making consent a precondition of a service.
We regularly review consents to check that the relationship, the processing and the purposes have not changed. There are processes in place to refresh consent at appropriate intervals, including any parental consents. Individuals may withdraw their consent at any time, and we publicise how to do so. Withdrawals of consent are acted on as soon as possible. We will not penalise individuals who wish to withdraw consent.
We consider that legitimate interests is also another
appropriate basis for processing and storing of for instance photographic
We understand our responsibility to protect the individual’s
We have conducted a legitimate interest’s assessment (LIA)
and kept a record of it, to ensure that we can justify our decision.
We have identified the relevant legitimate interests.
We have checked that the processing is necessary and there
is a no less intrusive way to achieve the same result.
We have done a balancing test, and are confident that the
individual’s interests do not override those legitimate interests.
We only use individuals’ data in ways they would reasonably
expect unless we have a very good reason.
We are not using people’s data in ways they would find
intrusive or which could cause them harm unless we have a very good reason.
We have considered safeguards to reduce the impact where
We have considered whether we can offer an opt-out.
If our LIA identifies a significant privacy impact, we have
considered whether we also need to conduct a DPIA.
We keep our LIA under review and repeat it if circumstances
We include information about our legitimate interests in our
We will take reasonable technical and organisational
precautions to prevent the loss, misuse or alteration of your personal
information. We will store all the personal information you provide on our
secure (password- and firewall- protected) servers. All electronic transactions
you make to or receive from us will be encrypted using SSL technology. All information
is handled in accordance with the data protection act 1998. Of course, data
transmission over the internet is inherently insecure, and we cannot guarantee
the security of data sent over the internet.
Any breach which leads to accidental, unlawful destruction
or the loss or alteration of personal data will be notified to the ICO within
72 hours and to all affected individuals without undue delay.
You have the absolute right to object to your data being processed and profiled for direct marketing purposes. You have the right to have your information withdrawn at any time. Your information will be provided to you within one month and no fee will be levied. You may instruct us to provide you with any personal information we hold about you. Provision of such information will be subject to the supply of appropriate evidence of your identity. For this purpose, we will usually accept a photocopy of your passport certified by a solicitor or bank plus an original copy of a utility bill showing your current address. We may withhold such personal information to the extent permitted by law. You may instruct us not to process your personal information for marketing purposes by email at any time. In practice, you will usually either expressly agree in advance to our use of your personal information for marketing purposes, or we will provide you with an opportunity to opt-out of the use of your personal information for marketing purposes.
The website contains links to other websites. We are not
responsible for the privacy policies or practices of third party websites.
Please let us know if the personal information which we hold
about you needs to be corrected or updated.
treatment of your personal information, please write to us using the form below.
The data controller responsible in respect of the
information collected at Redrock Commercial Finance Ltd is Mike Brown.