Data Protection Policy

At Van Sign Writing Essex, we are committed to ensuring the protection and privacy of personal data entrusted to us by our customers, employees, and business partners. This Data Protection Policy explains how we collect, use, store, and protect personal information, in line with the General Data Protection Regulation (GDPR) and other relevant UK data protection laws.

1. Scope of the Policy

This policy applies to all personal data collected, processed, and stored by Van Sign Writing Essex, whether in electronic or physical format. It applies to:

• Customers
• Employees
• Business partners and suppliers
• Website visitors

2. Personal Data We Collect

We collect and process personal data for legitimate business purposes, including:

• Contact information: Name, address, email address, phone number
• Business information: Company name, vehicle details, and services requested
• Financial information: Bank details or payment card information (where applicable)
• Website usage data: IP addresses, cookies, and online behavioural data
• Employee information: Employment contracts, payroll data, and related information

3. Data Collection Methods

Personal data is collected through the following channels:

• Direct interactions: Email, phone, in-person meetings, contact forms, and order requests
• Website: Forms, cookies, and analytics tools
• Employment applications and contracts

4. Purpose of Data Processing

We collect and process personal data for specific, legitimate purposes, including:

• To provide our services and fulfil customer orders (e.g., van signage, graphics design)
• To manage client relationships and communications (e.g., quotes, invoices, updates)
• To maintain business records and comply with legal obligations (e.g., tax, accounting)
• For internal employee management (e.g., payroll, HR functions)
• To improve website performance and user experience through analytics
• For marketing communications (with consent)

5. Legal Basis for Processing

Under the GDPR, we must have a lawful basis to process personal data. The lawful bases we rely on include:

• Consent: We seek explicit consent for certain processing activities, such as marketing.
• Contract: Data is processed as part of a contract with the data subject (e.g., providing services).
• Legal obligation: We process data to comply with legal or regulatory requirements.
• Legitimate interest: Processing is necessary for our legitimate business interests, such as improving customer service or marketing our services (balanced with individual privacy rights).

6. Data Retention

We retain personal data for only as long as necessary to fulfil the purposes for which it was collected or as required by law. The retention periods for different types of data are as follows:

• Customer data: Retained for the duration of the service relationship and for up to 6 years after, in line with tax and accounting requirements.
• Employee data: Retained for the duration of employment and for up to 6 years after employment ends, in compliance with UK employment laws.
• Marketing data: Retained until the individual withdraws consent or opts out of receiving communications.

7. Data Security

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, loss, or disclosure. Measures include:

• Secure storage of data (both physical and electronic)
• Encryption of sensitive data
• Restricted access to personal data, based on roles and responsibilities
• Regular review and updating of security procedures

8. Data Sharing

We do not sell or rent personal data to third parties. However, we may share personal data with trusted third parties under the following circumstances:

• Service providers: To help us provide our services (e.g., payment processors, delivery services, IT support).
• Legal requirements: If required to comply with legal obligations or respond to a court order.
• Business transfers: In the event of a merger, acquisition, or sale of assets.

We ensure that third parties with whom we share personal data are subject to appropriate data protection and confidentiality obligations.

9. Data Subject Rights

Under the GDPR, individuals have certain rights regarding their personal data. These rights include:

• The right to access: Request access to the personal data we hold about them.
• The right to rectification: Request correction of inaccurate or incomplete personal data.
• The right to erasure ("right to be forgotten"): Request the deletion of personal data in certain circumstances.
• The right to restrict processing: Request that we limit how we use their data.
• The right to data portability: Request to have their data transferred to another organisation.
• The right to object: Object to the processing of their data for specific purposes, such as direct marketing.

To exercise any of these rights, individuals can contact us at privacy@vansignwritingessex.co.uk. We will respond to requests within one month.

10. Data Breaches

We have procedures in place to detect, report, and investigate any personal data breaches. In the event of a data breach that poses a risk to individuals' rights and freedoms, we will notify the UK Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to individuals, we will also inform those affected.

11. International Data Transfers

We do not typically transfer personal data outside the European Economic Area (EEA). However, if international transfers are necessary (e.g., using third-party service providers outside the EEA), we will ensure that appropriate safeguards are in place, such as using contracts with approved Standard Contractual Clauses (SCCs).

12. Training and Awareness

All employees of Van Sign Writing Essex receive regular training on data protection principles, GDPR compliance, and the importance of safeguarding personal data. We promote a culture of privacy within our organisation to ensure that personal data is handled with the utmost care and responsibility.

13. Changes to This Policy

We may update this Data Protection Policy from time to time to reflect changes in legislation or our business practices. The latest version of the policy will always be available on our website. We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have any questions or concerns regarding this Data Protection Policy or how we handle personal data, please contact:

Van Sign Writing Essex
Email: privacy@vansignwritingessex.co.uk
Phone: 01708 918820