P A Baudains Ltd GDPR Policy 2024

This document provides you with information relating to how your personal data is used by P A Baudains Ltd (T/A Baudains Trade Supplies, BTS and Baudains Access & Storage, Baudains). Here you will find, information regarding all of your rights as a data subject and also the lawful basis on which the organisation relies when processing information about you.

Right of access

A data subject has the right to be advised as to whether a controller is processing personal data relating to them and, if so, that individual is entitled to one free copy of their personal data (with further copies available at a fee prescribed by the controller). This is known as a Subject Access Request (SAR). Upon receipt of an SAR, the controller has a period of one month to adhere to the request (an extension of two further months can be sought by the controller depending upon the complexity and number of requests submitted by the data subject).

Right to data portability

A data subject has the right to data portability, this means that an individual is able to arrange for the transfer of their personal data from one controller to another without hindrance from the first controller. This right can only be utilized where the processing is based on consent or for the performance of a contract. This right cannot be used for processing by a public authority.

Where a data subject invokes the right to data portability, the data subject has the right to be given their personal data in a structure, commonly used and machine-readable format suitable for transmission from one controller to another. Upon the request of a data subject, the controller must transmit their personal data directly to another controller unless it is technically unfeasible to do so.

Exception to right of portability or access

A controller is not obliged to comply with a data subject's request under the right of access or right to data portability where the controller cannot comply with the request without disclosing information in relation to another individual who is identified or identifiable from that information.

Right to object to processing

A data subject has the right to object to a controller's activities relating to the processing of personal data for direct marketing purposes, on grounds of public interest and for historical or scientific purposes.

Right to rectification

A data subject has the right to require a controller to complete any incomplete personal data and to rectify or change any inaccurate personal data.

Right to erasure

A data subject has the right to submit a written request to a controller regarding the erasure of the data subject's personal data in certain circumstances. These include where:

· The personal data is no longer required in relation to its original purpose for collection by the controller;

· The lawfulness of processing is based on consent and the data subject has withdrawn their consent;

· The data subject objects to the processing and the controller is required to cease the processing activity;

· The personal data has been unlawfully processed;

· The personal data must be erased in order to comply with any duty imposed by law; or

· The personal data was collected in the context of an offer from an information society service directly to a child under 13 years of age.

Right to restriction of processing

A data subject has the right to request, in writing, the restriction of processing activities which relate to the data subject's personal data. This right can be exercised where:

· The accuracy or completeness of the personal data is disputed by the data subject who wishes to obtain restriction of processing for a period in order for the controller to verify the accuracy or completeness;

· The processing is unlawful but the data subject wishes to obtain restriction of processing as opposed to erasure;

· The controller no longer requires the personal data, however the data subject requires the personal data in connection with any legal proceedings; or

· The data subject has objected to processing but the controller has not ceased processing operations pending determination as to whether public interest outweighs the significant interests of the data subject.

Right to be notified of rectification, erasure and restrictions

Where any rectification, erasure or restriction of personal data has been carried out, the data subject has a right to ensure that the controller notifies any other person to which the personal data has been disclosed about the rectification, erasure or restriction of processing. The controller must also notify the data subject of the identity and contact details of the other person if the data subject requests this information.

Right not to be subject to decisions based on automated processing

A data subject has the right not to be subjected to automated decision making without human intervention.

To exercise these data subject rights, please contact either the data protection officer or the controller.

Right to make a complaint

An individual may make a complaint in writing to the supervisory authority (the Office of the Data Protection Agency) if the individual considers that a controller or processor has breached, or is likely to breach, an operative provision of the data protection law, and the breach involves affects or is likely to affect any personal data relating to the individual or any data subject right of the individual (as listed above).

They can be contacted via the details below.

Email: info@odpa.gg

Address: Block A, Lefebvre Street, St Peter Port, GY1 2JP

Complainant may appeal failure to investigate or progress

An individual may appeal to the Court where:

The the Supervisory Authority has failed to give the complainant written notice that the complaint is being investigated or not within two months of receiving the complaint;

The Supervisory Authority has failed to provide written notice of the progress and, where applicable, the outcome of the investigation at least once within three months of providing notice of the beginning of an investigation; or

Where the individual seeks to appeal against a determination of the Supervisory Authority.

Lawful basis for processing

Where we are processing personal data, we do so lawfully and in all matters, one or more of the following conditions of the law will apply:

· The data subject has requested or given consent to the processing of personal data.

· The processing is necessary for the conclusion or performance of a contract to which the data subject is a party, or made between the controller and a third party in the interest of the data subject, or to take steps at the request of the data subject prior to entering into such a contract.

· The processing is necessary to protect the vital interests of the data subject or any other individual who is a third party.

· The processing is necessary for purposes of the legitimate interest of the controller or a third party.

· The processing is necessary for the exercise or performance by a public authority of a function that is of a public nature, or a task carried out in the public interest.

· The processing is necessary for the controller to exercise any right or power, or perform or comply with any duty, conferred or imposed on the controller by an enactment or an order or a judgment of a court or tribunal having the force of law in the Bailiwick.

· Where we are processing special category data, we do so lawfully and in all matters, one or more of the following conditions of the law will apply:

· The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

· The processing is necessary for the controller to exercise any right or power, or perform or comply with any duty, conferred or imposed on the controller by an enactment.

· The processing is necessary in order to comply with an order or a judgment of a court or tribunal having the force of law in the Bailiwick.

· The processing is necessary for a health or social care purpose and is undertaken by a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if the person were a health professional.

· The processing is necessary for reasons of public health.

· The processing is necessary, for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or the discharge of any functions of a court or tribunal acting in its judicial capacity, for the purpose of obtaining legal advice, or otherwise for the purposes of establishing, exercising or defending legal rights.

· The processing is necessary for, the administration of justice, or the exercise of any function of the Crown, a Law Officer of the Crown, the States or a public committee.

· The processing is necessary for a historical or scientific purpose.

· The processing is authorised by regulations made by the Committee for this purpose and carried out in accordance with those regulations, or authorised or required by any other enactment and carried out in accordance with the enactment.

· The data subject has given explicit consent to the processing of the personal data.

· The processing is necessary to protect the vital interests of the data subject or any other individual who is a third party, and the data subject is physically or legally incapable of giving consent, or the controller cannot reasonably be expected to obtain the explicit consent of the data subject.

P A Baudains Ltd Privacy Statement May 2024

Our privacy policy informs you of how P A Baudains Ltd uses the information you supply to us when using our website. We are committed to ensuring your privacy is protected. There may be times when we will ask you to provide us with personal information. This information will help us to identify you and your needs and will help us to serve you quickly and efficiently.

If we have collected sensitive information we will only use it for the purpose it is intended and will not pass it on to any 3rd party. We reserve the right, from time to time, to change this policy as situations may dictate. Please check this page before you use it to ensure you agree with our policy and that you are happy to continue. 

Fair Processing Notice – Data Protection Act 2018 (GDPR) Outline

a) All processing of personal data conducted by P A Baudains Ltd (the data controller), is fully compliant with both the Data Protection Act 2018 & Bailiwick of Guernsey equivalent 2018.

b) P A Baudains Ltd acknowledges its obligations as the data controller as per the data protection law 2018, which provides a number of requirements in terms of processing activities involving personal data.

c) Personal data must be processed lawfully, fairly and in a transparent manner. In order to provide our services, P A Baudains Ltd(the controller) collects personal data from data subjects who purchase online or over the phone.

d) None of the personal data collected for this purpose is classified as “Special Category Data” (the most sensitive data as defined by data protection law). The personal data that is collected for this purpose includes: Your email address, first name, last name, postal address, telephone number(s).

e) In terms of the lawful basis for processing this information, the controller would require the consent of the data subject to process their personal data in this way. By using this website and clicking on the I Accept button on the message on the bottom of the page you are giving P A Baudains Ltd your consent to process your data in order to facilitate your order.

F) As per data protection law, the data subject has the right to update or withdraw their consent & request a copy of the data held by P A Baudains Ltd.

For our full terms & conditions please click here. 

What we collect

P A Baudains Ltd may collect the following:

Name

Company Name

Postal Address

Email Address

Telephone Number(s)

Product(s) purchased

Your IP address

Location

Where do we use the information we gather?

The data you supply us will only be used to supply you with the selected goods and services you have chosen. It will also be used for fulfilment and billing.

The information is also necessary to provide you with the following.

Fulfilment of your order(s)

Improvement of our service to you

Keep a record for internal accountancy & bookkeeping

Advertising information in conjunction with Google & Bing

Security

We are committed to ensuring that the information you provide us with remains safe. To ensure that there is no unauthorised access to your details we have put in place the necessary procedures to protect the secure information we gather from you.

Links to other websites

There may be links to other websites of interest on the P A Baudains Ltd website. If you click on these links and leave our website please be aware that we do not have any control or access to them and therefore we will not be held responsible for your protection and privacy once on these sites. Please take the time to visit the relevant pages to find out their individual policies and terms.

Sharing your information

We may share information with third parties. This is for the purposes of fulfilling and delivering your order or to process warranty enquiries. We also share for the following reasons

Analysing data

Providing marketing assistance

Providing search results

Providing customer service

Please see below some of the third parties we may share your data with.

Couriers

Suppliers & manufacturers

Payment service providers

Marketing platform providers

Data analysis platform providers

External auditors

HM Revenue & Customs

Fraud prevention agencies

Regulators and other authorities

All of our third parties only have access to personal information needed to perform their functions, but they will not use it for other purposes. Furthermore, they must process the personal information in accordance with this Privacy Notice and as permitted by EU data protection laws. The data we collect from you via cookies when you use the P A Baudains Ltd website is retained and does not expire. It is used by us to enhance your experience when you are on the website and are always retained. They are only refreshed when you re-visit the website.