What Retailers Need to Know About Gift Voucher Fraud
09 Feb 2021Gift vouchers have always been a popular and convenient form of gifting. What’s more, with the continuation of coronavirus restrictions,
Gift vouchers have always been a popular and convenient form of gifting. What’s more, with the continuation of coronavirus restrictions,
Scope
Al personal and secure & confidential data handled by A1 Security Print Limited.
Policy Statement.
Under the new EUGDPR requirements A1 Security Print Limited are a processor for our client’s data and are registered with the Information Commissioners Office.
A1 Security Print Limited undertakes to only collect, store and use your personal information for defined purposes. At A1 Security Print Limited we take your privacy seriously and will only use your personal information to administer your account and provide the products and services you have requested from us.
A1 Security Print Limited will not sell your personal information. We will only share your personal data if required to by law, or in order to protect A1 Security Print Limited, its customers, or the public, or with companies that help A1 Security Print Limited fulfil its services to you, and then only with partners who share our commitment to protecting your privacy and data.
You may contact A1 Security Print Limited in writing to the Data Protection Officer Jim Richardson at A1 Security Print Limited, Camp Lane, Handsworth, Birmingham, B21 8JB with any privacy questions or concerns you may have.
You may ask at any time to see the personal data you have given us and request that we correct or delete it.
A1 Security Print Limited is committed to protecting the security of your personal data by the use of appropriate measures and processes throughout our business to meeting its data protection obligations; and being transparent about how it collects and uses that data.
What information does the Company collect?
The Company collects and processes a range of information about you. This includes:
The company also holds personal information about 3rd parties that you have provided to us for the purpose of fulfilling an order you have requested from us.
Personal data sent to us must be sent via secure means such as SFTP.
A log of how personal information is collected, stored and processed is kept by the company.
Data will be stored in a range of different places, including physically in and/or on job bags stored in secure ISO27001 accredited locations owned by A1 Security Print Limited; and digitally in ISO27001 and Cyber Essentials Plus accredited IT systems including our MIS.
Why does the Company process personal data?
The company needs to process data to administer your account and provide the products and services you have requested from us.
The company needs to process personal data provided by yourselves regarding 3rd parties in order to fulfil an order you have requested from us.
Who has access to data?
Your information may be shared internally amongst our CTC or SC Cleared staff for the purposes of fulfilling the product and services for which you have requested from us.
The Company will not transfer your data to countries outside the European Economic Area.
How does the Company protect data?
The Company takes the security of your data seriously. The Company has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.
Data stored and managed locally by A1 Security Print Limited sits on an IT Infrastructure that is within scope of the companies ISO27001:2013 Information Security certification and is independently audited by a UKAS accredited organisation. The internet facing infrastructure for A1 Security Print Limited Camp Lane and Summit Crescent locations including firewalls, routers and end user devices are Cyber Essentials Plus certified and independently assessed both internally and externally by a CREST-accredited organisation. The Company operates a strict access control policy with access rights granted on a ‘need to know’ basis.
Where the Company engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
For how long does the Company keep data?
A data classification & retention log is maintained for each data asset. Data will not be retained by A1 Security Print Limited for longer than is necessary in relation to the purpose for which is was originally collected, or for which it was processed.
The Company will hold personal information provided to us by you regarding 3rd parties for the purpose of fulfilling an order for the lifecycle of the production job unless requested otherwise.
How does the Company delete data?
The Company will manually delete personal information about you stored digitally in its MIS and securely shred personal information stored physically about you at the end of the retention period or upon request.
Data you provide to us digitally regarding a 3rd party for the purpose of fulfilling an order is destroyed securely using PGP shredder and physical data is securely shredded at the end of the retention period or upon request.
Your rights
As a data subject, you have a number of rights. You can:
If you would like to exercise any of these rights, please contact the Managing Director/Data Protection Officer, Jim Richardson.
If you believe that the Company has not complied with your data protection rights, you can complain to the Information Commissioner’s Office.
Subject access requests
You have the right to make a subject access request. If you make a subject access request, the Company will tell you:
The Company will also provide you with a copy of the personal data undergoing processing.
The Company will normally respond to a request within a period of one month from the date it is received. In some cases, such as where the Company processes large amounts of your data, it may respond within three months of the date the request is received.
The Company will write to you within one month of receiving the original request to tell them if this is the case.
If a subject access request is manifestly unfounded or excessive, the Company is not obliged to comply with it. Alternatively, the Company can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which the Company has already responded. If you submit a request that is unfounded or excessive, the Company will notify you that this is the case and whether or not it will respond to it.
Data breaches
If the Company discovers that there has been a breach of personal data that poses a risk to the rights and freedoms of individuals, it will report it to the Information Commissioner within 72 hours of discovery. The Company will record all data breaches regardless of their effect.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, it will tell affected individuals that there has been a breach and provide them with information about its likely consequences and the mitigation measures it has taken.
Data protection principles
The Company processes personal data in accordance with the following data protection principles: