Data Protection Policy

Whichwood Group Ltd is committed to protecting the privacy and security of personal data. We adhere to the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 to ensure that personal information is handled legally and transparently.

1. Purpose

This policy outlines how we collect, use, store, and protect personal data, ensuring that Whichwood Group Ltd complies with applicable data protection laws in the UK.

2. Scope

This policy applies to all personal data processed by Whichwood Group Ltd, including employees, customers, suppliers, and third-party partners. It covers any identifiable personal information, such as names, addresses, emails, phone numbers, and other sensitive data.

3. Data Collection

We only collect personal data that is necessary for our business operations, including but not limited to:

• Providing career advice and related services
• Processing job applications
• Communicating with users
• Conducting surveys and user feedback
• Marketing and service updates

4. Legal Basis for Processing

Whichwood Group Ltd processes personal data based on the following lawful grounds:

• Consent: We obtain explicit consent for processing specific data when required.
• Contractual obligations: Data is processed to fulfil contractual obligations, such as providing career services to users.
• Legal compliance: We may process data to comply with legal and regulatory requirements.
• Legitimate interests: In some cases, we process data to pursue the legitimate interests of our business, provided that these do not override the rights of data subjects.

5. Data Storage and Security

We take appropriate technical and organisational measures to secure personal data against unauthorised access, loss, or destruction. These include:

• Encrypting sensitive information.
• Restricting access to personal data to authorized personnel only.
• Regularly reviewing security measures to ensure their effectiveness.

6. Data Retention

Whichwood Group Ltd retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. After this period, the data is securely deleted or anonymised.

7. Rights of Data Subjects

Under the GDPR, individuals have the following rights regarding their personal data:

• Right to access: Individuals can request access to their personal data and receive a copy.
• Right to rectification: Individuals can request correction of inaccurate or incomplete data.
• Right to erasure: Individuals can request deletion of their personal data where there is no longer a legitimate reason for retention.
• Right to restrict processing: Individuals can request the limitation of processing under certain circumstances.
• Right to data portability: Individuals can request to transfer their personal data to another organisation.
• Right to object: Individuals can object to the processing of their personal data in certain situations.
• Right to withdraw consent: If consent was provided for processing, individuals have the right to withdraw it at any time.

8. Data Breaches

In the event of a data breach that poses a risk to individuals’ rights and freedoms, Whichwood Group Ltd will report the breach to the UK Information Commissioner’s Office (ICO) within 72 hours. Affected individuals will also be informed if there is a significant risk to their personal data.

9. Third-Party Data Sharing

We will not share personal data with third parties unless:

• We have obtained consent.
• It is required by law.
• It is necessary for fulfilling contractual obligations, such as with service providers who support our business.
  Any third parties with whom we share data must comply with data protection regulations and provide adequate safeguards to protect personal information.

10. Policy Updates

Whichwood Group will review and update this Data Protection Policy regularly to ensure it remains compliant with relevant data protection laws. Updates will be communicated to all employees and users.

11. Contact Information

For questions or concerns regarding this policy, or to exercise your rights under the GDPR, please contact us at:
Data Protection Officer
Whichwood Group
[email protected]