Privacy Policy

General Data Protection Regulation

Hey Little Cupcake

Appointed Data Protection Officer : Roger Gibbons - Operations Manager

HLC Data Protection Policy :

As part of our operations, we need to obtain and process information. This information includes any offline or online data that makes a person identifiable such as names, addresses, email addresses

Our company collects this information in a transparent way and only with the full cooperation and knowledge of our customers. Once this information is available to us, the following rules apply.

Our data will be:
• Accurate and kept up-to-date
• Collected fairly and for lawful purposes only
• Processed by the Hey Little Cupcake within its legal and moral boundaries
• Protected against any unauthorised or illegal access by internal or external parties

Our data will not be:
• Communicated informally
• Stored for more than a specified amount of time
• Transferred to other organisations that do not have adequate data protection policies
• Distributed to any party other than the ones agreed upon by the data’s owner.

In addition to ways of handling the data the Hey Little Cupcake has direct obligations towards people to whom the data belongs. Specifically we must:

• Let people know which of their data is collected
• Inform people about how we’ll process their data
• Inform people about who has access to their information
• Have provisions in cases of lost, corrupted or compromised data
• Allow people to request that we modify, erase, reduce or correct data contained in our databases
Actions - To exercise data protection we’re committed to:

• Restrict and monitor access to sensitive data
• Develop transparent data collection procedures
• Train employees in online privacy and security measures
• Build secure networks to protect online data from cyberattacks
• Establish clear procedures for reporting privacy breaches or data misuse
• Include contract clauses or communicate statements on how we handle data
• Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorization etc.)

Data processing activities

• Email Addresses/telephone number to confirm order and contact a customer
>Written down on an order form > filed away in a Diary > Taken to the kitchen to process order > File order form for a maximum of a month > Shredded at Staples Regent Road Manchester.
• Bank Card details to take payment over the phone >Written down on an order form to take payment once a phone call has ended > order form filed for a maximum of a month > Shredded at Staples Regent Road Manchester
• Staff Sort code and Account numbers to process payroll. > Processed all on-line using Citation, Atlas. Secure and can be deleted by user at any time.
• Staff Personal Information for Accountant > National insurance, bank details to be held by JOTFORMEU.COM
• Website Traffic Information

>Volume of people visited > What pages they clicked on > What area they're from.

Information asset register/data inventory the data used retention periods where the data is shared Email - 1 Month - Not shared
Bank Details - 1 Month - Not shared
Staff Bank Details Throughout employment - Between Employee and Employer
Personal Information Throughout employment - Between Employee and Employer

Training and awareness
Monthly review of staff knowledge and Data Protection policy. Ensuring staff have an understanding of their rights and the rights of others.
Communicate fair processing notices/privacy notices All employees to inform customers and staff of where and how their personal data will be used and how long for and when it will be deleted or destroyed.

Subject Access Request
Customers/Businesses that request data/information relating to them must be dealt with within a set time frame of 2 weeks. A request to remove their personal data on any of our systems must be completed within this time frame.

Data breach reporting
Ensuring all data breaches are reported to the Information Commissioner’s Office - 0303 123 1113
Review ICO/DPC website
Employers at Hey Little Cupcake to have access to : ico.org.uk - Information Commissioner’s Office