Privacy Policy

---

GDPR Policy

1. Introduction

This General Data Protection Regulation (GDPR) Policy outlines the procedures and guidelines that Core Financial Efficiencies Limited adheres to in order to ensure compliance with the GDPR regulations. The GDPR imposes strict requirements on how personal data is collected, processed, stored, and shared, with the aim of protecting the rights and privacy of individuals within the United Kingdom, European Union (EU) and the European Economic Area (EEA).

2. Scope

This policy applies to all employees, contractors, and third-party service providers who handle personal data on behalf of Core Financial Efficiencies Limited, regardless of their location or the location of the data subjects.

3. Principles of Data Protection

Core Financial Efficiencies Limited is committed to upholding the following principles of data protection as outlined in the GDPR:

- Lawfulness, fairness, and transparency: Personal data must be processed lawfully, fairly, and in a transparent manner.

- Purpose limitation: Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

- Data minimisation: Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

- Accuracy: Personal data must be accurate and, where necessary, kept up to date.

- Storage limitation: Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

- Integrity and confidentiality: Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

4. Data Protection Officer (DPO)

Core Financial Efficiencies Limited has appointed a Data Protection Officer (DPO) who is responsible for overseeing the company’s data protection strategy and ensuring compliance with the GDPR. Employees and data subjects can contact the DPO with any questions or concerns regarding the processing of personal data.

5. Data Collection and Processing

- Core Financial Efficiencies Limited will only collect personal data that is necessary for the purposes for which it is being processed.

- Personal data will be collected directly from data subjects whenever possible. When collecting data indirectly, Core Financial Efficiencies Limited will ensure that data subjects are informed of the collection and processing activities.

- Personal data will only be processed with the consent of the data subject or when there is another legal basis for processing, such as contractual necessity, legal obligation, or legitimate interests.

- Core Financial Efficiencies Limited will maintain accurate records of all personal data processing activities, including the purposes of processing, categories of data subjects, and any third-party recipients of the data.

6. Data Security

- Core Financial Efficiencies Limited will implement appropriate technical and organizational measures to ensure the security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

- Access to personal data will be restricted to employees who require access for legitimate business purposes. All employees with access to personal data will receive training on data protection and security.

- Personal data will be encrypted when transmitted electronically and stored securely using encryption or pseudonymization techniques.

- Core Financial Efficiencies Limited will regularly review and update its data security measures to ensure they remain effective against emerging threats and vulnerabilities.

7. Data Subject Rights

- Data subjects have the right to request access to their personal data held by Core Financial Efficiencies Limited and to request the correction, erasure, or restriction of processing of their personal data.

- Data subjects also have the right to object to the processing of their personal data and to data portability, whereby they can request a copy of their personal data in a commonly used format.

- Core Financial Efficiencies Limited will respond to data subject requests in a timely manner and will provide information on any actions taken in response to such requests.

8. Data Breach Response

- In the event of a personal data breach, Core Financial Efficiencies Limited will promptly assess the severity of the breach and take appropriate action to mitigate any adverse effects on affected data subjects.

- Where required, Core Financial Efficiencies Limited will notify the relevant supervisory authority and affected data subjects of the breach within the timeframes specified in the GDPR.

- Core Financial Efficiencies Limited will maintain records of all data breaches, including details of the breach, its impact, and any remedial actions taken.

9. Third-Party Processing

- When engaging third-party service providers to process personal data on behalf of Core Financial Efficiencies Limited, appropriate data processing agreements will be put in place to ensure that the third party complies with the GDPR requirements.

- Third-party processors will only be engaged if they can provide sufficient guarantees of their compliance with the GDPR and the security of personal data.

10. Training and Awareness

- Core Financial Efficiencies Limited will provide regular training and awareness programs for employees on data protection principles, GDPR requirements, and their responsibilities under this policy.

- Employees will be encouraged to report any potential data protection issues or breaches to the DPO or their line manager.

11. Policy Review

- This GDPR Policy will be reviewed and updated as necessary to ensure continued compliance with the GDPR and any relevant changes in legislation or best practices.

- Employees will be notified of any updates to this policy and provided with training on any changes that affect their responsibilities.

12. Conclusion

Core Financial Efficiencies Limited is committed to ensuring the protection of personal data in accordance with the GDPR and will continuously strive to improve its data protection practices and procedures.

Policy Owner: Core Financial Efficiencies Limited

Date of Approval: 13/06/2024

Date of Last Review: 27/06/2024