Your personal data – what is it?
‘Personal data’ is any information about a living individual (known as a ‘data subject’) which allows them to be identified from that data.
The processing of personal data is governed by strict legislation including the General Data Protection Regulation (the ‘GDPR’). This summary should be read in conjunction with the full version, the SVL Data Protection Policy and the SVL Mobile Devices Policy (available on request).
Who are we?
This Data Privacy Notice is provided to you by Specialist Vehicle Logistics Ltd (SVL), a private company specialising in vehicle fleet management services for business customers. Mostly, SVL is the data processor, but sometimes it is the data controller.
When processing or controlling personal data SVL works with:
For customers, other business-based data processors or controllers such as fleet management agencies working on behalf of our corporate customers, direct with corporate and other business customers who have vehicle fleets, car and van dealerships and service providers such as trade plated drivers, vehicle transporters, repair and servicing garages and body shops.
We may also hold and process personal data relating to business product and business services providers.
For staff, employee and internal sub-contractor matters, other data controllers, such as local and public authorities, central government agencies such as HMRC and DVLA; pension, professional and payroll services providers, and recruitment agencies.
We may need to share personal data we hold with other data controllers or data processors with which we work so that they can carry out either their legal responsibilities or legitimate business interests.
SVL will comply with data protection law. This says that the personal data we hold about you must be used lawfully, collected only for valid purposes, be accurate and kept up to date, kept only as long as necessary and when appropriate, destroyed securely
If you have any questions about the use of your data or wish to exercise any of your rights (as explained below) or wish to raise a complaint, you should do so directly to the relevant data controller or processor.
SVL will process or control some or all of the following personal data where necessary to conduct its business operations:
As a processor of customer and other business contact data:
SVL works only for business customers so any personal data processed will only relate to staff, employees or other individuals working for or on behalf of our business customers in a business-related capacity.
Personal data is therefore provided for us to process by one or more of the other business-based data processors or controllers listed above in order to complete instructions related to pursuance of our joint legitimate business interests.
We never collect, control or process any personal data from private individuals; ie. if not related to the pursuing of a legitimate business customer-based reason to use SVL services. The personal data processed is the minimum required to provide our services professionally and in line with our contractual and legal obligations including data protection.
As a controller and processor of staff, employee and sub-contractor data:
As an employer and in the engagement of internally based sub-contractors we may collect, control and process personal data about you including full information to correctly identify you, contact details, next of kin/emergency contact, information such as gender, age, marital status, nationality, education/work history, academic or professional qualifications, training completed, driving licence and driving history and forms of identification.
We may also collect non-financial identifiers such as passport and driving licence numbers, financial identifiers such as bank account numbers, national Insurance number and tax code, and operational personal data such as CCTV footage, IP addresses and website visit histories.
The personal data we control and/or process may include sensitive or other special categories of personal data such as criminal convictions, racial or ethnic origin and mental and physical health. In limited circumstances, we may approach you for your written consent to allow us to process certain sensitive personal data. We may only use personal data relating to criminal convictions where the law allows us to do so.
We may also use your personal data for other purposes, primarily to allow us to perform our contract with you and to enable us to comply with legal obligations.
What is the legal basis for processing your personal data?
As for most businesses, a number of different lawful bases apply at the same time and for different types of data subject. We will often be performing a task under a mix of legal obligation, in the exercise of a statutory obligation and as a result of contractual necessity.
Sharing your personal data:
Whether as a customer, employee or sub-contractor, it is likely that we will need to share your data with some or all of the following (but only where necessary):
As a processor of customer and other business contact data:
In principle your personal data will only be shared with other third parties where it is necessary for the performance of their tasks.
As a controller and processor of staff, employee and sub-contractor data:
In principle your personal data will only be shared with other third parties where it is necessary for the performance of their tasks, or where necessary, you first give us your prior consent.
How long do we keep your personal data?
As a processor of customer and other business contact data:
We process two broad types of customer personal data: data that enables us to deliver our prime customer service of vehicle collection and delivery and data that relates to other customer activities and other business contacts with whom SVL, its employees, staff, sub-contractors and agents work with on an ongoing basis.
This means some records with personal data only need to be kept for a short time, but we may keep some other records for an extended period of time and some we will keep permanently if we are legally required to do so. In general, we will endeavour to keep your personal data only for as long as we need it, which means that other than as defined in this Data Privacy Notice we will delete it when it is no longer needed.
As a controller and processor of staff, employee and sub-contractor data:
Once employed or engaged by SVL as a sub-contractor, it is probable the we will need to keep some records including your personal data permanently, especially if we are legally required to do so.
We may keep some other records for an extended period of time, such as accounting and payroll records for which it is currently required that we keep financial records for a minimum period of 7 years to support HMRC audits or provide tax information.
In general, we will endeavour to keep data only for as long as we need it. This means that means that other than as defined in this Data Privacy Notice we will delete it when it is no longer needed.
Your rights and your personal data:
You have the following data subject rights with respect to your personal data: When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for your security.
- The right to access personal data we hold on you.
- The right to correct and update the personal data we hold on you.
- The right to have your personal data erased.
- The right to object to processing of your personal data or to restrict it to certain purposes only.
- The right to data portability.
- If your personal data is being held on the grounds of consent, you have the right to withdraw your consent at any time.
- The right to lodge a complaint either to SVL at the contact details below or with the Information Commissioner’s Office.
Transfer of data abroad
Although SVL operations are entirely within the United Kingdom of Great Britain and Northern Ireland, we deal with many corporate customers who have offices outside the UK. SVL will make every effort to ensure that any personal data transferred to countries or territories outside the European Economic Area (EEA) will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the European Union.
Further processing:
If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.
How do we ensure data security and the ability to meet any data subject rights for the personal data that we process or control?
SVL has policies, systems and processes in place to securely and safely receive, capture, record, store and when necessarily, appropriately destroy and/or delete personal data gained as a result of its business activities as outlined in this Data Privacy Notice.
Should any member of staff become aware that personal data has not been controlled or processed in line with this notice, ie. that a data breach has occurred or weaknesses in the system have been identified to make personal data subject to security vulnerability, they are contractually obliged to immediately ensure that management is made aware of the breach or security risk so that the appropriate actions can be implemented.
SVL aims to conduct an annual data audit exercise to ensure it is meeting the personal data management and protection terms of this Data Privacy Notice.
As a processor of customer and other business contact data:
SVL processes customer and other business contact personal data as described in this notice as part of its business activity with appropriate data security and record keeping.
As a controller and processor of staff, employee and sub-contractor data:
SVL captures, controls and processes personal data as described in this notice as part of its recruitment, employment/engagement and cessation of employment/engagement with appropriate data security and record keeping.
Changes to this notice:
We keep this Data Privacy Notice under regular review in line with our business management processes.
Contact details
Please contact us if you have any questions about this Data Privacy Notice. The SVL Data Protection Officer contact details are:
John Blackwell, Managing Director, Specialist Vehicle Logistics Ltd
Units 3-4 Burnt Tree Industrial Estate, Groveland Road. Tividale. DY4 7UD
Tel: 0121 792 9020 Email: info@svl.org.uk