Privacy & Data Protection Policy

Change of purpose

We will only use personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. We encourage individuals wishing to know how processing the data for the new purpose is compatible with the original purpose to contact us.

If we need to use personal data for an unrelated purpose, we notify the individuals concerned and explain the legal basis which allows us to do so. We may process personal data without the knowledge or consent of the subject, in compliance with the above rules, where this is required or permitted by law.

Disclosure

We may have to share personal data with the following parties for the purposes set out in the table presented above:

External third parties, including:

• Service providers acting as processors based in the UK and overseas which provide IT and system administration services.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the UK, USA and all countries in which we operate who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the United Kingdom and overseas territories who require processing activities to be reported in certain circumstances.

Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change to our business takes place, then the new owners may use the personal data we have gathered in the same ways described in this privacy policy.

We require all third parties to respect the security of personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use personal data for their own purposes and only permit them to process personal data for specified purposes and in accordance with our instructions.

Data security

We have put appropriate security measures in place to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. ORB has Cyber Essentials Plus accreditation. Cyber Essentials is a UK Government-backed and industry-supported scheme that helps businesses protect themselves against the growing threat of cyber attacks and provides a clear statement of the basic controls organisations should have in place to protect themselves.

Cyber Essentials Plus accreditation, is the highest level of certification offered under the Cyber Essentials scheme. Cyber Essentials Plus requires a more rigorous test of an organisation’s cyber security systems where our cyber security experts carry out vulnerability tests to make sure that your organisation is protected against basic hacking and phishing attacks.

Much of our work involves collecting data from the field using tablets. Our approach to data protection during this process is set out in our Data and Tablet Security Statement:

Tablet & Data Security Statement

Purpose of this Document

This statement provides an overview of our approach to ensuring the security of the data we collect during fieldwork. This includes security aspects software we use to collect data, how the data is securely stored and deleted after use, back-ups and interviewer training.

Sending and Receiving Data

Our tablets for data collection are programmed with SurveyToGo Software. SurveyToGo enables our interviewers in the field to collect data and send it remotely to the SurveyToGo Data Centre. This involves two-way communications over the internet to both send survey data to the tablet and receive collected data from the tablet. Network security measures are in place to ensure network communication both to and from the Data Centre is secure along with communications between servers in the Data Centre. SurveyToGo uses SSL encryption to encrypt the tablet/server communications and management app/server communications. The Data Centre uses certified SSL Certificates to ensure tablets can validate and authenticate the server they are communicating with to prevent ‘man in the middle’ attacks along with eavesdropping risks. Any incoming communication to the Data Centre passes through a dedicated Check Point Firewall product to prevent network attacks.

Uploading Data and Data Storage

The SurveyToGo Data Centre servers are hosted by Amazon AWS. All servers include a mandatory antivirus protection and are configured to receive any security OS update as required. Our general approach to the security of the collected data is to upload the data to the servers and remove it from the device as quickly as possible. Shorter time on the device means lower data security risks. The tablet application stores all data in a special storage segment provided by the Operating System. This segment is secured from access by other applications. Even accessing the device through USB mass-storage interface will not allow the operator access to this storage area. Through this enhanced security mechanism, the data is saved in a local database on this secured storage segment. Whenever a network is detected, all data is uploaded from the tablet application to the server and deleted from the device. The last user who used the app is cached locally to allow for quick access and continue to collect data even in offline scenarios, however the password is encrypted. Communication to and from the server is secured by SSL Encryption.

Backups

Data stored in the SurveyToGo system, is redundantly stored in multiple physical locations as part of normal operation of those services. Data removed from the system by ORB are physically deleted from the servers and backups.

Accessing Data

All access to the SurveyToGo system is done with a user and a password. Each project member who will use the software is assigned a role which controls their access to the system. The role contains the permissions to the data contained within the different project components. For each component, the user’s access is configured as either none / read / write or full access.

Interviewer Training

All interviewers and supervisors are assigned a tablet, assigned a username and password and provided with training on using the software to collect and upload the data. Interviewers are instructed not to use the tablets for any other purposes, to only use the devise they have been assigned and not to let anyone else use their tablet.

Lost / Stolen Tablets

In the event that a device is lost or stolen interviewers are instructed to inform their supervisor immediately who will inform the fieldwork manager and ORB. The tablet is then disabled which prevents any access from the device to the account and any tampering with the data

Data retention

We will only retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of this data, the purposes for which we process the data and whether we can achieve these same purposes through other means, and the applicable legal requirements.

By law and for tax purposes, we have to keep basic information about our customers and suppliers (including Contact, Identity, Financial and Transaction Data) for at least six years after they cease being customers or suppliers. In some circumstances, customers and suppliers can ask us to delete their data: see ‘Request erasure’ below for further information.
In some circumstances we may anonymise personal data (so that it can no longer be associated with the individuals concerned) for research or statistical purposes in which case we may use this information indefinitely without further notice to the data subjects.

Legal rights

Under certain circumstances, individuals have rights under data protection laws in relation to their personal data. These include the right to:

Request access to personal data (commonly known as a “data subject access request”). This enables individuals to receive a copy of the personal data we hold about them and to check that we are lawfully processing it.

Request correction of the personal data that we hold. This enables petitioners to have any incomplete or inaccurate data corrected, although we may need to verify the accuracy of the new data provided.

Request erasure of personal data. This enables individuals to ask us to delete or remove personal data where there is no good reason for us to continue processing it. Data subjects also have the right to ask us to delete or remove their personal data in cases where:

• They have successfully exercised their right to object to processing (see below);
• We may have processed their information unlawfully;
• We are required to erase their personal data in order to comply with local law.

We may not always be able to comply with a request for erasure for specific legal reasons which will be communicated to the individuals concerned, if applicable, at the time of their request.

Object to processing personal data where we are relying on a legitimate interest (or those of a third party) and there is something about a person’s particular situation which makes them want to object to processing on this ground since they feel that it impacts on their fundamental rights and freedoms. Individuals also have the right to object when we are processing personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process this information which override these rights and freedoms.

Request the processing of personal data to be restricted. This enables individuals to ask us to suspend the processing of their personal data in the following scenarios:

a) They want us to establish the accuracy of the data;
b) Our use of the data is unlawful but they do not want us to erase it;
c) They need us to hold the data even if we no longer require it as they need it to establish, exercise or defend a legal claim; or
d) They have objected to our use of their data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of personal data to the individual concerned or to a third party. We will provide individuals, or designated third parties, with personal data in a structured, commonly used, machine-readable format. This right applies only to automated information which the data subjects initially gave us consent to use or where we used the information to perform a contract with the individuals concerned.

Withdraw consent at any time where we are relying on consent to process personal data. However, this does not affect the lawfulness of any processing carried out before consent is withdrawn.

Individuals who wish to exercise any of the rights set out above are encouraged to contact us at info@orb-international.com

Fees

Petitioners will not usually be asked to pay a fee to access their personal data (or to exercise any of their other rights). However, we may charge a reasonable fee if a request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with a request in these circumstances.

Requirements

We may need to request specific information from individuals in order to help us confirm their identity and ensure their right to access their personal data (or to exercise any of their other rights). This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it. We may also contact individuals to ask for further information about their request in order to expedite our response.

Response times

We try to respond to all legitimate requests within one month. This timeframe may be exceeded if a request is particularly complex or if an individual has made a number of requests. In these cases, we will notify the individuals concerned and keep them updated.

Governance

ORB’s Managing Director and senior managers take responsibility for implementing this policy statement and its objectives and for providing adequate resources (training, etc.) to ensure that ORB complies with the policy.