Record of Processing Activities Under Article 30 (GDPR)

Activities For Data Controllers

This Retention Policy describes how Methods Business and Digital Technology Limited and its subsidiaries and affiliates, to include Core Azure Limited (“collectively “Methods”), processes personal data. Methods recognises that Article 30 of the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (upon enactment) imposes documentation requirements on controllers and processors of data. This Policy is company confidential information, but Methods will provide it to the appropriate supervisory authority on request as required by Article 30.

Data Controller Details:

Name:                                       Methods Business and Digital Technology Limited

Address:                                   Saffron House, 6-10 Kirby Street, London, England, EC1N 8TS 

Telephone Number:                 +44(0)20 7240 1121

Website:                                    http://www.methods.co.uk/ http://www.coreazure.com/

Data Privacy Manager:            Mark Hewitt


Categories of Data Subjects

Methods collects personal data from the following categories of data subjects:

  • Methods’ customers.
  • Methods’ vendors or suppliers.
  • Methods’ employees and job applicants.

Categories of Personal Data

Methods collects the following categories of personal data about customers:

  • Personal details including name and contact information.
  • Device details.
  • Browser history details.
  • Location details.
  • Electronic identification data including IP address and information collected through cookies.
  • Financial details.
  • High Level Design, Low Level Designs, Configuration documentation.
  • Contractual details including the services provided.

Methods collects the following categories of personal data about employees and job applicants:

  • Personal details including name and contact information.
  • Date of birth.
  • Gender.
  • Marital status.
  • Beneficiary and emergency contact information.
  • Government identification numbers.
  • Education and training details.
  • Bank account details and payroll information.
  • Wage and benefit information.
  • Performance information.
  • Employment details.
  • Special categories of personal data, including data relating to an employee’s:
    • racial or ethnic origin;
    • religious or philosophical beliefs;
    • health.

Methods collects the following categories of personal data about vendors or suppliers:

  • Name and contact information.
  • Financial and payment details.
  • Device details.
  • User activity details and user preferences.
  • Browser history details.
  • Location details.
  • Electronic identification data including IP address and information collected through cookies.

Purposes of Data Processing

Methods collects and processes personal data about customers for the following purposes:

  • Maintaining and enhancing Methods’ services.
  • Providing services and customer management.
  • Account management.
  • Direct marketing.
  • Supporting network and system security.
  • Auditing.
  • Detecting and preventing fraud.
  • Complying with legal obligations.
  • Conducting web analytics.

Methods collects and processes personal data about employees and job applicants for the following purposes:

  • Recruitment and selection of employees.
  • Personnel management.
  • Workplace monitoring.
  • Human resources administration including payroll and benefits.
  • Complying with legal obligations and reporting requirements.
  • Education, training, and development activities.

Methods collects and processes personal data about vendors or suppliers for the following purposes:

  • To obtain products and services.
  • Vendor administration, order management, and accounts payable.
  • Evaluating potential suppliers.
  • Deliver Services.

Categories of Personal Data Recipients

Methods discloses personal data to the following categories of recipients, some of which may be located in third countries or may be international organisations as defined in Article 4(26) of the GDPR:

  • Methods’ parent company, subsidiaries, and affiliated entities.
  • Business partners.
  • Auditors and professional advisors, such as lawyers and consultants.
  • Law enforcement officials to include the police and Information Commissioner’s Office.
  • Third-party service providers, such as providers of:
    • IT system management;
    • information security;
    • human resources management;
    • payroll administration; or
    • Pension provision and administration
    • Health care provision

Methods makes limited personal data transfers subject to the second subparagraph of Article 49(1) which are necessary for Methods’ compelling legitimate interests. Methods provides appropriate safeguards for these limited personal data transfers through contractual clauses.

Personal Data Retention Periods

Except as otherwise permitted or required by applicable law or regulation, Methods only retains personal data for as long as necessary to fulfil the purposes Methods collected it for, as required to satisfy any legal, accounting, or reporting obligations, or as necessary to resolve disputes. To determine the appropriate retention period for personal data, Methods considers the amount, nature, and sensitivity of personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for processing the personal data, whether the employer can fulfil the purposes of processing by other means, and any applicable legal requirements.

Methods typically retains personal data for the periods set out below, subject to any exceptional circumstances or to comply with laws or regulations that require a specific retention period:

Information about customers:

  • personal details including name and contact information: 7 years;
  • family and lifestyle details: 7 years;
  • electronic identification data including IP address and information collected through cookies: 7 years;
  • contractual details including services provided: 7 years.

Information about employees and job applicants:

  • personal details including name and contact information: 7 years;
  • Recruitment – 6 months
  • Conditions of employment – 7 years after date of termination.

Payroll Administration:

  • Salary data: 7 years from the end of the financial year to which they relate.
  • Payroll data: 7 years from the end of the financial year to which they relate.
  • Individual employees personal payroll history: 7 years.
  • Pensions Administration: 7 years

Disciplinary:

  • Records of formal disciplinary actions in employee file. Retain both paper and electronic for review 3 years after last action
  • Grievances Records of formal grievances on employee file. Retain both paper and electronic for review 3 years after last action
  • Termination of employment Electronic: Records relating to individual employee files: Retain 3 years

Employee Files from date of leaving Methods:

  • date of birth: 3 years;
  • gender: 3 years;
  • beneficiary and emergency contact information: 3 years;
  • government identification numbers (passport, birth and marriage certificate etc.): 3 years;
  • education and training details: 3 years;
  • bank account details and payroll information: 7 years;
  • wage and benefit information: 7 years;
  • performance information: 3 years;
  • employment details: 3 years;
  • special categories of personal data, including information that relates to an employee’s racial or ethnic origin, political opinions and health: 3 years.

Information about vendors or suppliers:

  • name and contact information: 10 years;
  • financial and payment details: 10 years

Technical and Organisational Security Measures

Methods has implemented the following technical and organisational security measures to protect personal data:

  • Encryption of personal data.
  • Segregation of personal data from other networks.
  • Access control and user authentication.
  • Employee training on information security.
  • Written information security policies and procedures.

Changes to this Retention Policy

Methods reserves the right to amend this Retention Policy from time to time consistent with the GDPR and other applicable data protection requirements.

Effective Date:

5 April 2018

Last modified:

5 April 2018

Retention Policy

(FOR DATA PROCESSORS)

This Retention Policy describes how Methods processes personal data. Methods recognises that Article 30 of the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (upon enactment) imposes documentation requirements on controllers and processors of data.

 Data Processor Details:

Name:                                       Methods

Address:                                   Saffron House, 6-10 Kirby Street, London, England, EC1N 8TS 

Telephone Number:                 +44(0)20 7240 1121

Website:                                   www.methods.co.uk and www.coreazure.com

Data Privacy Manager:            Mark Hewitt

Categories of Processing

Data Processor processes personal data on behalf of its Customers and Suppliers for the following purpose(s):

  • Research and analytics.
  • Product development.
  • Direct marketing.
  • Professional and advisory services.
  • IT system management.
  • Information security.
  • Human resources management.
  • Payroll administration.
  • Pension plan administration.
  • Managed Services

Technical and Organisational Security Measures

Data Processor has implemented the following technical and organisational security measures to protect personal data:

  • Encryption of personal data.
  • Segregation of personal data from other networks.
  • Access control and user authentication.
  • Employee training on information security.
  • Written information security policies and procedures (ISO 27001 and Cyber Essentials).

Changes to this Retention Policy

Methods reserves the right to amend this Retention Policy from time to time consistent with the GDPR and other applicable data protection requirements.

Effective Date:

5 April 2018

Last modified:

5 April 2018

 

London

Saffron House, 6-10 Kirby Street, London, England, EC1N 8TS     

T. 020 7240 1121
E. info@methods.co.uk

Chelmsford

2nd Floor, Chelmsford Townfield House, 30-33 Townfield Street, Chelmsford, Essex, CM1 1QL

T. 020 7240 1121

Manchester

231-233 The Rise, Deansgate, M3 4EN
T. 020 7240 1121
E. info@methods.co.uk