Policies and
Certificates

Logistics UK (“the Company”) needs to process personal information (electronic or paper based) about customers, employees, and workers (associates and contractors) to support its operation. It is also necessary to process personal information about our staff and others who we encounter during our operations. In doing so, we recognise that the correct and lawful treatment of personal information is critical to maintaining the trust and confidence of those connected to us.

This policy, and any other documents referred to in it, sets out our approach to ensuring that we comply with data protection laws. It has been prepared and updated to take account of changes in the law introduced by the UK General Data Protection Regulation (the retained EU (European Union) law version of the General Data Protection Regulation (EU) 2016/679) (“GDPR”) and the Data Protection Act 2018 (“DPA”). A key change introduced is the principle of ‘accountability’ which requires us to demonstrate how we comply with data protection laws.

All employees must comply with our policies and procedures relating to data protection. This Policy does not form part of any employee’s contract of employment and may be amended at any time.

We are committed to processing personal data in accordance with the 6 key data protection principles outlined in the GDPR:

1. Lawfulness, fairness, and transparency

a. Transparency: We will tell data subjects how we will use their personal information.
b. Fairness: We will ensure that we process personal information fairly; only using that information for the purposes set out in our privacy information or in a way which is compatible with those purposes.
c. Lawfulness: we will ensure that we have identified a lawful basis for processing personal information.

2. Purpose limitationrness, and transparency

Personal data will only be obtained for “specified, explicit and legitimate purposes.” Personal Data will only be used for a specific processing purpose that the data subject has been made aware of.

3. Data minimisation 

Personal data collected about a data subject will be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.”

4. Accuracy

We will develop processes and protocols that support data being “accurate and where necessary kept up to date.”

5. Storage limitations

Personal data will be “kept in a form which permits identification of data subjects for no longer than necessary.”

6. Integrity and confidentiality

We are committed to handling data “in a manner ensuring appropriate security of the personal data including protection against unlawful processing or accidental loss, destruction or damage.”

We have appointed an internal data protection contact to deal with 1st line enquiries, all enquiries should be first made to our data protection contact, who can be contacted through Logistics UK using the email address [email protected].

Everybody has a responsibility to ensure compliance with the GDPR and DPA. As part of our commitment to ensuring that we comply with our data protection obligations, particularly the principal of accountability, the Company has established where responsibilities are assigned:

• ensure that a suitably qualified DPO is appointed.
• include budget and resources needed to ensure compliance at all levels.
• comply with all reasonable directions from the DPO to promote effective data protection practices.
• ensure that staff receive appropriate training at reasonable internals in relation to data protection.
• ensure that the appropriate policies and procedures are implemented which demonstrate
• how the Company complies with its data protection obligations.
• ensure that Privacy Notices are readily available.
• ensure that an Article 30 register is held and kept up to date.
• ensure that data protection impact assessments are undertaken when required.

• support the board to comply with its responsibilities.update and maintain data protection policies and procedures.
• provide advice in respect of data protection impact assessments.
• update privacy notices.
• investigate and report on data breaches.
• provide advice and support across the Company on all matters which impact on individual rights.
• Provide training to ensure that staff are aware of the GDPR and how it affects them.

• liaise with the ICO (Information Commissioners Office) in relation to all compliance matters.
  provide advice and support to the internal data protection contact on all matters which impact on individual rights.
• review Data Protection Impact Assessments (DPIA’s) which identify risks surrounding individual systems.
• assist in compiling, and reviewing the Article 30 registers which details what data is processed by our systems and how.
• The internal data protection contact will investigate and report on data breaches, they will also oversee compliance, liaise with regulatory bodies, and provide legal guidance in significant breach cases.

• observe data protection policies, procedures and guidance implemented by the Company.
  understand the purposes for which the Company uses personal information.
  collect and process appropriate information in accordance with the purposes for which it is to be used.
• ensure that information is correctly input into systems.
• ensure that information is destroyed (in accordance with our retention procedures) when it is no longer required.
• on receipt of a request from an individual or organisation for information held about them or another data subject, immediately notify the DPO in accordance with the subject access procedure.
• attend training when required to do so.
• understand that breaches of this Policy Statement may result in disciplinary action, including dismissal.

We have appointed an internal data protection contact to deal with 1st line enquiries, all enquiries should be first made to our data protection contact, who can be contacted through Logistics UK using the email address [email protected].

This policy will be implemented and supported through the development of a data protection framework comprising of 2 elements:

This policy will be implemented and supported through the development of a data protection framework comprising of 2 elements:

Step by step instructions to achieve a given aspect of the standards.

The Standards outline the actions that will be taken to implement the data protection policy and cover the following areas of data protection: –

S1: Lawfulness, fairness, and transparency

• We will conduct information audits at appropriate intervals and maintain a record of processing activities in compliance with Article 30 of the GDPR (“the Record”)
• The Record will document the personal data processes undertaken, its purpose, where it comes from and who we share data with
• We will identify the lawful bases for processing and document it in the Record.
• We will keep a record of consent.
• Where we rely on legitimate interests as the lawful basis for processing, we will apply the three-part test and demonstrate that we have considered and protected individual’s rights and interests.
• We will register with the Information Commissioners Office.

S2: Individual Rights

• We will provide privacy information to individuals.
• We will communicate privacy information in a way that is clearly understood and accessible.
• We will have a process to recognise and respond to individual requests to access their personal data.
• We will have processes in place to ensure that the personal data we process remains accurate and up to date.
• We will have processes in place to securely dispose of personal data that is no longer required or where an individual has asked us to erase it.
• We will have procedures to respond to an individual’s request to restrict the processing of their personal data.
• We will have procedures to allow individuals (where applicable) to move, copy or transfer their personal data from one IT environment to another in a safe and secure way, without hindrance to usability.
• We will have procedures to handle an individual’s objection to the processing of their personal data.

S3: Accountability and governance

• We will have a data protection policy.
• The data protection policy will be supported by a framework which details how we will respond to subject access requests, handle data breaches, provide privacy information and how long we will retain personal data.
• We will provide data protection awareness training for all staff.
• We will have written contracts with any processors that we use.
• An Article 30 register will be maintained.
• We will use the principles of ‘Data protection by Design and Default’ and implement appropriate technical and organisational measures to integrate data protection into our processing activities.
• We will conduct Data Protection Impact Assessments (DPIAs)
• We will have a nominated Data Protection Officer (DPO)
• Decision makers and key people will demonstrate support for data protection legislation and promote a positive culture of data protection compliance across the Company.

S4: Information security

• We will identify, assess, and manage information security risks.
• We will have established written agreements with third-party processors that ensure the personal data that they access and process on our behalf is protected and secure.
• We will ensure that we have an adequate level of protection for any personal data processed by others on our behalf that is transferred outside the European Economic Area.

S5: Physical Security

• We will have entry controls to restrict access to premises and equipment to prevent unauthorised physical access, damage, and interference to personal data.
• We will have secure storage arrangements to protect records and equipment to prevent loss, damage, or theft of personal data.
• We will have a process to securely dispose of records and equipment when no longer required and this will be done safely such that the data is irrecoverable.