PRIVACY & COOKIE POLICY

Data Protection, Information and Cyber Security and Privacy Policy

Fishbone Solutions (a trading name of Project REM Limited, company number 7929776) needs to gather and use certain information about Data Subjects. It is important to our staff and customers that Fishbone has a robust policy around data privacy and security which outlines our approach to data protection, and that the cyber security requirements of our IT system are put in place and adhered to.

Data the business uses can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.

This policy describes how personal data must be collected, handled and stored to meet the company’s data protection standards, and to comply with the law.

Fishbone recognises the importance of information security to ensure business continuity and minimise business damage by preventing and reducing the impact of security breaches. This policy details the cyber security steps in place to ensure business continuity and what recovery measures are in place in the event of a breach or similar business affecting issue.

1. Introduction

1.1 Why This Policy Exists

This data protection policy ensures Fishbone Solutions:

complies with data protection law and follows good practice;
protects the rights of staff, customers and partners;
is open about how it stores and processes Data Subjects’ data;
protects itself from the risks of a data breach; and
can recover swiftly in the event of a loss of business continuity.

1.2 Data Protection Law

The Data Protection Act 1998 and the General Data Protection Regulation describe how organisations, including Fishbone Solutions, must collect, handle and store personal information.

These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.

The Data Protection Act is underpinned by eight important principles. These say that personal data must:

be processed fairly and lawfully;
be obtained only for specific, lawful purposes;
be adequate, relevant and not excessive;
be accurate and kept up to date;
not be held for any longer than necessary;
be processed in accordance with the rights of Data Subjects;
be protected in appropriate ways; and
not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection.

Fishbone Solutions will keep and process limited data in accordance with the requirements of the Fishbone Solutions Quality Manual (ISO9001:2015).

1.3 Data Subject

A Data Subject is someone whose personal details we keep on file.

1.4 Lawful Processing

The legal basis and authority for collecting and processing data at Fishbone Solutions are:

consent obtained from a Data Subject;
performance of a contract where the Data Subject is a party to the contract;
compliance with a legal obligation;
to protect the vital interests of the Data Subject or other associated person;
to carry out the processing that is in the public interest and/or official authority; and
it is necessary for the legitimate interests of the data controller or third party in accordance with national law.

2. Data Protection Policy

2.1 Policy Scope

This policy applies to:

the head office of Fishbone Solutions;
all staff, management team and directors of Fishbone Solutions; and
all contractors and other people working on behalf of Fishbone Solutions.

It applies to all data that the company holds relating to identifiable Data Subjects, even if that information technically falls outside of the Data Protection Act 1998 and the General Data Protection Regulation. This can include:

names of Data Subjects;
postal addresses;
email addresses; and
telephone numbers.

2.2 Data Protection Risks

This policy helps to protect Fishbone Solutions from some very real data security risks, including:

breaches of confidentiality — for instance, information being given out inappropriately;
failing to offer choice — for instance, all Data Subjects should be free to choose how the company uses data relating to them; and
reputational damage — for instance, the company could suffer if hackers successfully gained access to sensitive data.

2.3 Responsibilities

Everyone who works for or with Fishbone Solutions has some responsibility for ensuring data is collected, stored and handled appropriately. Each team that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles.

However, these people have key areas of responsibility:

The board of directors is ultimately responsible for ensuring that the Company meets its legal obligations.

The data protection officer, Mark Gadsby, is responsible for:

keeping the board updated about data protection responsibilities, risks and issues;
reviewing all data protection procedures and related policies, in line with an agreed schedule;
arranging data protection training and advice for the people covered by this policy;
handling data protection questions from staff and anyone else covered by this policy;
dealing with requests from Data Subjects to see the data Fishbone Solutions holds about them (also called ‘subject access requests’); and
checking and approving any contracts or agreements with third parties that may handle the company’s sensitive data.

The IT manager is responsible for:

ensuring all systems, services and equipment used for storing data meet acceptable security standards;
performing regular checks and scans to ensure security hardware and software is functioning properly;
evaluating any third-party services the company is considering using to store or process data — for instance, cloud computing services; and
ensuring that a disaster recovery management plan is in place and regularly reviewed to ensure there is minimal risk of data loss and business continuity in the event of an issue such as a data breach.

The marketing manager is responsible for:

approving any data protection statements attached to communications such as emails and letters;
addressing any data protection queries from journalists or media outlets like newspapers; and
where necessary, working with other staff to ensure marketing initiatives abide by data protection principles.

2.4 General Staff Guidelines

the only people able to access data covered by this policy should be those who need it for their work;
data should not be shared informally — when access to confidential information is required, employees can request it from their line managers;
Fishbone Solutions will provide training to all employees to help them understand their responsibilities when handling data;
employees should keep all data secure, by taking sensible precautions and following the guidelines below;
in particular, strong passwords must be used and they should never be shared;
personal data should not be disclosed to unauthorised people, either within the company or externally;
data should be regularly reviewed and updated if it is found to be out of date — if no longer required, it should be deleted and disposed of; and
employees should request help from their line manager or the data protection officer if they are unsure about any aspect of data protection.

2.5 Data Storage

Fishbone Solutions data retention policies are governed by our ISO9001:2015 Quality Manual. Regarding personal data, the following rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT manager or data controller.

When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it. These guidelines also apply to data that is usually stored electronically but has been printed out for some reason. Fishbone Solutions operates a paperless environment — all paper or files are scanned and stored on the secure server. Data printouts will be shredded and disposed of securely when no longer required.

employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer;
when data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts;
data should be protected by strong passwords that are changed regularly and never shared between employees;
if data is stored on removable media (like a CD or DVD), these should be kept locked away securely when not being used;
data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing service;
data should be backed up frequently — those backups should be tested regularly, in line with the company’s standard backup procedures;
data should never be saved directly to laptops or other mobile devices like tablets or smart phones; and
all servers and computers containing data should be protected by approved security software and a firewall.

2.6 Data Use

Personal data is of no value to Fishbone Solutions unless for specific purposes contributing to the operation of the Company. However, the greatest risk of loss, corruption or theft occurs when personal data is accessed and used. To this end:

when working with personal data, employees should ensure the screens of their computers are always locked when left unattended;
personal data should never be transferred outside of the European Economic Area; and
employees should not save copies of personal data to their own computers — always access and update the central copy of any data.

2.7 Data Accuracy

The law requires Fishbone Solutions to take reasonable steps to ensure data is kept accurate and up to date. The more important it is that the personal data is accurate, the greater the effort Fishbone Solutions should put into ensuring its accuracy.

It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.

data will be held in as few places as necessary — staff should not create any unnecessary additional data sets;
staff should take every opportunity to ensure data is updated;
Fishbone Solutions will make it easy for data subjects to update the information Fishbone Solutions holds about them, for instance via the company website;
data should be updated as inaccuracies are discovered — for instance, if a customer can no longer be reached on their stored telephone number, it should be removed from the database; and
it is the marketing manager’s responsibility to ensure marketing and Customer Relationship Management (CRM) databases are checked against industry standards and GDPR requirements every six months.

2.8 Subject Access Requests

All Data Subjects who are the subject of personal data held by Fishbone Solutions are entitled to:

ask what information the company holds about them and why;
ask how to gain access to it;
be informed how to keep it up to date;
be informed how the company is meeting its data protection obligations;
the right to erasure;
the right to restrict processing;
the right to data portability; and
the right to object and the right not to be subject to automated decision making including profiling.

If a Data Subject contacts the company requesting this information, this is called a Subject Access Request. Subject Access Requests from Data Subjects should be made by email, addressed to the data controller at go-fish@fishbonesolutions.co.uk. The data controller can supply a standard request form, although Data Subjects do not have to use this.

The data controller will aim to provide the relevant data within one calendar month of request. The data controller will always verify the identity of anyone making a subject access request before handing over any information.

Fishbone Solutions reserves the right to refuse requests for data that are unfounded; all Data Subjects will be advised why, and they do have the right to complain to the supervisory authority.

2.9 Disclosing And Sharing Data With Other Parties

Fishbone Solutions will not share any personal data with any external parties.

In certain circumstances, the Data Protection Act and the General Data Protection Regulation allow personal data to be disclosed to law enforcement agencies without the consent of the data subject. Under these circumstances, Fishbone Solutions will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board and from the company’s legal advisers where necessary.

2.10 Providing Information

Fishbone Solutions aims to ensure that Data Subjects are aware that their data is being processed, and that they understand how the data is being used and how to exercise their rights.

To these ends, the company has a privacy statement, setting out how data relating to Data Subjects is used by the company. This is published on the Company website and is available on request.

2.11 Information Held

Fishbone Solutions will hold the following information:

Client

name and address of client;
phone number of client;
email address of client; and
details of work carried out at client addresses.

Staff

name and address of staff;
phone number of staff;
email address of staff; and
bank account, National Insurance and HMRC taxation data, and other payroll information of staff.

2.12 Data Breaches

Information held by Fishbone Solutions is not high risk and could not result in discrimination, damage to reputation, financial loss or any other significant economic or social disadvantage.

That notwithstanding, Fishbone Solutions will carry out an annual audit in order that any data breaches can be detected, investigated and reported.

2.13 Data Protection Impact Assessments

Fishbone Solutions has carried out a privacy impact assessment. Due to the limited nature of the data kept, a Data Protection Impact Assessment is not deemed necessary.

2.14 Business Continuity And Data Recovery

Fishbone Solutions has been operating fully using Microsoft’s cloud services (Microsoft 365) since 2019. This covers:

company-generated email addresses for employees and associates;
all cloud storage facilities for company files (using SharePoint and OneDrive); and
the internal and external communication platform (Microsoft Teams).

Fishbone has implemented high levels of security measures and data backup facilities included within the Microsoft 365 environment, and snapshots are taken multiple times a day, with version history for documents held for as long as the data type defines.

Bi-weekly offsite backups are taken on an encrypted hard drive, and in the event of complete loss of access to company data it would take less than a working day to restore access to a cloud backup of the Fishbone Solutions file system.

Fishbone are in the process of attaining Cyber Essentials accreditation.

3. Privacy Notice

Fishbone Solutions is a consulting company providing engineering and business consultancy services. The primary function of the business is to carry out engineering projects for our customers, in the automotive, rail and wider transportation / engineering industries. Fishbone Solutions is accredited to ISO9001:2015, which ensures a robust lifecycle for our projects. As part of this function, personal data on clients is stored. Information that is kept by Fishbone Solutions is documented in this data protection and privacy policy. Fishbone Solutions does not share personal data with external bodies, unless required to by law enforcement agencies.

4. Website Privacy And Cookies Policy

This privacy policy (together with our website’s terms of use, acceptable use policy and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us, and how Project REM Limited, trading as Fishbone Solutions, uses and protects any information that you give us when you use this website.

Fishbone Solutions is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy policy. Fishbone Solutions may change this policy from time to time by updating this page. You should check this page from time to time to ensure you are happy with any changes.

For the purpose of the Data Protection Act 1998, the data controller is Project REM Limited of 7 Pride Point Drive, Pride Park, Derby DE24 8BX. Our nominated representative for the purpose of the Act is Mark Gadsby.

What Information We Collect

We may collect the following information:

contact information including name and email address.

What We Do With The Information We Gather

We require this information to understand your needs and provide you with a better service, and in particular for the following reasons:

internal record keeping;
customer relationship management;
to improve our products and services; and
from time to time, we may also use your information to contact you for market research purposes — we may contact you by email, phone, fax or mail, and may use the information to customise the website according to your interests.

Fishbone Solutions will not share any personal data with any external parties.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

How We Use Cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. By using this website you agree to our use of cookies.

Links To Other Websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Controlling Your Personal Information

You may choose to restrict the collection or use of your personal information in the following ways: whenever you are asked to fill in a form on the website, look for the box that you can click to indicate that you do not want the information to be used by anybody for direct marketing purposes.

We will not sell, distribute or lease your personal information to third parties unless we are required by law to do so. You may request details of personal information which we hold about you under the Data Protection Act 1998. If you would like a copy of the information held on you please contact us at go-fish@fishbonesolutions.co.uk. If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address. We will promptly correct any information found to be incorrect.

5. IT / Cyber Security Policy And Process

IT system and cyber security is of paramount importance to Fishbone, due to handling customer data, information, specifications and other project related documentation.

The IT infrastructure, software and processes are accredited to Cyber Essentials. This is an important accreditation for Fishbone to achieve and retain, as it is an industry-wide accreditation recognised by our customers as providing the relevant baseline certification for our IT system’s cyber credentials.

Fishbone has selected a suite of IT infrastructure, office software tools, and other software tools which are generally cloud based Software as a Service (SaaS) applications and therefore compliant with the latest cyber security standards.

However, it is important that certain IT processes and guidelines are communicated to and adhered to by the staff base to ensure that the IT infrastructure remains secure.

The following guidelines and processes outline the fundamental requirements of this policy. This policy should be read / used in conjunction with the Staff Handbook, which outlines policies and processes for usage of email, internet, social media and artificial intelligence.

User Account Types

There are three types of IT account: Standard User, Local Administrator and Global Administrator. Most users are Standard users. Local and Global Administrators are assigned by approval from a Director.

Standard User — access to all standard IT systems and software provided by the Company, but prohibited from installing new software to PCs or accessing administration facilities;
Local Administrator — IT administrator with rights to set up and change user credentials, and install new software from approved sources; and
Global Administrator — IT administrator with rights to be able to set up and change global IT infrastructure settings.

Equipment Security And Passwords

employees are responsible for the security of the equipment allocated to or used by them — you must not allow anyone else to use that equipment other than in accordance with this policy; you should use passwords on all IT equipment, particularly items that you take out of the office, and you should keep your passwords confidential and change them regularly;
you must only log on to our systems using your own username and password — you must not use another person’s username and password or allow anyone else to log on using your username and password;
password controls are automatically applied by our IT systems providers; however you should use the following guidelines in the event that this does not happen:
- use Multi-Factor Authentication (MFA) sign-in for email and other office applications;
- use a strong and unique password including a minimum of 12 characters which includes alphanumeric and special characters;
- use biometric sign-in credentials where your device allows it;
- use a 6-number PIN sign-in credentials where your device allows it; and
- the provisions above should also be used on mobile devices;
you must update your password every 180 days, or in line with the automatic password expiry policy set out by our office software providers, whichever is sooner; and
if you are away from your desk, you should log out or lock your computer — you must log out and shut down your computer at the end of each working day.

Systems And Data Security

you should not delete, destroy or modify existing systems, programs, information or data (except as authorised in the proper performance of your duties);
you must not download or install software from external or unauthorised sources without authorisation from a Director — downloading unauthorised software may interfere with our systems and may introduce viruses or other malware;
you must only download new device applications from the device’s software provider’s “App Store” where such software is approved for use on the device’s operating system and will comply with the device’s security requirements;
you must not attach any device or equipment, including mobile phones, tablet computers or USB storage devices, to our systems without authorisation from a Director;
we monitor all emails passing through our system for viruses — you should exercise particular caution when opening unsolicited emails from unknown sources; if an email looks suspicious, do not reply to it, open any attachments or click any links in it;
inform a Director immediately if you suspect your computer may have a virus, or if you receive an email which is unsolicited or appears to be of a phishing nature, i.e. asking you to make monetary transactions;
you must ensure that anti-virus software (typically Microsoft Defender and Windows Firewall) is automatically updated with the latest software patches — typically such updates will occur automatically, but on the rare occasion that automatic updates are not available, you should ensure that updates happen within 7 days of their release; and
you must ensure that automatic updates to operating systems on PC and mobile devices are allowed to occur — on the rare occasion that automatic updates are not available, you should ensure that updates happen within 7 days of their release.