[et_pb_section fb_built=”1″ fullwidth=”on” _builder_version=”3.22″ collapsed=”on” global_colors_info=”{}”][et_pb_fullwidth_header title=”DATA PROTECTION POLICY” _builder_version=”4.0.6″ background_image=”http:\/\/www.gdg.travel\/wp-content\/uploads\/2019\/11\/Technology.jpeg” z_index_tablet=”500″ global_colors_info=”{}”][\/et_pb_fullwidth_header][\/et_pb_section][et_pb_section fb_built=”1″ admin_label=”Quote Section” _builder_version=”3.22″ custom_padding=”75px|0px|110px|0px|false|false” border_color_all=”rgba(255,186,96,0.6)” border_width_right=”8vw” border_color_right=”#5b8cb1″ collapsed=”on” global_colors_info=”{}”][et_pb_row column_structure=”3_4,1_4″ admin_label=”Quote Area” _builder_version=”3.25″ custom_padding=”55px|0px|55px|0px|true|false” use_custom_width=”on” global_colors_info=”{}”][et_pb_column type=”3_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Author Name” _builder_version=”4.0.6″ text_text_color=”#ffba60″ text_letter_spacing=”4px” header_font=”||||||||” header_2_font=”||||||||” header_3_font=”||||||||” header_4_font=”||||||||” header_5_font=”||||||||” header_6_font=”||||||||” module_alignment=”center” animation_style=”slide” animation_direction=”bottom” animation_intensity_slide=”10%” animation_starting_opacity=”100%” inline_fonts=”Georgia” global_colors_info=”{}”]<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=”3.27.4″ text_font_size=”17px” text_letter_spacing=”1px” text_line_height=”1.8em” header_3_font=”||||||||” header_3_line_height=”1.6em” header_4_font=”||||||||” custom_margin=”|||” custom_padding=”|||30px” animation_style=”flip” animation_intensity_flip=”5%” animation_starting_opacity=”100%” border_color_all=”#313e47″ border_width_left=”10px” border_color_left=”#414042″ global_colors_info=”{}”]<\/p>\n
Key Details<\/strong><\/span><\/p>\n Our Commitment<\/strong><\/span><\/p>\n The Gray Dawes Group will ensure that it complies with all laws relating to the storage, management and control of data. These include, but are not limited to, the General Data Protection Regulation (GDPR) (EU) 2016\/679 (new legislation from 25th<\/sup> May 2018). \u00a0We will endeavour to keep customers, suppliers, and staff updated on policies and procedural changes implemented.<\/span><\/p>\n Why this policy exists<\/strong><\/span><\/p>\n This data protection policy ensures the Gray Dawes Group:<\/span><\/p>\n Review of this policy<\/strong><\/span><\/p>\n This policy will be reviewed and updated on a quarterly basis by the Data Protection Officer (DPO) in consultation with the senior management team and CEO.<\/span><\/p>\n These rules apply regardless of whether data is stored electronically, on paper or on other material.<\/span><\/p>\n Under the GDPR, the data protection principles set out the main responsibilities for organisations.\u00a0 These state that personal data must:<\/span><\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”1_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Project Image Area” _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_image src=”http:\/\/www.gdg.travel\/wp-content\/uploads\/2019\/11\/Globe.jpg” show_bottom_space=”off” force_fullwidth=”on” align_tablet=”center” align_phone=”” align_last_edited=”on|desktop” _builder_version=”4.0.6″ custom_margin=”|||” custom_padding=”|||” animation_style=”slide” animation_direction=”right” animation_intensity_slide=”2%” z_index_tablet=”500″ border_width_all=”30px” border_color_all=”#ffffff” box_shadow_style=”preset2″ box_shadow_horizontal=”0px” box_shadow_vertical=”15px” box_shadow_blur=”60px” box_shadow_color=”rgba(29,61,71,0.2)” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ admin_label=”Project Analysis Section” _builder_version=”3.22″ custom_padding=”90px||2px||false|false” collapsed=”on” global_colors_info=”{}”][et_pb_row column_structure=”1_4,3_4″ admin_label=”Project Analysis Area” _builder_version=”3.25″ custom_padding=”60px|0px|60px|0px|true|false” border_color_all=”rgba(51,51,51,0.12)” border_width_top=”1px” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Title” _builder_version=”4.0.6″ header_font=”||||||||” header_3_line_height=”2em” header_4_font=”||||||||” header_5_font=”||||||||” header_6_font=”||||||||” animation_style=”fold” animation_direction=”left” animation_intensity_fold=”5%” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.0.6″ text_line_height=”2em” animation_style=”fade” global_colors_info=”{}”]<\/p>\n This policy applies to:<\/p>\n The head office of Gray Dawes Group Name [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ admin_label=”Project Analysis Area” _builder_version=”3.25″ custom_padding=”60px|0px|60px|0px|true|false” border_color_all=”rgba(51,51,51,0.12)” border_width_top=”1px” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Title” _builder_version=”4.0.6″ header_font=”||||||||” header_3_line_height=”2em” header_4_font=”||||||||” header_5_font=”||||||||” header_6_font=”||||||||” animation_style=”fold” animation_direction=”left” animation_intensity_fold=”5%” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.0.6″ text_line_height=”2em” animation_style=”fade” global_colors_info=”{}”]<\/p>\n Adherence to this policy will protect Gray Dawes Group from data security risks, including:<\/p>\n Breaches of confidentiality<\/p>\n<\/div>\n<\/div>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ admin_label=”Final Result Area” _builder_version=”3.25″ custom_padding=”60px|0px|60px|0px|true|false” border_color_all=”rgba(51,51,51,0.12)” border_width_top=”1px” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Title” _builder_version=”4.0.6″ header_3_line_height=”2em” animation_style=”fold” animation_direction=”left” animation_intensity_fold=”5%” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.0.6″ text_font=”||||||||” text_line_height=”2em” header_font=”||||||||” animation_style=”fade” global_colors_info=”{}”]<\/p>\n Everyone who works for or with Gray Dawes Group has responsibility for ensuring data is collected, stored, handled and processed in line with this policy and data protection principles.<\/p>\n However, these people have key areas of responsibility:<\/p>\n The CEO, Suzanne Horner, is ultimately responsible for ensuring that Gray Dawes Group meets its legal obligations.<\/p>\n The DPO, Richard Munday, is responsible for: The Chief Technology Officer, Steve Fisher, is responsible for: The Marketing Director, John Cooper, is responsible for: To audit key suppliers on a 12-monthly basis to review their data protection policies and standards. The adequate completion of this audit logged in the Supplier Data protection log. This is reviewed by the DPO.<\/p>\n<\/div>\n<\/div>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ admin_label=”Final Result Area” _builder_version=”3.25″ custom_padding=”60px|0px|60px|0px|true|false” border_color_all=”rgba(51,51,51,0.12)” border_width_top=”1px” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Title” _builder_version=”4.0.6″ header_3_line_height=”2em” animation_style=”fold” animation_direction=”left” animation_intensity_fold=”5%” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.0.6″ text_font=”||||||||” text_line_height=”2em” header_font=”||||||||” animation_style=”fade” global_colors_info=”{}”]<\/p>\n The only people able to access data covered by this policy should be those who need it for their work. Employees should keep all data secure, by taking sensible precautions and following the guidelines below. Personal data should not be disclosed to unauthorised people, either within the company or externally. Employees should request help from their line manager or the DPO if they are unsure about any aspect of data protection.<\/p>\n<\/div>\n<\/div>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ admin_label=”Final Result Area” _builder_version=”3.25″ custom_padding=”60px|0px|60px|0px|true|false” border_color_all=”rgba(51,51,51,0.12)” border_width_top=”1px” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Title” _builder_version=”4.0.6″ header_3_line_height=”2em” animation_style=”fold” animation_direction=”left” animation_intensity_fold=”5%” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”3.25″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.0.6″ text_font=”||||||||” text_line_height=”2em” header_font=”||||||||” animation_style=”fade” global_colors_info=”{}”]<\/p>\n These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the Head of Technology.<\/p>\n When data is stored on paper, it should be kept in a secure place where unauthorised people cannot access it.<\/p>\n These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:<\/p>\n Gray Dawes Group is actively working towards a paper free environment, however if still in use, any paper or files should be kept in a locked drawer or filing cabinet. Gray Dawes primary GD technical suppliers currently host data in the following locations:<\/p>\n \u2022 Travcom (UK)\n
\n
\n
POLICY SCOPE<\/h4>\n<\/div>\n<\/div>\n
All branches of Gray Dawes Group
All staff employed by Gray Dawes Group
All contractors, suppliers and other people working on behalf of Gray Dawes Group
It applies to all data that the company holds that can identify an individual. This can include:<\/p>\n
Passport information
Date of birth
Visa information
Mobile phone number and contact details
Home address
Frequent Traveller & other memberships
Form of payment<\/p>\n<\/div>\n<\/div>\nDATA PROTECTION RISKS<\/h4>\n<\/div>\n<\/div>\n
RESPONSIBILITIES<\/h4>\n
Keeping the CEO updated about data protection responsibilities, risk and issues.
Reviewing all data protection procedures and related policies, in line with an agreed schedule.
To facilitate data protection training to all employees to help them understand their responsibilities when handling data and to ensure that they are fully aware of this policy.
Handling data protection questions from staff and anyone else covered by this policy.
Dealing with requests from individuals to see the data Gray Dawes Travel holds about them (also called \u2018Subject Access Requests.\u2019)<\/p>\n
Ensuring all systems, services and equipment used for storing data meet acceptable security standards.
Performing regular check s and scans to ensure security hardware and software is functioning properly.
Evaluating any third-party services, the company is considering using to store or process data. For instance, cloud computing services.<\/p>\n
Approving any data protection statements attached to communications such as emails and letters.
Addressing any data protection queries from journalists or media outlets like newspapers.
Where necessary, working with other staff to ensure marking initiatives abide by data protection principles.
The Commercial Director, David Bishop, is responsible for:
Checking and approving any contracts or agreements with third parties that may handle the company\u2019s sensitive data.<\/p>\nGENERAL STAFF GUIDELINES<\/h4>\n<\/div>\n<\/div>\n
Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.<\/p>\n
In particular, strong passwords must be used and they should never be shared.<\/p>\n
Data should be regularly reviewed and updated if it is found to be out of date. If no longer required by the Business or by Law, it should be deleted and disposed of.<\/p>\nDATA STORAGE<\/h3>\n<\/div>\n<\/div>\n
Employees should make sure paper and printouts are not left where unauthorised people could seem them, like on a printer.
Staff should avoid printing out data wherever possible and print only in exceptional circumstances. Data printouts should be shredded and disposed of securely (shredded) on the day when they are no longer
When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:
Data should be protected by strong passwords that are changed regularly and never shared between employees.
The business does not permit the storage of data on removable media (like a CD or DVD.) All computers are locked down to prevent this.
Data should only be stored on designated drives and servers, and should only be uploaded to an approved cloud computing services.
Servers containing personal data will be sited in a secure location, away from general office space.
Data will be backed up frequently. Those backups should be tested regularly, in line with the company\u2019s standard backup procedures.
All servers and computers containing data will be protected by approved security software and a firewall.
Owing the nature of travel business that requires travel and accommodation to be made to destinations throughout the world, data pertaining to reservations may be processed by suppliers outside of the European Economic Area (EEA) and US Privacy Shield framework.<\/p>\n
\u2022 Travelport (US)
\u2022 Evolvi (UK)
\u2022 Atriis (Western Europe)
\u2022 Agentivity (Western Europe)
\u2022 Grapevine (UK)<\/p>\n