Privacy Notice
SAPPHIRE SKIES
This Privacy Policy applies the use by us of any data provided by you to us through via direct contact via email or website etc. Website links etc. that are provided are not included.
Introduction
Sapphire Skies Limited is the Data Controller for UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioners Office registration number ZC168847
For an organisation such as a school, Sapphire Skies acts as data processor, acting only on the instructions of the school. Therefore, the school is the Data Controller.
This policy relates to data provided by direct contact with us or via the website if / as applicable.
The policy soes not include any website links .
Sapphire Skies overview
Sapphire Skies is a data protection consultancy and a training / safeguarding training provider. Company no.10415685
The information we collect
We will collect information relating to name, address, email address, telephone number, financial invoicing data records of correspondence.
Legal basis for processing
Contractual obligations – To fulfil a contract
Consent - You may withdraw your consent at any time
Legal obligation – To fulfil legal obligations
Legitimate interests - To provide you with the best services and or products
How we process your data
To provide you with information with regards to information that you have requested.
Internal record keeping
Data retention
We retain your data for one month at conclusion of a contract unless there is a requirement to comply with legal obligation. For example, financial data is retained for 7 years. If you withdraw consent for the processing of your data, we will only retain it if there is a legal obligation to do so.
Your legal rights
You have the rights under the data protection laws in relation to your personal data including:
The right of access – You have the right via a Subject Access request. We will ask you to verify your identity before processing any request.
The right to rectification – You have the right for any incorrect data to be rectified
The right to erasure – You have the right to the erasure of your data
The right to object – You have the right to object to the processing of your data
The right to restrict processing – You have the right to restrict processing for accuracy , unlawful use or a legal claim.
Transfer
We will transfer your data to a third party on request in a common machine format.
We do not transfer data outside the EEA unless a Transfer Risk Assessment has been completed and there are reasonable security measures in place or Standard Contractual Clauses are in place.
Requesting information
Please contact dpo@sapphireskies.co.uk for a Subject Access Request or to exercise your other rights. You do not have to pay a fee unless the request is unfounded, manifestly excessive or a repeated request. A reasonable fee will be charged.
In order to protect your data, we will ask you to verify your identity before processing any request. If you are acting on behalf of a third party, we will ask for written authorisation for you to act on their behalf.
Data security
Regular reviewed and deleted as if necessary
Encrypted via Transport Layer Security
AES encryption (Advanced Encryption Standard)
MFA where possible
Limiting access to data
Data storage
Microsoft Azure servers based in the UK ISO 27001
Offsite and offline backup
Complaints
You can contact email dpo@sapphireskies.co.uk
You can also contact the ICO
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Via ICO website online at https://ico.org.uk/concerns/
Data breaches
We have procedures in place to report, investigate and detect data breaches.
Cookies
Our website may contain cookies to improve the user experience and functionality. Cookies can be managed via your browser settings.
Contact us:
Via email dpo@sapphireskies.co.uk
Sapphire Skies Limited
Pendragon House
65 London Road
St.Albans
Herts
AL1 !LJ