Our Privacy Statement

This privacy policy explains the legal basis of how and why we collect your personal data, and how it is used based on the consent of the business, complainant, or enquirer.

Personal Data we collect and use

• We will only collect personal data where necessary to investigate a complaint on your behalf. We will only request information that enables us to verify you the enquirer or complainant and to be able to contact you during our investigation. We will only use the requested information during our investigation and as part of any follow up activity as agreed with you. Where we issue a report as part of any investigation conducted on your behalf we will agree the use of your data and information at the outset.

Who we share personal data with and why

• We will agree with you the use of your data for the purposes of pursuing enquiries and investigating complaints on your behalf. It may be necessary for us to share your data information with the party that we are investigating on your behalf in order to fully investigate and resolve the matter satisfactorily. We will not share your information with third parties that are not directly involved with your complaint or enquiry unless agreed with you and similarly we will not share personal information with third parties for marketing purposes.

Storing and retaining data

• We will only retain your personnel information for as long as necessary to fulfil the purpose we originally collected for, including the purpose of satisfying any legal, accounting or reporting requirements. The information we have collected will be retained securely and reviewed after seven years where it will be deleted if no longer required.

How you can access and update your information

• To access and update the information we have about you please contact us.

Your data and your rights

• The data we hold on you is your data and we respect that you have the right to know what information we hold about you. We will deal with you directly, confidentially and professionally to ensure that your information is held securely and managed responsibly and will only share information by prior agreement and for the purposes of the Small Business Commissioner to be able to perform its’ duties and meet any obligations placed upon us.

How you can withdraw consent for us to use your data

• You can withdraw your consent for us to use your data and information at any time, however the withdrawal of such consent during the process of an investigating this may limit the Small Business Commissioner in terms of reaching a satisfactory resolution to your complaint or enquiry.

Under certain circumstances by law you have the right to request:

• Access to your personnel information. This enables you to receive a copy of the personnel information we hold about to you check that we are lawfully processing it.
• The erasure of personnel information enabling you to ask us to remove personnel information where there is no good reason to keep it.
• An objection to the processing of your personal information where we require it for a legitimate purpose, but in doing so could compromise your particular circumstances.
• A restriction of processing your personnel information. This enables you to ask us to suspend the processing of personnel information. For example, if you want us to establish accuracy and reason for processing it.
• The transfer of your personnel information to another party.

Use of Cookies

• We will only use cookies to inform on how our website is being used and to help make improvements to our online service and functionality as set out in our cookie policy.

Links to websites

• The Small Business Commissioner Website contains links to other websites, mainly government departments and organisations, but also to those of other third parties. Those websites are not covered by this Privacy Policy and the Small Business Commissioner is not responsible for the privacy practices within any of these other websites. You should be aware of this when you leave our website and we encourage you to read the privacy statements of other websites.
• Where we provide links to third party websites as part of our obligations to signpost users to information that may be of interest to you, this does not construe any endorsement of those products, services or individuals by the Small Business Commissioner.

Reviewing the Policy

• We will keep our privacy policy under review to ensure it continues to meet all of our operational and legislative requirements and obligations and ensure we remain an organisation that is fit for the future.

When should privacy information be communicated?

Where personal data is obtained directly from the data subject, this information should be communicated when the data is collected. For data not obtained directly from the data subject, this information should be communicated:

• Within a reasonable period of having obtained the data (and in any event within one month).
• If it is used to communicate with the data subject, when the first communication takes place.
• If disclosure to another recipient is envisaged, before the data is disclosed.

Relevant Officers

• The Small Business Commissioner is the Data Controller
• The Office of the Small Business Commissioner is the Data Processor

Further information: The ICO code of practice on privacy.