Privacy & Data Protection Policy

Jannah Express Limited (the Employer) is committed to ensuring that all personal data handled by us will be processed according to legally compliant standards of data protection and data security.

We confirm for the purposes of the data protection laws, that the Employer is a data controller of the personal data in connection with your employment. This means that we determine the purposes for which, and the manner in which, your personal data is processed.

The purpose of this Policy is to help us achieve our data protection and data security aims by:

• notifying our staff of the types of personal information that we may hold about them, our customers, suppliers and other third parties and what we do with that information;
• setting out the rules on data protection and the legal conditions that must be satisfied when we collect, receive, handle, process, transfer and store personal data and ensuring staff understand our rules and the legal standards; and
• clarifying the responsibilities and duties of staff in respect of data protection and data security.

This is a statement of policy only and does not form part of your contract of employment. We may amend this Policy at any time, in our absolute discretion.

• Criminal records data: information about an individual’s criminal convictions and offences, and information relating to criminal allegations and proceedings.
• Data protection laws: all applicable laws relating to the processing of personal data, including, for the period during which it is in force, the UK General Data Protection Regulation.
• Data subject: the individual to whom the personal data relates.
• Personal data: any information that relates to an individual who can be identified from that information.
• Processing: any use that is made of data, including collecting, storing, amending, disclosing, or destroying it.
• Special categories of personal data: information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, and biometric data.

Staff whose work involves using personal data must comply with this Policy and the following principles:

1. Processed lawfully, fairly and in a transparent manner.

2. Collected only for specified, explicit and legitimate purposes.

3. Adequate, relevant and limited to what is necessary.

4. Accurate and kept up to date.

5. Kept only as long as necessary.

6. Kept secure, using appropriate technical and organizational measures.

• Maintaining appropriate standards of data protection and data security is a collective task shared between us and you.

• This Policy applies to all staff: employees, directors, officers, consultants, contractors, casual or agency staff, trainees, homeworkers, fixed-term staff, and volunteers.

• Questions should be directed to the Data Protection Officer (DPO).

• All staff have personal responsibility to comply with this Policy. Managers must lead by example and ensure compliance.

• Any breach of this Policy may result in disciplinary action, up to and including dismissal.

This Policy covers personal data which:

• relates to a living individual who can be identified,

• is stored electronically or on paper,

• includes statements of opinion as well as facts,

• relates to staff, customers, suppliers or third parties,

• is obtained, stored, used, disclosed, amended, retrieved, transferred, or destroyed by Jannah Express Limited.

We collect personal data about you which:

• you provide before or during employment,

• is provided by third parties (references, suppliers, etc.), or

• is publicly available.

This may include:

• home address and contact details (including next of kin),

• recruitment information (applications, CVs, references, qualifications),

• pay, tax, NI number, pensions, health insurance,

• communications usage (email, internet, telephone),

• performance, professionalism and reliability records,

• disciplinary, grievance, complaint and concern records.

We may process sensitive personal data only where:

• we have a lawful basis, and

• one of the special conditions applies (e.g., explicit consent, legal rights, protection of vital interests, public information, legal claims, or substantial public interest).

The DPO must approve any processing of sensitive data.

Handled in accordance with our Criminal Records Information Policy.

We will tell you why we process your data in our Privacy Notice. Typical uses include:

• Staff address lists

• Sickness records

• Monitoring IT systems

• Disciplinary, grievance, legal or compliance matters

• Performance reviews

• Equal opportunities monitoring

• Necessary business checks inside and outside the UK

We will ensure that:

• Data is accurate, up to date, adequate and relevant.

• Data obtained for one purpose will not be used for another unless agreed or reasonably expected.

• If data is inaccurate, we will correct it promptly.

• Personal data will be kept securely in accordance with our Data Retention Policy.

• Retention periods are set out in our Privacy Notice.

You have the following rights regarding your personal data:

• Subject Access Requests (SARs): you may request details of the data we hold about you, who it is shared with, how long it is retained, and more.

• Other rights: you can require us to rectify inaccurate data, stop processing or erase data, or restrict processing.

Requests should be sent to: booking@jannahexpress.co.uk

We will:

• Ensure only authorised people access personal data.

• Use pseudonymisation or encryption where possible.

• Protect against unauthorised access, loss or destruction.

• Require third-party processors to comply with equivalent security standards.

Security procedures include:

• Locking desks and cupboards with confidential information.

• Strong, regularly updated passwords.

• Encryption of portable storage (USBs, CDs, memory sticks).

• No saving of data directly to personal devices.

• Servers secured and backed up.

• Telephone identity checks before disclosure of information.

• Shredding or destroying physical documents and storage devices when no longer needed.

Where processing creates a high risk, Jannah Express Limited will carry out a Data Protection Impact Assessment.

• Any data breach posing risks to individuals’ rights will be reported to the ICO within 72 hours.

• All breaches will be recorded.

• Affected individuals will be notified if the risk is high.

• Personal data may be transferred outside the UK or EEA where necessary for business.

• Transfers will only occur with adequate protections in place.

Staff must:

• Keep personal data accurate and up to date.

• Report changes in personal data (address, bank details, etc.).

• Only access and disclose data where authorised.

• Keep data secure.

• Not store work data on personal devices without encryption or password protection.

• All staff will receive training on data protection responsibilities during induction and at regular intervals.

• Staff with special responsibilities (e.g., handling SARs) will receive additional training.

This Data Protection and Data Security Policy was created using a document from Rocket Lawyer (https://www.rocketlawyer.com/gb/en).