Data Security Policy
Duffy Rafferty Communications (DRC) Ltd, a member of the Chartered Institute of Public Relations, is committed to protecting your personal information and respecting your privacy in everything we do.
As data controller, DRC may collect, store and use your personal data for lawful purposes.
This Policy outlines what data we may collect, from whom and how we use it in accordance with the EU data protection regime introduced by the General Data Protection Regulation (Regulation 2016/679, the “Data Protection Legislation”).
In this policy, use of the terms “we”, “us”, “our” and “The Company” refer to Duffy Rafferty Communications (DRC). The terms “client”, “you” and “your” refers to you, the person accessing this website and accepting our terms and conditions.
Whose information do we collect?
DRC collects basic contact information for people with whom we engage and/or do business. These details include:
– DRC directors and staff
- Clients and their associated agencies / partners
- Journalists and members of the media
– Suppliers (e.g., photographers, printers, model agencies, office supplies, etc)
DRC retains a legitimate interest in holding contact details for the above groups and communicating with them regularly in order to work together and conduct out our collective daily business.
Typically, for the above groups, DRC may collect information including name and job title, contact information including email address and phone number, billing and/or delivery address for orders.
For DRC staff, details including address, bank details, date of birth, National Insurance number will be securely stored for payroll purposes. The use of this personal data is restricted to the extent necessary for the performance of the contract between us.
Should we wish to use any of this personal data for other specific purposes, outside of conducting our day to day business, we will contact and ask for consent before using it.
If a client provides us with personal data on individuals connected to them, in relation to their engagement with us, this policy will be relevant for those individuals who should receive a copy or be advised of its content.
Members of the public
DRC is not an organisation that deals directly with the public – only when the need arises on behalf of a client, which includes:
- Client competitions for which we may gather entries, select winners and organise resulting publicity
- Taking PR photographs and/or video filming involving members of the public at client events or functions
- Any ad hoc enquiries, through DRC’s offices, from members of the public intended for clients (or DRC) that contain personal details such as name, contact number, email address
This is not a major part of our business and does not constitute collecting or holding personal data for a large number of people.
In cases where public personal data is required, the following guidelines apply:
- All personal data will be captured in accordance with the principles of GDPR.
- Only the minimum data required for the lawful purpose of the campaign is requested.
- In the case of PR photography / video filming involving members of the public at events, only the participant’s name and general area of residence is required (e.g., town or city).
- All participants in PR photographs / video content are asked to sign a form giving consent for their photographs to be used for publicity purposes.
- For client competitions and promotions, only personal details required for selection of winner or notifying winners of prizes, will be used.
- Participation in any competition or promotion is not to be seen as agreement to data being retained for any other purpose.
- Copy for any competition / event entry forms – paper or online – will be written in such a way as to ensure entrants provide explicit consent to their data being captured and retained.
- Should we wish to use any personal data for other specific purposes, not stated at the outset, we will contact the individual and ask for consent before using it.
- We do not hold on to winner or entrant information for longer than is reasonably necessary, in line with General Data Protection Regulation.
- DRC does not provide, sell, rent, loan, trade or lease the information to any third party for the purposes of marketing or selling goods and services.
- All rights of the individual under GDPR will be safeguarded and implemented.
Is the information shared?
Personal details for any of the aforementioned groups will not be disclosed to anyone who does not need it. DRC does not provide, sell, rent, loan, trade or lease the information to any third party for the purposes of marketing or selling goods and services. In the event of any personal data breach, that is likely to result in a high risk to someone’s rights or freedoms, we shall notify anyone affected.
How is information stored?
DRC is committed to ensuring that any personal data held will be stored securely. Only selected and approved individuals will have access to it. Security measures include password protection and encryption of data files, controlled access to data files and secure transmission of data files to approved individuals including clients and third parties who require the data in order to fulfil a lawful purpose of the campaign.
Whilst we will always strive to protect the personal data that we hold, individuals should bear in mind that no method of transmission over the Internet, or method of electronic storage is 100% secure. As such we make no warranties as to the level of security afforded to your data, except that we will always act in accordance with the relevant UK and EU legislation.
How long is information stored?
DRC will not hold on to personal data for longer than is reasonably necessary, in line with General Data Protection Regulation. Thereafter, we will refrain from collecting any further personal data on you and shall take appropriate steps to dispose of any records containing your personal data, to the extent this is operationally feasible and proportionate.
Aside from creating media lists of relevant journalists with a legitimate interest in what we are promoting on behalf of our clients, DRC does not use mailing lists for any other group, nor do we deliver e-shots, newsletters or any other updates. Journalists can ask to unsubscribe from our media distribution lists at any time, in which case their details will be removed and erased from our media data base.
The DRC website
What are your rights?
Individuals are entitled to have their personal data recorded accurately and have the following rights:
- The right to access, examine and correct their data at any time
- The right to restrict the use of their data
- The right, where applicable, to withdraw any consent given to the processing of their data
- The right to receive information regarding any entities to whom their data may be disclosed
- The right to object to the processing of their data where we have considered this to be necessary for the purposes of our legitimate interests
- The right to unsubscribe and be removed from any contact list that you may have previously agreed to be on
- The right to request a copy of the information you have provided to us, to use for your own purposes (often called your right to data portability)
- The right to lodge a complaint with the Information Commissioner’s Office
- The right to request that their data is erased where the information is no longer necessary for the purpose for which it was collected
Should anyone wish to discuss their data protection rights with us, please contact us at firstname.lastname@example.org write to us at Duffy Rafferty Communications, 18 Heron Road, Belfast, BT3 9LE.