General Statement of AMG’s Duties and Scope

AMG is required to process to relevant data regarding members of staff, suppliers and customers as part of its operation and shall take all reasonable steps to do so in accordance with this Policy. AMG as a data controller is responsible for establishing policies and procedures in order to comply with the Data Protection Act 1998 and GDPR.

Lawfulness, Fairness and Transparency

Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. AMG will tell the data subject what processing will occur, the processing must match the description given to the data subject and it must be for one of the purposes specified in the applicable Data Protection regulation.

Purpose Limitation

Personal data shall only be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes

Data Minimisation

Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. This requires AMG to only store Personal Data that is strictly required.

Accuracy

AMG will endeavour to ensure that all personal data held is accurate. Data subjects must notify the data processor of any changes to information held about them. Data subjects have the right in some circumstances to request that inaccurate information about them is erased. This will not apply in some cases for example, where records of mistakes or corrections are kept.

Storage Limitations

AMG will ensure personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.

Integrity and Confidentiality

AMG will process and handle all data in a manner that ensues appropriate security of the personal data, including protection against unauthorised or unlawful processing, and against accidental loss, destruction or damage.

Data Subject Consent

AMG will obtain personal data only by lawful and fair means and where appropriate with the knowledge and consent of the individual concerned. The data subject has the right to withdraw his or her consent at any time. It shall be as easy to withdraw as to give consent.