Bundle Business Data Protection Policy
At the Bundle Business Ltd we take our responsibilities under the Data Protection Act 1998 very seriously.
The Bundle Business Ltd is registered as a Data Controller (as that term is defined in the Data Protection Act 1998) with the Office of the Information Commissioner in respect of its operations. Our registration number is Z1678213. The nominated person at the Bundle Business Ltd responsible for information security is the Director, Samantha Dawson.
When processing personal data provided by our clients, we act as a Data Processor (as that term is defined in the Data Protection Act 1998). To assist our clients with complying with their own obligations under the Data Protection Act we confirm that:
- we will only process the personal data controlled by our clients as directed by them; and
- we will take appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, the personal data in our care.
For this reason collated bundles will only be available for download through our user portal which will be protected by password. The server that hosts our website has physical and electronic security measures that include CCTV, firewalls and encryption. The level of protection provided by the encryption is reviewed and updated periodically to ensure that it is sufficient. Each file or bundle is also password protected.
The Bundle Business Ltd can accept no liability for the exposure of information before it is uploaded or once it has been downloaded from our website by those who use our service. Therefore we recommend that our clients have policies on the appropriate use and security of electronic information and, in particular, portable devices and ensure that their staff are properly trained in these matters.
We also recommend that in accordance with the guidance given by the Office of the Information Commissioner, where information for use in bundles is processed on laptops and other portable devices, those materials should be encrypted if they are likely to cause damage or distress to an individual (e.g. financial and medical information).
Furthermore:
- We aim to process personal data fairly and lawfully;
- We will only use the personal data given to us to perform the services requested;
- We only keep personal data in our care for a reasonable period or for so long as either the client or legislation permits; and
- We do not transfer personal data outside the EEA without consent.
The Bundle Business Ltd has a clear process to establish the identity of the businesses that instructs it in accordance with our Money Laundering Procedures. As part of that procedure information is gathered regarding the identity of the principals of the legal practices that instruct us. We are required by the Money Laundering Regulations to keep records of the due diligence checks made, and information held, on customers and details of transactions. Consequently personal information arising from these checks will be kept for 6 years from receipt. Records can include any of the following:
- original documents
- photocopies
- on microfiche
- in a scanned format
- computerised or electronic.
This website is the property of The Bundle Business Ltd. Registered office: Office 3, Mintsfeet Place, Mintsfeet Road North, Kendal Cumbria LA9 6LL. Registered in England with company number 6235551. VAT registration number: 946246210