Individual Rights Policy

Controller: Signwaves Limited
Controller’s Representative: Bob Brown

Right to be informed
Individuals have the right to be informed about the collection and use of their personal data. Signwaves limited will provide individuals with information including: the purposes for processing their personal data, the retention periods for that personal data, and who it will be shared with. This is called ‘Privacy Information’.

This privacy information will be provided to individuals at the time their personal data is collected from them. Where Signwaves Limited obtains personal data from other sources, it will provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.

Privacy Information will not be provided when an individual already has the information or if it would involve a disproportionate effort to provide it to them.

Any new uses of an individual’s personal data will be bought to their attention before processing begins.

Right of Access.
Individuals have the right to access their personal data and supplementary information held by Signwaves Limited. The right of access allows individuals to be aware of and verify the lawfulness of the processing.

Individuals have the right to obtain: 

• Confirmation that their data is being processed;
• Access to their personal data; and
• Other supplementary information – this largely corresponds to the information as provided in Signwaves Data Protection Policies and Privacy Notices

Right to Rectification
Individuals have the right to have inaccurate personal data rectified, or completed if it is incomplete. An individual can make a request for rectification verbally or in writing. When a request for rectification is received, Signwaves Limited will take reasonable steps to satisfy itself that the data is accurate and will rectify the data if necessary. Signwaves Limited will take into account the arguments and evidence provided by the data subject.

If appropriate to do so, Signwaves Limited will restrict the processing of the individuals data whilst the accuracy of the data held is being checked.

Where Signwaves Limited is satisfied that the personal data is accurate, the individual will be notified and told that the data will not be amended. In such instances, an explanation will be provided to the individual, informing them of their right to complain to the supervisory authority and to a judicial remedy without undue delay and at the latest within one month.

It will be recorded in Signwaves Limited’s system, that the individual challenges the accuracy of the data and their reasons for doing so.

Right to Erasure (or ‘Right to be Forgotten’)
Individuals have the right to have personal data erased. This right is not absolute and only applies in certain circumstances. An individual can make a request for erasure verbally or in writing.

Individuals have the right to have their personal data erased if:

• The personal data is no longer necessary for the purpose which it was originally collected or processed for;
• Signwaves Limited is relying on consent as the lawful basis for holding the data, and the individual withdraws their consent;
• Signwaves Limited is relying on legitimate interests as the basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
• Signwaves Limited is processing the personal data for direct marketing purposes and the individual objects to that processing;
• Signwaves Limited is processing the personal data unlawfully (i.e. in breach of the lawfulness requirement of the 1st principle);
• To comply with a legal obligation; or
• Signwaves Limited has processed the personal data to offer information society services to a child.

 If the personal data has been shared with other organisations then Signwaves Limited will contact those recipients and inform them of the required erasure unless this proves impossible or involves disproportionate effort. If asked, Signwaves will inform individuals about these recipients.

The right to erasure does not apply if processing is necessary for one of the following reasons:

• To exercise the right of freedom of expression and information;
• To comply with a legal obligation;
• For the performance of a task carried out in the public interest or in the exercise of official authority;
• For archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or
• For the establishment, exercise or defence of legal claims.

Right to Restrict Processing
Individuals have the right to request the restriction or suppression of their personal data. This is not an absolute right and only applies in certain circumstances. When processing is restricted, Signwaves Limited will store the personal data, but not use it. An individual can make a request for restriction verbally or in writing.

Individuals have the right to request restriction in processing of their personal data in the following circumstances:

• The individual contests the accuracy of their personal data and you are verifying the accuracy of the data;
• The data has been unlawfully processed (i.e. in breach of the lawfulness requirement of the first principle of the GDPR) and the individual opposes erasure and requests restriction instead;
• Signwaves Limited no longer needs the personal data but the individual needs Signwaves Limited to keep it in order to establish, exercise or defend a legal claim; or
• The individual has objected to Signwaves Limited processing their data under Article 21(1), and Signwaves Limited is considering if its legitimate grounds override those of the individual.

If the personal data has been shared with other organisations then Signwaves Limited will contact those recipients and inform them of the required restriction unless this proves impossible or involves disproportionate effort. If asked, Signwaves will inform individuals about these recipients.

In most cases the restriction of processing is only temporary, specifically when the restriction is on the grounds that:

• The individual has disputed the accuracy of the personal data and Signwaves Limited is investigating this; or
• The individual has objected to Signwaves Limited processing their data on the basis that it is necessary for the performance of a task carried out in the public interest or the purposes of Signwaves Limited’s legitimate interests, and Signwaves Limited is considering if its legitimate grounds override those of the individual.

Once Signwaves Limited has made a decision on the accuracy of the data, or if its legitimate grounds override those of the individual, Signwaves Limited may decide to lift the restriction. In such instances Signwaves Limited will inform the individual before the restriction is lifted.

Right to Data Portability
Individuals have the right to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability

The right to data portability only applies:

• To personal data an individual has provided to Signwaves Limited;
• Where the processing is based on the individual’s consent or for the performance of a contract; and
• When processing is carried out by automated means.

Signwaves Limited may be able to transmit the data directly to another organisation if this is technically feasible. Signwaves Limited will not adopt or maintain processing systems that are technically compatible with other organisations in order to fulfil this request.

Right to Object
Individuals have the right to object to:

• Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
• Direct marketing (including profiling); and
• Processing for purposes of scientific/historical research and statistics.

If the personal data in question is for the performance of a legal task or Signwaves Limited’s own legitimate interests, it will continue to be used as long as:

• It can be demonstrated that there are compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or
•  The processing is for the establishment, exercise or defence of legal claims.

Where personal data is used for direct marketing purposes this will cease as soon as an objection is received.

Where personal data is used for research purposes, individuals must have “grounds relating to his or her particular situation” in order to exercise their right to object to processing for research purposes.

If Signwaves Limited is conducting research where the processing of personal data is necessary for the performance of a public interest task, an objection to the processing need not be complied with.

Rights related to automated decision making including profiling
Signwaves Limited does not use any form of automated decision making or profiling tools, therefore no policy is required for this area of individual rights.

Responding to an ‘Individuals Rights’
Request Any request s will be carried out free of charge unless the request is manifestly unfounded or excessive in which case a reasonable fee will be applied.

A response will be provided at the latest within one month of the request. This period of compliance may be extended by a further two months where requests are complex or numerous. If this is the case, individuals will be notified within one month of the receipt of the request and explained why the extension is necessary.

If the request is manifestly unfounded or excessive, Signwaves Limited may refuse to respond. In such instances, an explanation will be provided to the individual, informing them of their right to complain to the supervisory authority and to a judicial remedy without undue delay and at the latest within one month.

Before providing an individual with any data, reasonable means will be taken to identify the person making the request. All information requested will be provided using a commonly used electronic format.