This notice sets out how Panira collects, uses and protects personal data, in line with UK data protection law.
We aim to ensure that all personal data and special category data provided to us is stored and processed in accordance with the UK Data Protection Act 2018 and UK GDPR.
This applies to all data, regardless of whether it is in paper or electronic format.
This notice meets the requirements of UK data protection law, and is based on guidance published by the Information Commissioner's Office. UK data protection law consists primarily of:
Our directors have overall responsibility for ensuring that we comply with our data protection obligations. Day-to-day responsibility rests with our Data Protection Officer, who ensures that the team is aware of its data protection obligations and oversees any queries related to the storing or processing of personal data.
Personal data — data from which a person can be identified, including data that, when combined with other readily available information, leads to a person being identified.
Special category data — data such as:
This does not include personal data about criminal allegations, proceedings or convictions, as separate rules apply.
Processing — obtaining, recording or holding data.
Data subject — the person whose personal data is held or processed.
Data controller — a person or organisation that determines the purposes for which, and the manner in which, personal data is processed.
Data processor — a person, other than an employee of the data controller, who processes the data on behalf of the data controller.
Personal data is:
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us if you wish to make a request.
We hold personal data about the people who request a read, use the platform, or engage with us as clients or professional contacts, so that we can deliver our products and services.
Where you request a sample or full Outside-In read through the site, we collect your work email, your company web address and, optionally, your position in the company, and use this only to produce and deliver the read you asked for. This information is kept for no longer than 12 months from the date of contact, unless you become a client, in which case it is retained for the duration of the engagement.
Where an Inside Out engagement gives us access to your own data, that data is handled under the terms agreed with you and set out at Security & Trust, entirely within your own environment or through a secure, access-controlled data room, and is never used for any purpose beyond the engagement.
The lawful basis for the processing is contractual (clients) and legitimate interest (enquiries and sample reads).
We may engage consultants or third-party service providers ("processors") to carry out specific data processing activities on our behalf, including infrastructure and hosting partners. Such parties:
We only appoint processors that provide sufficient guarantees to meet the requirements of UK data protection law.
Paper-based records, digital records and portable electronic devices that contain personal information all comply with UK data protection law and are regularly assessed by our Data Protection Officer. Destruction and archiving of personal data follow the same standard. Further detail on our technical security posture is set out at Security & Trust.
If you feel that we have mishandled your personal or special category data at any time, in the first instance, please contact our Data Protection Officer.
You can also contact the Information Commissioner's Office by visiting their website (ico.org.uk/make-a-complaint) or by calling their helpline on 0303 123 1113. The ICO expects an individual to address any complaint with us before contacting them.