Data Protection

Elite Admin Services Ltd, trading as EAS Finance – (Referred to as ‘the company’)

Introduction

The Company needs to gather and use certain information about individuals. This can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact. This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards — and to comply with the law.

Why this policy exists

This data protection policy ensures the company:

  • complies with data protection law and follows good practice
  • protects the rights of all individuals’ data
  • is open about how it stores and processes individuals’ data in line with individuals’ rights
  • protects itself from the risks of a data breach

Data Protection Law

The General Data Protection Regulations describe how organisations must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically or otherwise.

To comply with the law, personal information must be:

  • processed lawfully, fairly and in a transparent manner in relation to individuals
  • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
  • accurate and, where necessary, kept up to date
  • kept in a form which permits identification of data subjects for no longer than is necessary
  • processed in a manner that ensures appropriate security of the personal data

Record Keeping

A range of information must be detailed in our internal records of processing activities, including: name and details of the organisation; purposes of processing the data; description of the categories of individuals and personal data; categories of recipients of personal data; details of transfers to third parties; retention schedules; and technical and organisational security measures.

Individuals’ data is kept on file for 6 years in line with the Financial Conduct Authority’s record-keeping rules. After this point, personal data is anonymised and used for statistical purposes only.

Lawful Basis for Processing Data

The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever the company processes personal data:

(a) Consent: the individual has given clear consent for a specific purpose. (b) Contract: the processing is necessary for a contract with the individual. (c) Legal obligation: the processing is necessary to comply with the law. (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary to perform a task in the public interest. (f) Legitimate interests: the processing is necessary for the legitimate interests of the company or a third party.

The company processes data on the basis that it is requested from individuals before entering into a contract (for example, to provide a quote for finance).

Responsibilities

The company acts as both data Controller and data Processor. Although a Data Protection Officer has not been formally appointed (as the company does not fall within the statutory scope), the Directors and Owners are accountable for compliance with GDPR.

Individuals’ Rights

Under GDPR, individuals have the following rights: the Right to be Informed; the Right of Access; the Right to Rectification; the Right to Erasure; the Right to Restrict Processing; the Right to Data Portability; the Right to Object; and rights in relation to automated decision making and profiling.

The company provides every customer with a Privacy Notice at the point data is captured.

Subject Access Requests (SAR)

Individuals may request confirmation that their data is being processed, access to their personal data, and other supplementary information. The company will provide this free of charge within one month (extendable to two months for complex requests).

Data Security and Storage

Paper records are kept in secure, locked storage. Electronic data is protected by strong passwords, stored on designated drives and approved cloud services, backed up regularly, and protected by approved security software and firewalls. Personal data is never transferred outside the European Economic Area without adequate contractual safeguards.

Contact

For data protection enquiries: service@easfinance.co.uk | +44 (0)20 8191 3164

Elite Admin Services Ltd is registered with the Information Commissioner’s Office. Data Protection Number: ZB799371.