PRIVACY POLICY

As stated previously, we may send you relevant marketing communications on the basis of growing our practice, which is within our legitimate interest. Where we wish to send you general and non-specific marketing communications, we will always do this on the basis of your consent. You are within your rights to request that we stop sending you marketing communications entirely. You can do this by contacting us directly.

​

The Privacy and Electronic Communications Regulations (PECR) permits us to communicate with you for marketing purposes if:

You are a customer or expressed interest in using our services.
You have explicitly opted-in to marketing communications from us and:
You haven’t since withdrawn that consent
Your consent is still deemed relevant e.g you have been in contact within a certain period of time.

 

After 12 months of no contact, we will deem your consent ‘expired’. Similarly, we would deem your expression of interest no longer relevant because we would deem that your interest has ‘faded’. Both have the same effect as explicitly withdrawing consent – that is, after which, we will erase any of your data collected.

​

As stated, you may request that we stop sending you marketing communications outright at any time. Use the contact details at the top of this document to contact us if you wish to request this.

​

We will never send you unsolicited (non-relevant) marketing emails or texts. All marketing communications are delivered after, and only after, you, the individual, initiates a prospective customer relationship with Dr MCas.

Data Processor Arrangements

As a data processor, we have a contractual obligation to process data that has been provided to us by a client. We may process personal information provided to us by a data controller only for the purpose it was collected, as stated by the data controller in their own privacy policy.

​

This will be the case if information is provided by a data controller to process, whether this is automatic or consciously.

​

As part of this arrangement, under the GDPR we would operate as a data processor and our client the data processor when handling such data. As such, if you wish to exercise your rights as a data subject, the first person to contact would be the data collector. However if you wish to exercise your rights as a data subject and contact us at hello@drmcas.com regarding data we process, we would contact the data controller in the first instance pertaining your request.

​

Who Processes Your Data

​

To perform all business functions, we may need to share some of your personal data to third-party data processors:

General advisors for advisory and auditing purposes, such as solicitors and accountants
The HMRC for tax and financial reporting
Government bodies that legally require us to report on our activities in general
CRM software supplier – XXXXXXXX
Analytics software supplier for website usage analysis – Google Analytics
Facebook advertising platform, for advertising and marketing measurement
Google Ads for pay-per-click advertising and results measurement
Cloud file storage and sharing – Dropbox, Google Drive
Email marketing software – XXXXXXXXXX
And, if we decide to sell the business, a third party and their chosen third parties would be required to audit the business

​

International Processors

Some of our processing requires transfer of your personal information outside of the European Economic Area (EEA).

​

Companies within countries that fall outside of the EEA are not obliged to implement the protections of the DPA and GDPR. As such, EU law has banned the transfer of personal information to companies outside of the EEA where those companies do not comply with new data privacy regulations.

​

As such, all of our data processors that are outside of the EEA have agreed, via a Data Processor Agreement, to comply with the protections of the GDPR, reside in a country that European lawmakers have determined provide strong enough protections of personal data or we use, in the case of a processor in the United States, processors that fall under the EU-US Privacy Shield, guaranteeing the same level of protections of personal data as the GDPR.

 

We will not use a processor that does not meet this criteria as part of our ongoing activities. If, in the event of one time processing, we will seek your explicit consent. That consent will only be relevant for that particular request.

 

Data Security

Our systems have been developed using Privacy by Design. Our business systems, as such, as built to protect your personal data from accidental loss, access, processing and mutation without the authority to do so.

​

Only those that have a need for a particular piece of your information have access to that information. Your personal data is only processed to our explicit instructions. All processing activity is kept confidential.

 

We have also proactively built business systems to handle any kind of potential or suspected breach of personal data that we are responsible for. If it is found your personal data has been breached, we will notify you and the appropriate regulator within three days. We will also inform you of the steps we had taken to prevent that and steps we have taken to recover/further protect your personal data.

 

Holding Your Data

As stated previously, we will hold your personal data for as long as we need it and no longer. Where feasible, we have stated how long we expect to hold the various categories of your personal data and the legal bases for doing so. Where we have been unable to provide a specific time period, we have given a global maximum timeframe for that category of data.

​

We use evidence from our own business activities, existing law and obligations to determine the appropriate length of time to hold your data. A major factor include how sensitive a piece of personal data is. That is, how much potential harm this personal information would cause if breached.

​

Some processors anonymise personal data. Where we can use pseudo-anonymisation, we will to reduce or eliminate the risk of privacy breaches.

 

Your Rights

Your privacy rights, which existed under the DPA, have been strengthened and amended under the GDPR. You have the right to, in relation to your data:

Request access
Correct
Erase
Restrict
Transfer
Object to processing
Portability
Withdraw consent

​

ICO explains your rights in more detail here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

 

You can contact us using the details at the beginning of this document to exercise any of your rights at any time.

 

Exercising your rights is free of charge. We can, however, refuse or charge for any requests that are deemed excessive, repetitive and/or unreasonable.

 

We will need to verify your identity to comply with any request(s) to exercise your rights. We will need some personal information to do so, strictly for the purposes of identity verification. Otherwise, this would leave your personal information vulnerable – something the GDPR aims to resolve. Unless a proxy is stated explicitly in a form that can be used as evidence, we will only ever comply with requests for the excision of rights with regards to your personal data by you only.

​

All requests should be resolved within one month. This, however, may take longer for requests that require a more complex resolution. We will inform you of any delays that may be required, along with justification.

 

You have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we process your personal data. ICO is a body that supervises and enforces privacy laws in the UK. Please visit their website at www.ico.org.uk for more information. We do request that you contact us first with any concerns. We recommend contacting ICO if you are still unsatisfied after attempting to resolve any issues with us directly.

​

External Hyperlinks

On our website we may link to other websites that provide more information on a specific topic discussed on this website. By clicking any of those links, the contents of this privacy policy does not apply to your data processing on the websites that we link to. You must refer to the privacy policy on those websites which are out of our control. We will endeavour to link to reputable, well-maintained websites.

 

Cookie Policy

Some parts of our website may not function correctly without cookies. You can view our existing cookie policy here: Cookie Policy