Your rights under the new data protection legislation

Under the new data protection legislation, a number of rights for individuals are enhanced when we process your personal data.

1. The right to be informed

We need to tell you clearly how we are processing your personal data. Privacy notices are available on the individual web pages and forms for our services.

2. The right of access

Subject Access Requests

Under the Data Protection Act, you have a statutory right to ask what personal information Hoople holds about you and what it uses that information for, subject to certain exemptions.

To help us carry out your request, please carefully complete our Subject Access Request form, read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

3. The right to rectification

You are entitled to have any inaccurate or incomplete personal data rectified.

Where the personal data in question has been disclosed by us to third parties, we must, wherever possible, also inform them of the rectification.

To help us carry out your request, please carefully complete our Right to Rectification form, explaining what the information is and why you believe it is inaccurate or incomplete. You must then read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

We will respond to your request within one month, extended by two months where the request for rectification is complex. Where no action is being taken in response to your request for rectification, we must explain the reasons for this to you. To request this please email data.protection@hoopleltd.co.uk. If you are not satisfied, you have a right to complain to the Information Commissioner’s Office.

4. The right to erasure

You can request the deletion or removal of personal data verbally or in writing where there is no compelling reason for its continued processing. You have the right to erasure in the following circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
• When you withdraw consent, if we have used your consent to process your personal data
• The personal data was unlawfully processed
• The personal data is required to be erased in order to comply with a legal obligation

Hoople has the right to refuse a request for erasure where the personal data is being processed for the following reasons:

• To comply with a legal obligation or for the performance of a public interest task or exercise of official authority
• For public health purposes in the public interest
• For archiving purposes in the public interest, scientific research, historical research or statistical purposes
• The exercise or defence of legal claims

Where personal data has been disclosed to third parties, we will inform them about the erasure of the personal data, unless it is impossible or involves disproportionate effort to do so.

Where personal data has been made public within an online environment, we will inform other organisations who process the personal data to erase links to and copies of the personal data in question.

To help us carry out your request, please carefully complete our Right to Erasure form, read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

5. The right to restrict processing

You have the right to block or suppress Hoople’s processing of your personal data. In the event that processing is restricted, we must store the personal data, but not further process it, guaranteeing that just enough information about you has been retained to ensure that the restriction is respected in future.

Hoople will restrict the processing of personal data in the following circumstances:

• Where you contest the accuracy of the personal data, processing will be restricted until Hoople has verified the accuracy of the data
• Where processing is unlawful and you oppose erasure and request restriction instead
• Where Hoople no longer needs the personal data but the individual requires the data to establish, exercise or defend a legal claim

If the personal data in question has been disclosed to third parties, we must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.

We will inform you when a restriction on processing has been lifted.

To help us carry out your request, please carefully complete our Right to Restrict Processing form, read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

6. The right to data portability

You have the right to obtain and reuse your personal data for your own purposes across different services in some circumstances. We will move your personal data from one IT environment to another in a safe and secure manner, without hindrance to usability.

The right to data portability only applies however in the following cases:

• To personal data that you have provided to us
• Where the processing is based on your consent or for the performance of a contract
• When processing is carried out by automated means

Personal data will be provided in a structured, commonly used and machine-readable form. We will provide the information free of charge to you or where feasible, data will be transmitted directly to another organisation at your request.

Hoople is not required to adopt or maintain processing systems which are technically compatible with other organisations.

In the event that the personal data concerns more than one individual, we need to consider whether providing the information would prejudice the rights of any other individual.

We will respond to any requests for portability within one month. Where the request is complex, or a number of requests have been received, the time-frame can be extended by two months, ensuring that you are informed of the extension and the reasoning behind it within one month of the receipt of your request.

Where no action is being taken in response to a request, we must explain to you the reason for this. You have a right to then complain to the Information Commissioner’s Office if you are not satisfied by this.

To help us carry out your request, please carefully complete our Right to Data Portability form, read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

7. The right to object

You have the right to object to the following:

• Processing based on the performance of a task in the public interest
• Direct marketing
• Processing for purposes of scientific or historical research and statistics

Where personal data is processed for the performance of a legal task:

• Your grounds for objecting must relate to your particular situation
• We must stop processing your personal data unless the processing is for the establishment, exercise or defence of legal claims

Where personal data is processed for direct marketing purposes:

• We must stop processing personal data for direct marketing purposes as soon as an objection is received
• We cannot refuse your objection regarding data that is being processed for direct marketing purposes

Where personal data is processed for research purposes:

• You must have grounds relating to your particular situation in order to exercise your right to object
• Where the processing of personal data is necessary for the performance of a public interest task, we are not required to comply with an objection to the processing of the data
• Where the processing activity is outlined above, but is carried out online, we must offer a method for you to object online

To help us carry out your request, please carefully complete our Right to Object form, read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

8. Automated decision making and profiling

You have the right not to be subject to a decision when:

• It is based on automated processing, e.g. profiling
• It produces a legal effect or a similarly significant effect on you

We must take steps to ensure that you are able to obtain human intervention, express your point of view, and obtain an explanation of the decision and challenge it if we use automated processing.

When automatically processing personal data for profiling purposes, we must ensure that the appropriate safeguards are in place, including:

• Ensuring processing is fair and transparent by providing meaningful information about the logic involved, as well as the significance and the predicted impact
• Using appropriate mathematical or statistical procedures
• Implementing appropriate technical and organisational measures to enable inaccuracies to be corrected and minimise the risk of errors
• Securing personal data in a way that is proportionate to the risk to the interests and rights of the individual and prevents discriminatory effects

Automated decisions must not concern a child or be based on the processing of sensitive data, unless:

• We have your explicit consent
• The processing is necessary for reasons of substantial public interest on the basis of UK law

To help us carry out your request, please carefully complete our Automated Decision Making and Profiling form, read and sign the declaration and send the completed form, along with proof of identity to Hoople Ltd.

For further information regarding your data protection rights, email Hoople’s Data Protection Officer with your request via data.protection@Hoopleltd.co.uk