We are committed to the principles inherent in the GDPR and particularly to the concepts of privacy by design, the right to be forgotten, consent and a risk-based approach. In addition, we aim to ensure:
Our Data Protection Officer (DPO), who works to promote awareness of the GDPR throughout Whisk Creative and The SHARP System. Our DPO oversees the Group’s commitment to best practice and inform and advise the Group and monitors compliance.
Right to be forgotten
We recognise the right to erasure, also known as the right to be forgotten, laid down in the GDPR.
Subject access requests
We recognise that individuals have the right to access their personal data and supplementary information and will comply with the one-month timeframe for responses set down in the GDPR. As a rule, a copy of the requested information will be provided free of charge although we reserve the right to charge a “reasonable fee” when a request is manifestly unfounded or excessive, particularly if it is repetitive. If this proves necessary, the data subject will be informed of their right to contest our decision with the supervisory authority (the Information Commissioner’s Office (ICO)).
As set out in the GDPR, any fee will be notified in advance and will be based on the administrative cost of providing the information.
We will implement data protection “by design and by default”, as required by the GDPR. Safeguards will be built into products and services from the earliest stage of development and privacy-friendly default settings will be the norm. The privacy notice, which is on our website and which is provided to anyone from whom we collect data, explains our lawful basis for processing the data and gives the data retention periods. It makes clear that individuals have a right to complain to the ICO. We have conducted a privacy impact assessment (PIA) to ensure that privacy risks have been properly considered and addressed.
Privacy Information Notices
Data transfers outside the EU
We have put recognised procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of any personal data that is transferred to countries outside the EU. Diligence checks are carried out to ensure that such countries have the necessary safeguards in place, provide enforceable data subject rights and offer effective legal remedies for data subjects where applicable.
The GDPR provides for special protection for children’s personal data and we will comply with the requirements stated by law. No data is shared, nor will any data be used for marketing purposes. The SHARP System falls under “an online service that is a preventive or counselling service.” We design our processing with children in mind from the outset, and use a data protection by design and by default approach.
If a data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, the people affected will be informed as soon as possible and the ICO will be notified within 72 hours.
The SHARP System is the property of – Obitek Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF Company No – 15215584