Narnie’s Autumn Breeze privacy notice
This privacy notice tells you what to expect us to do with your personal information.
Contact details
Contact Elana Jobson (business owner) at narniesautumnbreeze@gmail.com
What information we collect, use, and why
We collect or use the following information to provide services and goods:
- Names and contact details
- Information relating to compliments or complaints
- Information relating to contracts and invoices
Lawful bases
Our lawful bases for collecting or using personal information to provide services and goods are:
- Consent
Where we get personal information from
- People directly
How long we keep information
See data retention policy below
Your data protection rights
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal data.
Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent.
You don’t need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Last updated 18/07/2024
DATA RETENTION POLICY WITH SCHEDULE
of Narnie’s Autumn Breeze
Introduction
As part of the day-to-day running of my business, I collect and process personal data from a variety of sources. This personal information is collated in several different formats including letters, emails, legal documents, operations records, and statements. The personal data may be stored both as a hard copy or in electronic form.
Aims of the policy
I will ensure that the personal data I hold is kept secure and is held for no longer than is necessary for the purposes for which it is being processed. In addition, I will retain the minimum amount of information to fulfil statutory obligations and the provision of goods or/and services – as required by data protection legislation, including the General Data Protection Regulation (GDPR).
Retention
This retention policy (along with its schedule), is a tool used to assist me in making decisions on whether a particular document should be retained or disposed of. In addition, it takes account of the context within which the personal data is being processed and my business practices.
Decisions around retention and disposal are to be taken in accordance with this policy.
Responsibility
I, Elana Jobson am responsible for keeping this retention schedule up to date in order to reflect changing business needs, new legislation, changing perceptions of risk management and new priorities for our business.
I am responsible for determining (in accordance with this Policy) whether to retain or dispose of specific documents.
Storage
Due to only selling physically I do not need to collect any personal information at the point of sale, like names, addresses or contact information.
Physical records will be stored according to date to make finding any personal information to be destroyed easy to locate at the time of its disposal. Non-sensitive records will be stored in a file, and sensitive records in a locked document box. Digital records in the from of emails will be labelled when they arrive (once a week I will check all new emails have been labelled where appropriate). These labels will be used to locate email that need to be deleted. Data downloaded onto my laptop (or any other device) will have its record type and storage location noted in a document (this document will not contain any of the personal data) allowing the data to be located when it requires disposal. If any other information needs to be stored in a way not outlined below I will document the category of the information and where it is stored to ensure its deleted appropriately. My privacy policy and data retention information will be kept updated as appropriate.
Disposal
My business must ensure that personal data is securely disposed of when it is no longer needed. This will reduce the risk that it will become inaccurate, out of date or irrelevant.
The methods of disposal are to be appropriate to the nature and sensitivity of the documents concerned and include:
- Non-Confidential records: place in waste paper bin for disposal
- Confidential records: shred documents
- Deletion of computer records including laptop backups onto exterior hard drives
- Deletion of emails and email contacts
The table below contains the retention period that we have assigned to each type of record. This will be adhered to wherever possible, although it is recognised that there may be exceptional circumstances which require documents to be kept for either shorter or longer periods.
Document retention schedule
This only includes the personal data I currently may wish to store. It will be updated if I wish to store any types of record not included.
Commercial contracts:
| Type of record | Retention period | Where is it stored? | Reason | Method of deletion |
| Contracts with markets | 6 years after last action | Depends on market – some may email contracts, resulting in digital storage in my email inbox, and a downloaded copy on my laptop hard drive. Others may give a paper copy, which will be filed, with a digital copy also being stored on my laptop hard drive. | To ensure contact obligations are met. Contains vital information about where, how and when I can trade. May also contain information needed for financial records. | Delete emails. Delete digital files from laptop and any duplicates on exterior hard drives. Bin physical documents, or shred if they contain sensitive information. |
| Contracts with suppliers | 6 years after last action | Stored digitally in email inbox. Important documents that I want to collate in my records may be downloaded onto my laptop hard drive. | To ensure contact obligations are met. May contain information needed for financial records. | Delete emails. Delete digital files from laptop and any duplicates on exterior hard drives. |
| Purchase orders and invoices | 7 years after purchase | Stored digitally in email inbox. May receive additional physical copy with order items, which will be filed. Non-personal data will be copied to financial records, which will be kept. | Needed for financial records and repeat purchases | Delete emails. Bin physical documents. |
Email records:
| Type of record | Retention period | Where is it stored? | Reason | Method of deletion |
| Customer correspondence | 2 years after last contact from same individual | Only in email inbox | Past conversations may be relevant to new enquiries. A problem may re-occur | Delete emails. Delete contact from email contacts |
Once a month I will check each type of record for any data past its retention period.
Date created: 18/07/2024
Narnie's Autumn Breeze 