Tetbury Advertiser GDPR compliance, policies and methodologies

     

1. We have a data protection compliance folder on the Tetbury Advertiser file system containing GDPR documentation - and we keep a record of consents to hold data via email. Our acquired customer data consists of customer names and business identities (where appropriate,) and email and postal address detail.
2. We note meetings on GDPR, and decisions made on GDPR, through our usual meeting and minutes process via Tetbury Lions.
3. The Advertiser data protection officer is the Tetbury Advertiser Editor.
4. Our data is Mapped into two categories:
5. A)           customers with running advertisements – “Accounts”
   B)            archived non-personal advertising material,"Libraried."
   The purpose of these categories is firstly ("A") to bill, track and occasionally incentivise customers to re-advertise, (issue by issue, or yearly for "repeat" events,) and secondly ("B",) to retain advertising material for potential re-use by customers who are no longer running “active” advertisement material.
6. We assert the lawful basis for both these categories, chiefly through (although not restricted to,) items a, b and c of article 6 of the GDPR. The specific terms from the act state:
   
   (a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
   (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
   (c) processing is necessary for compliance with a legal obligation to which the controller is subject.
   ​
7. We practice a policy of refreshed consent where necessary.
8. We have a policy to handle any data subject access requests.
9. We have a policy to handle any data erasure or corrections requests.
10. We are prepared to document non-compliance issues and risk mitigation. 
11. We have a password policy for users of the Accounts system, web site and collection and preparation equipment used for the Advertiser.
12. We have contacted our database of current and previous customers to ask them to opt in to our data retention.
13. We have a retention schedule for data, in respect of both active customer data and archive advertisement information. We minimise the data we hold. Accounts data is held for six years, in keeping with prudent practice.
    “Front End” contact information is retained for two years, to preserve contract details and allow contact with customers with their permission. Library information (which is non-personal advertising material) is retained for seven years.   
14. Our staff and volunteers all understand what constitutes personal data.
15. Our staff and volunteers can identify a breach and how to avoid email scams, phishing processes and so on.
16. We have a breach response policy.
17. We hold a data breach log to record events.
18. Our website does not require HTTPS security, since it is for information only, currently. If it develops into a vehicle for payment processing and pass-through in the future, we will re-visit requirements.
19. Our office computers are encrypted using “security by design.”
20. We review the physical security of our data regularly; disks, paper filing systems and all other retention is “behind lock and key.”
21. We hold an asset register of the serial numbers of our computers.
22. We have a register of individuals with access to the data on each device.
23. We securely lock away any data.
24. We have a privacy policy – this document - which includes identity of the data protection officer, the purpose of the processing and the legal basis, the legitimate interest, any recipient or categories of recipients of the personal data, the right to withdraw consent at any time, and the data retention period.
25. We have an ongoing consultation procedure to re-visit our processes, both technical and legal, in case of a new requirement,  to take simple further steps before we are fully compliant, or to retain compliance.
26. The Tetbury Advertiser employs a proprietary Accounts system called “Xero” - a modern cloud-based system with built-in scheduled backup and restoration processes. Security and data protection is inherent in the design. We employ Google’s “My Drive” functionality for front-end transactions, giving excellent restore facilities, and a mapped transfer protocol for emails between a site alias [email protected] and Yahoo’s mail service. Both enjoy an excellent reputation for password-protected data integrity.
27. “Xero” enjoys its own virus protection; operations conducted via laptop and desk-based connectivity for front-end communications all employ freeware solutions from AVG at the minimum to ensure transfer integrity and antivirus capability. No unprotected devices are permitted to access data. 
28. The Tetbury Advertiser employs an online payment (gateway) system from "EVO Payments International." This client-based software is fully HTTPS protected and proprietary. Please see the website https://www.evopayments.co.uk/ for more information about their pass-through features and data protection. They are fully 25 and GDPR compliant. We go through a process, yearly,  of attestation with EVO to confirm our compliance with PCI DSS the Payment Card Industry Data Security Standard.
29. Please contact the Advertiser Data Protection Officer - the editor - if you would like more specific details about any of the procedures or policies set out in this document, via email address [email protected]