The Data Subject has the Right to be Informed and obtain the following information, to give the opportunity to understand how and why their data is being used and that it is being handled lawfully.
Name and Contact details of our Organisation – Arkay Education, C/O Ross Krise, firstname.lastname@example.org
The Data Protection Officer contact details if required, see IOC.org.uk
The Purpose of the Processing being for business interests, the necessity deriving from the need to process the information to pursue the business interests, the interests of the Data Subject do not override the business interests given the information is already in the public domain. The Lawful Basis of the Processing being Legitimate Interest. Using Data collected from the public domain in a professional manner where there is legitimate interest. In this instance providing information of Schools related products or services that relate to the job role of the Data Subject at the school.
The Categories of Personal Data obtained being name, job title and email address.
The Retention Period for the personal data being until notification by post or email, that the address or recipient is no longer valid.
The Right of Access – The Data Subject has the right to obtain a copy of their personal data which must be provided within one month of request.
The Right to Erasure – The Data Subject has the right to have their personal data erased within one month if: The personal data is no longer valid for the purpose which you originally processed it. There is no overriding legitimate interest to continue the processing. The processing is for direct marketing purposes and the Data Subject has a legitimate Right to Object.
The Right to Object – The Data Subject has the right to object to the processing of their personal data if it is for direct marketing purposes, which must be dealt with within one month. The Data Subject must give specific reasons why they are objecting, these reasons should be based upon their particular situation. This can be refused if the Data Controller can demonstrate legitimate interests for the processing, which do not override the interests, rights and freedoms of the Data Subject.