Jannah Express Limited (the Employer) is committed to ensuring that all personal data handled by us will be processed according to legally compliant standards of data protection and data security.
We confirm for the purposes of the data protection laws, that the Employer is a data controller of the personal data in connection with your employment. This means that we determine the purposes for which, and the manner in which, your personal data is processed.
The purpose of this Policy is to help us achieve our data protection and data security aims by:
This is a statement of policy only and does not form part of your contract of employment. We may amend this Policy at any time, in our absolute discretion.
Staff whose work involves using personal data must comply with this Policy and the following principles:
Processed lawfully, fairly and in a transparent manner.
Collected only for specified, explicit and legitimate purposes.
Adequate, relevant and limited to what is necessary.
Accurate and kept up to date.
Kept only as long as necessary.
Kept secure, using appropriate technical and organizational measures.
Maintaining appropriate standards of data protection and data security is a collective task shared between us and you.
This Policy applies to all staff: employees, directors, officers, consultants, contractors, casual or agency staff, trainees, homeworkers, fixed-term staff, and volunteers.
Questions should be directed to the Data Protection Officer (DPO).
All staff have personal responsibility to comply with this Policy. Managers must lead by example and ensure compliance.
Any breach of this Policy may result in disciplinary action, up to and including dismissal.
This Policy covers personal data which:
relates to a living individual who can be identified,
is stored electronically or on paper,
includes statements of opinion as well as facts,
relates to staff, customers, suppliers or third parties,
is obtained, stored, used, disclosed, amended, retrieved, transferred, or destroyed by Jannah Express Limited.
We collect personal data about you which:
you provide before or during employment,
is provided by third parties (references, suppliers, etc.), or
is publicly available.
This may include:
home address and contact details (including next of kin),
recruitment information (applications, CVs, references, qualifications),
pay, tax, NI number, pensions, health insurance,
communications usage (email, internet, telephone),
performance, professionalism and reliability records,
disciplinary, grievance, complaint and concern records.
We may process sensitive personal data only where:
we have a lawful basis, and
one of the special conditions applies (e.g., explicit consent, legal rights, protection of vital interests, public information, legal claims, or substantial public interest).
The DPO must approve any processing of sensitive data.
Handled in accordance with our Criminal Records Information Policy.
We will tell you why we process your data in our Privacy Notice. Typical uses include:
Staff address lists
Sickness records
Monitoring IT systems
Disciplinary, grievance, legal or compliance matters
Performance reviews
Equal opportunities monitoring
Necessary business checks inside and outside the UK
We will ensure that:
Data is accurate, up to date, adequate and relevant.
Data obtained for one purpose will not be used for another unless agreed or reasonably expected.
If data is inaccurate, we will correct it promptly.
Personal data will be kept securely in accordance with our Data Retention Policy.
Retention periods are set out in our Privacy Notice.
You have the following rights regarding your personal data:
Subject Access Requests (SARs): you may request details of the data we hold about you, who it is shared with, how long it is retained, and more.
Other rights: you can require us to rectify inaccurate data, stop processing or erase data, or restrict processing.
Requests should be sent to: booking@jannahexpress.co.uk
We will:
Ensure only authorised people access personal data.
Use pseudonymisation or encryption where possible.
Protect against unauthorised access, loss or destruction.
Require third-party processors to comply with equivalent security standards.
Security procedures include:
Locking desks and cupboards with confidential information.
Strong, regularly updated passwords.
Encryption of portable storage (USBs, CDs, memory sticks).
No saving of data directly to personal devices.
Servers secured and backed up.
Telephone identity checks before disclosure of information.
Shredding or destroying physical documents and storage devices when no longer needed.
Where processing creates a high risk, Jannah Express Limited will carry out a Data Protection Impact Assessment.
Any data breach posing risks to individuals’ rights will be reported to the ICO within 72 hours.
All breaches will be recorded.
Affected individuals will be notified if the risk is high.
Personal data may be transferred outside the UK or EEA where necessary for business.
Transfers will only occur with adequate protections in place.
Staff must:
Keep personal data accurate and up to date.
Report changes in personal data (address, bank details, etc.).
Only access and disclose data where authorised.
Keep data secure.
Not store work data on personal devices without encryption or password protection.
All staff will receive training on data protection responsibilities during induction and at regular intervals.
Staff with special responsibilities (e.g., handling SARs) will receive additional training.
This Data Protection and Data Security Policy was created using a document from Rocket Lawyer (https://www.rocketlawyer.com/gb/en).
