/01. IncentiveDirect privacy policy.
In light of the farrago that is the Child benefit records loss scandal, we have taken a look at our processes and procedures regarding data protection and security.
Obviously in order to manage iD-points, we hold details of all end users in the system, numbering in the thousands, and can access their statement, order history, and other details. We also hold details about our clients and suppliers. We take great care to ensure that this data is secure, and backed up every day.
Unlike HMRC, we would certainly never export unencrypted records of end users in the system, and burn them onto CD and send them to someone, or e-mail them.
We are registered (Z8756461) as a data controller with the Information Controllers Office, and are bound by terms of the Data Protection Act (1984). You can look us up on the ICO site here.
On the ICO site you can also view the 8 basic principles of Data Protection, and best practice guidelines. While we are happy that we meet these principles, we will be review our processes to ensure we are following best practice.
One of the provisos of this act, is that any one can request to see what information we hold about them. But generally speaking this is no more than they can access themselves via their End User log-in.
Where we do need to tread more carefully is the information we supply to Supervisors regarding their End Users activities. Currently we do not allow Supervisors to see a list of End User passwords, because of the potential security risks involved, and nor do we allow Supervisors to see a list of purchases made by an End User, for privacy reasons. However, there may be valid reporting and operational issues why we should open this information up. We would like to hear from our clients what their feelings are on these matters. Would being able to see End User passwords help? Would you like to see reports on who has ordered what?
|
